The PDPC Office's answered consultations are real questions organisations submitted, such as whether choosing "do not consent" in an app counts as withdrawal. This is for DPOs and legal teams, and covers 8 common questions, including why a new product cannot rest on the contract basis. The answers are advisory and do not bind the Expert Committee.
- Switching to "do not consent" in an app counts as withdrawal if the privacy notice says so clearly (s.19 para 5).
- New products for existing customers cannot rest on the contract basis, and once a customer refuses consent you cannot fall back on s.24(5).
- A limited company is not a non-profit; regular processing or sensitive data brings back the RoPA duty under s.39 para 3.
- Patient records can go to an investigating officer on a summons without consent, but the disclosure must be logged in the RoPA (s.27 para 3).
- Consultation answers are advisory and do not bind the Expert Committee; use them, and record your own reasoning.
Most Thai DPOs work on questions nobody answers for them. The PDPA is short, the guidelines are broad, and there is no case law yet to compare against. Yet one set of documents is still unread in many companies: the summaries of consultation answers collected and published by the Office of the Personal Data Protection Committee. These are questions that banks, hospitals, companies and state agencies actually submitted, with answers from the ad hoc consultation subcommittee of the Personal Data Protection Committee.
We picked the 8 that matter most to private companies. For each, you get the question in plain words, the answer quoted from the book, and what it means for your organisation. The book exists only in Thai, so the answers are quoted in the original and explained in English. First, be clear about what kind of document this is. One answer in the book spells it out.
การตอบข้อหารือนี้เป็นความเห็นและคำแนะนำทางกฎหมายของคณะอนุกรรมการเฉพาะกิจตอบข้อหารือฯ ซึ่งท่านอาจใช้ประกอบดุลพินิจในการดำเนินการที่เกี่ยวข้อง แต่ความเห็นดังกล่าวนี้ไม่ผูกพันการใช้อำนาจและหน้าที่ของคณะกรรมการผู้เชี่ยวชาญตามกฎหมายIn English: this answer is the legal opinion and advice of the consultation subcommittee, which you may use to inform your own judgement, but it does not bind the statutory powers and duties of the Expert Committee.
All 8 answers in one table
| # | Question | The PDPC's answer in short | Key PDPA sections | What to do |
|---|---|---|---|---|
| 1 | A customer switches to "do not consent" in the app. Is that a withdrawal? | Yes, if the privacy notice says so clearly; no separate withdrawal menu needed | s.19 paras 5–6 | State what the toggle does in the privacy notice and keep a traceable history |
| 2 | Do we need consent to offer new products to existing customers? | New products cannot rely on the contract basis; related products may rely on legitimate interest | s.24(3), (5); s.19; s.32 | Pick the right basis from the start and run an LIA |
| 3 | Are small companies exempt from keeping a RoPA? | A limited company is not a non-profit; as a processor it still needs a s.40(3) record | s.39 para 3; s.40(3) | Check the small-business criteria and the exceptions to the exemption |
| 4 | A customer left a phone or laptop behind. What now? | Lost & Found does not make you a controller, but wipe data before disposal | s.6; s.37(1) | Wipe, factory reset or destroy the storage before passing it on |
| 5 | An investigating officer asks for patient records. Can we hand them over? | Yes, without consent, on a letter or summons | s.4(2), (5); s.27 para 1; s.21 | Verify the requester's authority and log the disclosure in the RoPA |
| 6 | The insurer wants the employer to certify that staff consented | Certifying is not consenting on staff's behalf; the task can be delegated | s.19; s.20; s.26 | Get real consent from each employee, keep proof, then sign |
| 7 | Is posting someone's photo on Facebook a PDPA breach? | An identifiable photo is personal data, but purely personal posting may fall outside the PDPA | s.4(1); s.5; s.6 | A company page is not personal use and needs a legal basis |
| 8 | Do we need consent for a face or fingerprint time clock? | Maybe not, if genuinely necessary for labour protection; otherwise explicit consent plus an alternative | s.26(5)(c); s.26 para 2; s.19 para 4 | Document the necessity and provide a fallback way to clock in |
1. If a customer taps "do not consent" in the app, has consent been withdrawn?
The real question: Bank Kh. let customers switch their consent status from "consent" to "do not consent" themselves at VTM kiosks and in mobile banking. It asked whether that alone counts as withdrawing consent, or whether a separate "withdraw consent" menu is needed.
