Employee data from hire to exit is personal data that HR must handle under the PDPA. Most of it can rest on the employment contract or a legal obligation, but health data, fingerprints and criminal records are sensitive under Section 26. This is for HR teams, who get TDPG 4.0's advice on background checks, notice before monitoring, and retention after an employee leaves.
- Criminal records may be collected only where a law requires a check or with explicit consent (2023 PDPC Notification, clause 5).
- Health data cannot rest on the employment contract; it needs explicit consent or Section 26 (5), such as occupational medicine.
- TDPG 4.0 item S41: for fingerprint clock-in, the contract is not enough; consider less intrusive methods first.
- TDPG 4.0 item HR68: tell staff the purpose and scope before monitoring begins, unless covert monitoring is justified.
- Employees can request copies of their data under Section 30; the company must act within 30 days of the request.
Count the places where one employee leaves data with a company: an application with a photo, an ID card copy, a pre-employment medical, bank details for payroll, a fingerprint in the time clock, a work mailbox, CCTV footage at the front door, medical certificates for sick leave and a performance file every year.
Each of these rests on a different legal basis, some are sensitive data with stricter rules, and none of them disappears on the day the employee resigns. This article follows the working life stage by stage, reading the Personal Data Protection Act B.E. 2562 (2019), or PDPA, alongside the HR chapter of TDPG 4.0, which was written for human resources teams.
- Job advertIf the role needs a criminal record check, state the necessity at this stage2023 Notification clause 5 para. 2
- Application and interviewCollect only what is needed, explain how data will be verified, train interviewers on interview notesSection 23 · TDPG HR18–HR21
- Third-party checksOnly where necessary and no alternative exists; tell the candidate expresslyTDPG HR22–HR25
- HiringGive an employee privacy notice; use contract or legal obligation for core HR workSections 23 and 24
- During employmentHealth checks, time recording, monitoring, appraisalsSection 26 · TDPG HR63–HR98
- Exit and afterAnswer access requests and reference calls, keep data for set periods, then destroy itSection 30 · TDPG HR40–HR43 · HR60–HR62
Recruitment: what can you ask candidates for?
Only what the selection genuinely needs, with a Section 23 notice from the moment you receive the application. TDPG 4.0 item HR18 adds that candidates should be told early how the data they provide will be verified and whether third parties will be involved.
For information a candidate has made public, such as a work history on a jobs site, TDPG 4.0 item HR19 says the company may rely on legitimate interest to check accuracy, provided the impact is minor and the candidate could expect it.
Interview notes are personal data that the candidate can ask to see. TDPG 4.0 items HR20–HR21 therefore suggest training interviewers on what to write down, and deleting or destroying notes within a reasonable time to reduce the risk of discrimination claims.
How far can third-party background checks go?
Calling a former employer or hiring a screening firm is different from checking documents the candidate supplied. TDPG 4.0 item HR22 treats it as a more intrusive step with greater privacy risk.
For this reason, this type of check should only be carried out where the employer has a genuine need and no other alternative.
Where a check goes ahead, TDPG 4.0 item HR25 advises telling the candidate expressly, and relying on legitimate interest only if the company can show three things: a legitimate benefit, necessity with no less intrusive option, and an impact that is not excessive. Item HR18 also says a candidate must not be compelled to obtain their own data from another organisation as a condition of applying.
Criminal records have their own rules
Criminal record data is sensitive under Section 26, and a 2023 notification of the Personal Data Protection Committee adds specific rules. Only two bases are available.
A data controller may collect personal data relating to criminal records only where there is a provision of law requiring a criminal record check, or a check of the qualifications or prohibited characteristics concerning the commission of a criminal offence or the serving of a criminal punishment, or where explicit consent has been obtained from the data subject
After selection, clause 9 allows further retention of no more than six months where no specific law says otherwise; the data must then be erased, destroyed or anonymised. TDPG 4.0 item HR26 (2) likewise advises deleting criminal record information once the check is confirmed. The full picture is in our article on criminal record checks in hiring.
How long can you keep applications from unsuccessful candidates?
The recruiting organization must not collect personal data obtained from the selection process for longer than the period required by law, or longer than the statute of limitations for any related litigation.
To keep an application on file for future roles, TDPG 4.0 items HR27–HR28 suggest saying so in the notice from the start and relying on legitimate interest after a balancing exercise. For successful candidates, item HR26 (1) asks which recruitment data is still needed; anything that is not should stay out of the personnel file.
