Eight More PDPA Questions the PDPC Office Has Answered

Our first article, eight PDPA questions the PDPC Office answered, covered consent, marketing and the small-business RoPA exemption. The same book contains many more answers that settle everyday questions better than any textbook.

This instalment picks eight more and groups them in three: sensitive data and minors, how much to give outsiders who ask for data, and roles and the limits of the PDPA. The book is published in Thai only, so each opinion is quoted in the original Thai and then explained in English.

What did the PDPC Office say about sensitive data and minors?

1. A bank scans a minor's face to open an account: whose consent is needed?

Bank M asked two things: whether face recognition used to verify customers, including minors aged 7 to 20, needs consent, and how to market products to minor customers. The opinion splits the analysis. Opening the account itself can rest on the contract basis in section 24(3). Scanning the face, however, collects biometric data under section 26 paragraph two.

In English: the bank must look for a basis in section 26 paragraph one (1) to (5) for identity verification, and if none applies, it must obtain explicit consent. On marketing, the opinion says that offering new products fits none of the other section 24 bases, so consent should be sought, and given the minor's maturity, the child's consent alone is not enough.

That is: consent to market to these minor customers should also be obtained from the person exercising parental authority. Issue 4, on offering existing or related products such as an ATM card, received a similar answer. For apps, tutoring schools or shops with young customers, the lesson is to separate what the contract needs from what is marketing, because they rest on different bases.

2. A disabled customer has no national ID card: can the bank keep a disability ID card?

The Thai Bankers' Association asked whether a disability ID card or booklet is sensitive data under section 26, and if explicit consent were required from every customer, how banks could meet their anti-money-laundering identification duties. The opinion accepts that it is section 26 data but identifies a basis that does not need consent.

In English: the processing may be regarded as necessary to comply with law for substantial public interest, exempt from explicit consent under section 26(5)(e) with section 27 paragraph one, provided the bank puts suitable safeguards in place. The opinion adds data minimisation under section 22, notice under section 23 delivered in a form suited to disabled customers, and security measures that may include pseudonymisation or encryption. The pattern applies to any business with a statutory identity-check duty: a consent exemption comes with heavier protective duties. See our guide to sensitive data.

When outsiders ask for data, how much can you give?

3. An agency requests merchant data by email without a formal letter: can you comply?

Company Y, an e-commerce platform, regularly receives official letters asking for merchant, buyer and recipient details, even ID card and bank-book copies, and wanted to let officials ask by email. The opinion says the formal Garuda-headed letter is a matter of official form, and electronic requests are possible, but sets a condition.

In English: the company should verify that the electronic request genuinely comes from an official of a body with legal authority, or someone authorised to act for it. If so, disclosure falls within the consent exemptions in section 24(4) or (6) or section 26(5) as the case may be. The opinion closes with the duty companies most often forget: record the disclosure.

In practice, an email channel needs a verification step: check the agency's email domain, call back on the agency's switchboard number, and ask the requester to cite their legal power. Every time data goes out, log who asked, what for, under which law and when it was sent.

4. A candidate for cooperative chair wants the member list for campaigning: can you hand it over?

Savings Cooperative P asked whether it could give all members' names, addresses and phone numbers to a member standing for chair. Without consent, no: the data was collected to serve members, not for campaigning.

In English: such use goes beyond the original purpose, so the cooperative cannot disclose members' data to a candidate without the members' consent. The opinion leaves a door open: if communicating with members is within the purpose, the cooperative itself may send news of the election and the candidates, without giving any candidate the list. The same approach works for associations, condominium juristic persons and unions facing similar requests: the organisation sends the message; the list stays inside.

5. How much can a professional council publish about its licensees?

The Federation of Accounting Professions asked whether it could publish auditors' names, licence numbers and licence status online. Yes, under section 24(4) with section 27 paragraph one, but phone numbers and addresses are not needed to check status, and the opinion suggests a narrower method.

In English: disclosing case by case through a search service with set conditions is more appropriate than publishing every licensee's data on the website. The asker sits under both the PDPA and the Official Information Act, but the principle transfers directly to private “verify a dealer” or “find a certified technician” pages: a one-at-a-time lookup beats a downloadable list, showing only the fields needed to verify.

Who is the controller, and where does the PDPA stop?

6. Can you rely on the contract basis for a supplier employee's phone number?

Company K, a building manager, raised what nearly every business faces: names and numbers of the people at a supplier or customer you deal with. The opinion separates two cases. If the counterparty is an individual, the contract basis works. If it is a company, its employees are not parties to your contract.

In English: these individuals are not the company's contract parties, so it cannot rely on contract performance, and may consider section 24(5) instead.

The opinion warns against using such data beyond normal expectations in a business-contact setting. In working terms: use the coordinator's number to send a quotation, not to add them to a personal marketing list. Give “counterparty contacts” its own RoPA row with section 24(5) as the basis.

The second issue concerned roles. A company hired to manage a condominium or housing estate collects residents' data for billing, parking stickers and security on the juristic person's instructions. The opinion places it as follows.

In English: the company is not a data controller but a data processor under the PDPA. It therefore need not find its own lawful basis, which is the juristic person's job, but must follow instructions under section 40(1), and the juristic person must put an agreement in place under section 40 paragraph three. Our processor agreement guide has a template.

7. Can a cooperative leave attendees' names out of meeting minutes, citing the PDPA?

Mr A, a member of Savings Cooperative B, complained that the board's minutes omitted attendees' names, supposedly because attendees did not want them disclosed under the PDPA. The opinion says the cooperative may disclose names in line with the purpose notified, without consent, and that the choice is a bounded discretion.

In English: whether to disclose is for the cooperative to decide, but that discretion should follow the purpose notified at collection, must not conflict with applicable law or rules, and must not defeat the purpose of keeping minutes. Whether past meetings were valid was outside the Committee's remit. For company secretaries, the takeaway is that the PDPA is no reason to strip attendees' names where the rules or purpose of the minutes call for them.

8. Is posting an ex-spouse's divorce certificate on TikTok a PDPA offence?

Police Station D asked about a TikTok user who posted a divorce certificate showing the complainant's name. The opinion confirms the name is personal data, but says the PDPA targets systematic or regular processing; a purely personal act falls outside it under section 4(1).

In English: such an act is outside the PDPA under section 4(1), but if it unreasonably invades another's privacy or meets the elements of another offence, the person may be liable under those laws. The opinion names the Computer Crime Act, defamation under the Criminal Code and tort under section 420 of the Civil and Commercial Code. Unlike the Facebook photo case in our first set, the focus here is the line between private conduct and organisational processing. If the poster were an employee using a company account, the analysis could change.

How do the eight answers apply to your work?

Boiled down, these answers repeat three points. Choose the lawful basis per activity, not per customer. The purpose you notified at collection decides how far you can go when someone asks for data. And every disclosure made without consent needs a record under section 27 paragraph three. In AIPDPA each disclosure can be logged against its RoPA activity with the basis and requester, so it can be traced later.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)