กรณีนี้หากธนาคาร ข. ได้แจ้งในประกาศความเป็นส่วนตัว (Privacy Notice) ให้เจ้าของข้อมูลส่วนบุคคลทราบอย่างชัดแจ้งว่าการที่ลูกค้าผู้ใช้บริการได้กดปุ่ม "ไม่ยินยอม" ผ่านระบบ SUMO (เครื่อง Virtual Teller Machine (VTM)) และผ่านระบบ Mobile Banking ซึ่งเป็นการกดปุ่มหลังจากที่ทำการกดปุ่มให้ความยินยอมมาแล้ว ให้ถือว่าเป็นการถอนความยินยอมจากการให้บริการ แม้กระบวนการถอนความยินยอมไม่ได้จัดทำเป็นกรณีเฉพาะก็ถือเป็นการถอนความยินยอมตามกฎหมายแล้วThe answer says: if the bank's privacy notice clearly tells customers that pressing "do not consent" after having consented counts as withdrawal, that is a legal withdrawal even without a dedicated withdrawal process.
What this means for you: you do not need a separate withdrawal menu if the same toggle used to give consent can take it back, and your privacy notice clearly says what the toggle does. The same answer recommends two more things: a trace-back record of every grant and withdrawal, and a visible status so customers can see the withdrawal took effect. The principle behind it is PDPA Section 19, paragraph 5.
The data subject may withdraw his or her consent at any time. The withdrawal of consent shall be as easy as to giving consent
2. Do you need consent before offering a new product to an existing customer?
The real question: Bank J. asked whether it needs consent to offer loans to deposit customers, or ATM cards and mobile banking to existing customers, and what happens if the customer has already ticked "no" to marketing.
การนำเสนอผลิตภัณฑ์ใหม่เพื่อวัตถุประสงค์ทางการตลาดเป็นกิจกรรมที่ไม่เกี่ยวข้องกับการปฏิบัติตามสัญญาของผลิตภัณฑ์เดิม จึงไม่สามารถอ้างฐานการปฏิบัติตามสัญญาตามมาตรา ๒๔ (๓) แห่งพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ ได้In English: marketing a new product is unrelated to performing the contract for the existing product, so the contract basis in Section 24(3) cannot be used. For products tied to the existing one, such as an ATM card for a deposit customer, the PDPC allows the bank to consider legitimate interest under Section 24(5). The bank should run an LIA and tell customers they can object to marketing under Section 32. The most important sentence comes at the end.
แต่กรณีธนาคารเลือกใช้ฐานความยินยอมแล้ว ลูกค้าไม่ให้ความยินยอม ธนาคารจะไม่สามารถนำฐานทางกฎหมายตามมาตรา ๒๔ (๕) มาใช้ในการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลกับลูกค้าในกิจกรรมดังกล่าวได้อีกThat is: once the bank has chosen consent as its basis and the customer refuses, it can no longer fall back on Section 24(5) for that same activity.
What this means for you: asking for consent just in case is not the safe option. If you ask and the customer says no, you cannot switch back to legitimate interest for the same activity. Decide the legal basis for each activity when you build your RoPA, not when you design the form. Our lawful basis guide walks through the choice.
it is necessary for legitimate interests of the Data Controller or any other Persons or juristic persons other than the Data Controller, except where such interests are overridden by the fundamental rights of the data subject of his or her Personal Data;
3. Are small businesses really exempt from keeping a RoPA?
The real question: Company S., which manages condominiums and housing estates, asked whether a condominium juristic person counts as a non-profit organisation under the 2022 notification exempting small businesses from record-keeping. The answer went further than the question and also addressed the company itself. (The 2022 notification has since been repealed by a B.E. 2567 notification on the same subject, which names condominium juristic persons as an exempt group in their own right.)
การจดทะเบียนจัดตั้งธุรกิจในรูปแบบบริษัทจำกัดจึงเป็นไปเพื่อการแบ่งปันกำไร บริษัทฯ จึงไม่ถือเป็นองค์กรที่ไม่แสวงหากำไรIn English: a business registered as a limited company exists to share profits, so the company is not a non-profit organisation.