Day one: which basis covers which data?
Most core HR work needs no consent. Bank details for payroll are TDPG 4.0's own Chapter C example of the contract basis, and sending salary data to the Revenue Department is its example of legal obligation. What you do need is a complete Section 23 notice for staff.
From item HR101 onward, TDPG 4.0 offers sample text for an employee privacy notice, employment contract clauses and work rules on data security. They are a useful starting point, provided you adapt them to what the company actually does.
Only a few things suit consent, such as using staff photos in marketing where people can decline without any effect on their job. Why employee consent so often fails is covered in our article on when consent is the wrong basis.
Do health checks need employee consent?
It depends on whether a law requires the check. Health data is sensitive under Section 26. If the check is required by law for a purpose listed in Section 26 (5), consent is not needed; otherwise, explicit consent is.
(5) it is necessary for compliance with a law to achieve the purposes with respect to: (a) preventive medicine or occupational medicine, the assessment of working capacity of the employee, medical diagnosis,
TDPG 4.0 item HR87 (6) gives the example of jobs in hazardous environments or involving chemicals, where law requires a health check before work starts, and says decisions on fitness for a role must be interpreted by a health professional rather than by HR reading lab results.
Item HR91 requires that a check be genuinely necessary, for example to prevent a significant health and safety risk, to assess a return to work after illness, or to decide on benefits. It also bars disclosing one employee's illness to colleagues unless that is needed to keep the work going.
Medical certificates for sick leave
Where an employee takes sick leave of 3 days or more, the employer has the right to require the employee to produce a medical certificate [104]. Therefore, in the case of sick leave of 3 days or more, the employer may rely on that statutory right to collect and use the employee's personal data without needing to obtain consent from the employee.
The same item says consent should be sought when a certificate is requested for sick leave of under 3 days, or to assess a claim under a company medical benefit, and that such consent can count as free because it serves the employee's own interest. If the company has no health professional and engages an outside reviewer, that reviewer is a processor and needs an agreement under item HR93.
Drug and alcohol testing
TDPG 4.0 items HR96–HR98 accept that some roles, such as bus drivers, justify testing, but advise limiting random tests to safety-critical work, notifying staff formally in advance and never using the tests to probe private life outside work.
Can you use fingerprint scanners for clocking in?
Yes, but only on the terms that apply to sensitive data. Fingerprint data used to identify someone is biometric data under Section 26, and TDPG 4.0 item S41 says plainly that the employment contract alone is not enough.
Furthermore, in the context of employment, the special conditions for processing sensitive data are rather limited; in most cases, explicit consent of the data subject (employee) must be relied on, and the employer-employee context requires rather special consideration to demonstrate that the employee has truly given consent freely, and the employment contract basis alone is still not sufficient to meet the special condition under the law.
The example under item S41 says that without full information, and without showing that employees are free to decline, the consent cannot count as explicit consent. A workable answer is to offer an ID card or PIN as an alternative, with no effect on how anyone is assessed.
Item S41 also asks whether a less intrusive method would do, and item S42 recommends devices that delete raw data as soon as a template is created and that encrypt the template. Ask the vendor about both before buying a time clock.
Monitoring email, work and cameras: what must staff be told first?
The purpose, the scope and any likely adverse effect, before monitoring begins. TDPG 4.0 item HR65 says employee consent to monitoring may not be free, so the basis is legitimate interest, balanced as items HR66–HR67 describe.
Before any monitoring takes place, the employer must inform the employee of the purpose of the monitoring, the genuine benefit, and the scope of the monitoring, as well as any adverse impact that may arise from the monitoring, unless the monitoring is covert monitoring.
- Email and internet: TDPG 4.0 item HR72 calls for a written policy covering permitted personal use, prohibitions, how monitoring works and the penalties for breach.
- CCTV: item HR74 asks for signs showing camera locations, how the system works and why it is used; item HR77 rules out hidden cameras in restrooms or changing rooms. More in our CCTV article.
- Covert monitoring: item HR76 limits it to unusual cases, such as suspected misconduct needing urgent investigation, and it must end when the investigation does.
- Who sees the results: item HR70 keeps access to the smallest possible group of trained people.
One more point from TDPG 4.0 item HR69 (1): do not monitor staff merely because a customer requires it, unless the company has satisfied itself that the requirement is fair.