What this means for you: a limited company cannot use the non-profit route. The route that may be open is being a small or medium-sized enterprise, which this answer lists as the first category in clause 3 of the notification. But the exemption has its own exceptions in Section 39, paragraph 3. If your processing risks people's rights, is more than occasional, or involves Section 26 sensitive data, you need a RoPA anyway. And when you act as a processor for clients, the PDPC says you must still keep the Section 40(3) record.
unless the collection, use, or disclosure of such Personal Data is likely to result in a risk to the rights and freedoms of data subjects, or not a business where the collection, use, or disclosure of the Personal Data is occasional, or involving in the collection, use, or disclosure of the Personal Data pursuant to section 26.
If you do need a RoPA, start with our RoPA guide, or use the AIPDPA RoPA register, which prints a Section 39 report.
4. Does a phone or laptop left behind by a customer make you a data controller?
The real question: Company O., an airport operator, was drafting rules for lost property and asked how to handle electronic devices containing personal data before selling or auctioning them.
การดำเนินกิจกรรมของแผนกบริการทรัพย์สินสูญหาย (Lost & Found) เป็นเพียงการจัดการทรัพย์สินที่ไม่ทราบว่าเป็นของผู้ใดเท่านั้น ไม่ใช่เป็นการเก็บรวบรวมข้อมูลส่วนบุคคลที่จะทำให้บริษัทฯ เป็นผู้ควบคุมข้อมูลส่วนบุคคลแต่อย่างใดIn English: running a Lost & Found desk is merely handling property of unknown ownership. It is not a collection of personal data that would make the company a data controller.
What this means for you: hotels, malls, restaurants and hospitals that keep lost items do not become data controllers just by putting a phone in a drawer. Still, the PDPC sets out a three-step good practice before donating or selling a device. First, if it has a storage component, wipe it. Second, if the data sits in the device itself, do a factory reset. Third, if the data cannot be accessed at all, destroy the device or its storage. The PDPC says doing this may count as appropriate security measures. You can write those three steps into your Lost & Found procedure today.
5. Do you need consent before giving an investigating officer patient or customer data?
The real question: Hospital B regularly receives letters or summonses from investigating officers asking for patients' treatment records for criminal case files. It asked whether it can hand them over without consent.
ดังนั้น โรงพยาบาล B จึงสามารถใช้หรือเปิดเผยข้อมูลส่วนบุคคลดังกล่าว ซึ่งรวมถึงประวัติการรักษาพยาบาลของผู้ป่วยที่ถือเป็นข้อมูลส่วนบุคคลเกี่ยวกับข้อมูลสุขภาพตามมาตรา ๒๖ แห่งพระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. ๒๕๖๒ ตามที่พนักงานสอบสวนมีหนังสือ และ/หรือหมายเรียกพยานเอกสารได้โดยไม่ต้องขอความยินยอมจากเจ้าของข้อมูลส่วนบุคคลIn English: the hospital may use or disclose the data, including treatment records that are health data under Section 26, as requested by the investigating officer's letter or summons, without the patient's consent. The reasoning has two layers. First, a criminal investigation by an investigating officer is part of the criminal justice process under Section 4(5), to which the PDPA does not apply. Second, data the hospital collected under a consent exemption in Section 24 or 26 may be disclosed under Section 27, paragraph 1, and the Criminal Procedure Code also authorises it.
What this means for you: a private company that receives an official request for data does not need to chase customers for consent. Two steps cannot be skipped, though. First, verify that the requester really has legal authority, a point stressed in another consultation in the same book (Company Y., an e-commerce platform). Second, log the disclosure in your RoPA, because it was made without consent.
In the event that the Data Controller uses or discloses the Personal Data which is exempted from consent requirement in paragraph one, the Data Controller shall maintain a record of such use or disclosure in the record under section 39.
6. The insurer wants the employer to certify that staff have consented. Can HR sign?
The real question: Company K. has group health insurance for its staff. The insurer asked the employer to sign a "certificate of consent obtained" from employees and threatened not to renew the policy or add new members otherwise. The company's DPO saw this as forcing the employer to consent on employees' behalf and asked whether the document breaches the PDPA.
การที่บริษัท ก. ทำหน้าที่ประสานงานเพื่อขอความยินยอมจากพนักงานของบริษัท ก. แทนผู้รับประกันภัยและ/หรือนายหน้าประกันชีวิตหรือบุคคลอื่นใดตามที่กำหนดในหนังสือดังกล่าว และให้คำรับรองกับผู้รับประกันภัยและ/หรือนายหน้าประกันชีวิตตามที่กำหนดในหนังสือ จึงไม่ใช่การที่บริษัท ก. ให้ความยินยอมแทนพนักงานซึ่งเป็นเจ้าของข้อมูลส่วนบุคคลIn English: when the company coordinates obtaining its employees' consent on behalf of the insurer or broker and gives the certification the document requires, it is not consenting on behalf of the employees who are the data subjects.
What this means for you: this kind of certificate means taking on the job of collecting consent from staff for the insurer, then confirming it was done. It is not consent given on their behalf. The PDPC says this delegation is lawful as long as the consent obtained genuinely meets Sections 19 and 20, and that the certificate's terms are a contractual matter open to negotiation. Before HR signs, it should collect real consent from each employee, especially for health data, which is sensitive. It should also keep proof that can be produced on request and have a process for employees who withdraw. See our valid consent guide for how to design it.
7. Is posting someone else's photo on Facebook a PDPA violation?
The real question: Police Station F received a complaint that a Facebook user had posted the victim's photo with text exposing them to contempt and hatred. It asked whether the poster is a data controller who breached the PDPA. The PDPC first confirmed that photos or text that identify a person, directly or indirectly, are personal data. It then explained who the PDPA is aimed at.
บทบัญญัติและเจตนารมณ์แห่งกฎหมายดังกล่าวมุ่งประสงค์จะใช้บังคับแก่บุคคลธรรมดาหรือนิติบุคคลที่มีการเก็บรวบรวม ใช้ หรือเปิดเผยข้อมูลส่วนบุคคลอย่างเป็นระบบหรือเป็นประจำสม่ำเสมอเพื่อวัตถุประสงค์อย่างใดอย่างหนึ่งขององค์กรหรือของบุคคลนั้นIn English: the provisions and intent of the PDPA are aimed at individuals or legal entities that collect, use or disclose personal data systematically or regularly for some purpose of their organisation or of themselves. The PDPC therefore told the police to consider whether the post was made for personal benefit under the Section 4(1) exemption. If so, it falls outside the PDPA, though the poster may still be liable under other laws such as the Computer Crime Act, defamation under the Criminal Code, or tort under Section 420 of the Civil and Commercial Code.
the collection, use, or disclosure of Personal Data by a Person who collects such Personal Data for personal benefit or household activity of such Person only;
What this means for you: this answer is not a licence for a company page to post photos of customers or staff freely. The Section 4(1) exemption covers only personal benefit or household activity. A company page posting event photos, customer award photos or staff pictures uses personal data for the organisation's purposes, so it needs a legal basis and a privacy notice as usual.
8. Do you need every employee's consent for a face or fingerprint time clock?
The real question: the Expressway Authority of Thailand (EXAT) had enrolled 3,314 staff in its face and fingerprint time system and installed 84 machines costing 3,149,010 baht. One employee refused, fearing a data leak and citing PDPA Section 26. EXAT asked whether consent was required, and what to do if it was refused. The answer expressly addresses employers "whether private or state enterprise", so it applies directly to private companies.
The biometric data in paragraph one shall mean the Personal Data arising from the use of technics or technology related to the physical or behavioral dominance of Person, which can be used to identify such Person apart from other Persons, such as the facial recognition data, iris recognition data or fingerprint recognition data.