An employee resigns: keep the data or delete it?
Some of it must be kept, and some deleted once it is no longer needed; there is no single answer for the whole file. TDPG 4.0 items HR60–HR62 ask employers to set retention rules by data category for current and former staff.
Retaining the personal data of employees (and former employees) without necessity constitutes a burden on the employer, and may create a risk of erroneous use of such personal data
| Data | Period in the TDPG sample | Reason TDPG gives |
|---|---|---|
| Employment contract and changes to terms | Duration of employment plus 10 years, or as other law requires | Defence against claims for compensation |
| Pay, wages, overtime, bonuses | Duration of employment plus 2 years | Limitation period under Civil and Commercial Code Section 193/34 (8) and (9), as TDPG cites |
| Working hours and remuneration | Duration of employment plus 2 years | Same as above |
| Leave, discipline, resignation, dismissal, consent to sensitive data | Duration of employment plus 10 years | Per the sample policy |
| Work accidents, injuries or deaths | Duration of employment plus 10 years | Per the sample policy |
The table gets you started, but check labour, tax and sector-specific law before adopting figures. Then state the periods in the employee notice under Section 23 (3) and keep a disposal record when each period ends.
A former employee asks for a copy of their data
Current and former staff can request access to and copies of their data under Section 30. TDPG 4.0 items HR40–HR41 suggest systems that can pull data per person and identity checks on the requester, since outsiders may pose as employees.
When the data subject makes a request as in paragraph one, and such request cannot be rejected based on the reasons in paragraph two, the Data Controller shall fulfill the request without delay, but shall not exceed thirty days from the date of receiving such request.
Another company calls for a reference
You can answer, but have a policy first rather than leaving it to a former manager's memory. TDPG 4.0 item HR42 describes a new employer asking about someone's abilities, or a bank asking during a loan application. Each is a disclosure of personal data.
The employer should establish a clear organizational policy as to who may disclose the employee's personal data in the case of a request by a third party [54]. The employer must notify the employee of the scope of personal data that may be disclosed for the purpose of such reference
The safe approach is to name a few people who may respond, define what they may confirm, such as job title and dates of employment, and state that scope in the employee notice from day one. Anything beyond it, such as the reason for leaving or disciplinary outcomes, should be cleared with the person first.
Health data is sensitive. Without a legal requirement for that role, explicit consent is needed, and TDPG item HR91 limits checks to genuine necessity.
A real alternative makes explicit consent freely given, in line with TDPG item S41.
Contrary to TDPG items HR68 and HR72, which require notice and a policy, unless covert monitoring is justified under item HR76.
TDPG items HR26–HR28 call for a set period, notice if files are kept for future roles, and deletion when no longer needed.
Frequently asked questions
Must every employee sign a PDPA consent form?
Not for core HR. Payroll, tax and social security can rest on contract or legal obligation under Section 24. What you need is a Section 23 notice. Consent is for things staff can genuinely refuse, and for sensitive data not covered by a Section 26 exception.
Can we require a pre-employment medical?
Yes, where a law requires a check for that job, which falls under Section 26 (5) (a). Otherwise you need explicit consent. TDPG 4.0 items HR87 and HR91 advise testing only when necessary, having a health professional interpret results and restricting access to them.
Can we rely on the employment contract for a fingerprint time clock?
TDPG 4.0 item S41 says the contract basis is not sufficient for biometric data; in most cases freely given explicit consent is needed. Offer an alternative such as an ID card, and first ask whether a less intrusive method would work.
How long can we keep former employees' data?
The PDPA sets no single figure. Keep data as long as the purpose and other applicable laws require. TDPG 4.0's sample policy uses 10 years for contracts and 2 years for pay records after termination, as examples rather than legal periods. State the periods under Section 23 (3).
A new employer asks whether a former employee was any good. Can we answer?
That is a disclosure of personal data. TDPG 4.0 item HR43 recommends a policy on who may answer and telling employees in advance what scope of data may be disclosed for references. Anything beyond that scope should be agreed with the person first.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 23 · Section 26 · Section 30
- TDPG 4.0 Thailand Data Protection Guidelines (guidance, not law) — HR40–HR43 · HR60–HR77 · HR87–HR98)
- PDPC Notification on Protective Measures for Collecting Criminal Record Data Not Carried Out under the Control of a Competent Authority, B.E. 2566 (2023) — Clause 5 · Clause 9
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)