ในกรณีที่ กทพ. เห็นว่า การเก็บรวบรวมข้อมูลชีวภาพสำหรับการบันทึกเวลาทำงานเป็นสิ่งจำเป็นในการปฏิบัติตามสิทธิหรือหน้าที่ของ กทพ. หรือผู้ปฏิบัติงานของ กทพ. เกี่ยวกับการคุ้มครองแรงงานตามกฎหมาย เช่น เพื่อป้องกันปัญหาการทุจริตในการบันทึกเวลาทำงานแทนกัน โดยได้พิจารณาจากข้อเท็จจริงแล้วว่า หากไม่ดำเนินการเช่นนั้น กทพ. จะไม่สามารถปฏิบัติตามกฎหมายเพื่อให้บรรลุวัตถุประสงค์เกี่ยวกับการคุ้มครองแรงงานได้ กทพ. ก็อาจยกกรณีดังกล่าวเป็นข้อยกเว้นการได้รับความยินยอมโดยชัดแจ้งจากเจ้าของข้อมูลส่วนบุคคล ตามมาตรา ๒๖ (๕) (ค) ได้In English: if EXAT finds, on the facts, that collecting biometric data for time-keeping is necessary to exercise rights or duties relating to labour protection, for example to stop staff clocking in for one another, and that without it EXAT cannot comply with labour protection law, it may rely on the Section 26(5)(c) exception to explicit consent.
The other half of the answer matters just as much. If the facts do not clearly show a buddy-punching problem, or a non-biometric method could solve it, the exception does not apply and explicit consent is required. If an employee refuses and biometrics are not necessary for the employment contract under Section 19, paragraph 4, the employer must provide another way to record time for those who refuse or withdraw, such as signing a time book.
What this means for you: before buying scanners, write down why they are necessary. Name the real problem they solve and the alternatives you considered and found inadequate, because that is what the PDPC looks at to decide whether Section 26(5)(c) applies. Then always keep a fallback way to clock in, and set security measures that match the risk; the answer stresses that biometric data is inherently fairly high risk. More in our sensitive personal data guide.
How should you read PDPC consultations without getting lost?
All 8 share a pattern that makes other consultations faster to read. The PDPC rarely says a flat yes or no. It answers with conditions and hands the burden of proof back to the controller: if the privacy notice says so, if it is genuinely necessary, if the consent was validly obtained. The organisations that benefit are the ones that wrote down their reasoning before anyone asked.
- Read the requester's facts before the answer; if they differ from yours, treat the answer as a line of thinking only.
- Note which sections the answer relies on, then open those sections yourself.
- Separate the opinion from the observations; observations are often good practice rather than legal duties.
- Record your organisation's decision with the consultation you relied on, in the RoPA or your LIA file.
The theme that recurs most across these 8 is consent: withdrawing it, collecting it through an intermediary, and choosing the wrong basis. AIPDPA's consent register keeps a traceable history of grants and withdrawals, which is what the PDPC recommended to Bank Kh. Its RoPA records consent-exempt disclosures in one place. See the demo account, no sign-up needed.
Frequently asked questions
Are PDPC consultation answers legally binding?
No. The book itself states that each answer is the legal opinion and advice of the consultation subcommittee. It can inform your judgement but does not bind the Expert Committee's powers. If a complaint is filed, the outcome depends on the facts and process of that case.
Do we need a separate "withdraw consent" menu in our app?
Not necessarily. Under the Bank Kh. consultation, if customers can switch from "consent" to "do not consent" themselves and the privacy notice clearly says that switch is a withdrawal, it is a legal withdrawal. The PDPC still recommends a trace-back record and a visible status.
Is it safer to ask for consent just in case rather than rely on legitimate interest?
Not always. The Bank J. consultation says that if you choose consent and the customer refuses, you cannot then rely on Section 24(5) for that activity. Choose the right basis from the start.
Are SMEs exempt from keeping a RoPA?
Not automatically. Small and medium enterprises are one of the categories the small-business notification exempts, but Section 39, paragraph 3 removes the exemption where processing risks people's rights, is more than occasional, or involves sensitive data. And if you process data for others, you still need a Section 40(3) record.
Can an employer require staff to use a face-scan time clock?
It depends on genuine necessity. The EXAT consultation says the Section 26(5)(c) exception may apply if it is necessary for labour protection, for example to prevent buddy punching, and there is no other way. If not, explicit consent is required, and staff who refuse must have another way to record their time.
Law and sources
- PDPC Office: Summaries of answers to PDPA consultations (part 1 of the collected administrative orders and consultation answers)
- Personal Data Protection Act B.E. 2562 (2019) — Section 4 (1) · 19 · 24 (5) · 26, para. 2 · 27, para. 3 · 39, para. 3
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)