Police Want Customer Data: What a Thai Company May Hand Over

On a Monday morning the legal team receives a letter from a police station asking for one customer's service history, with a summons for documentary evidence attached. The team splits. One side says it is an order from an official, so send it. The other worries that the PDPA forbids disclosure without consent.

There is no need to guess. The Office of the Personal Data Protection Committee (the PDPC Office) answered this exact question for a hospital it calls Hospital B, and answered a related one where a state body asked another state body for data: the Bangkok Metropolitan Administration (BMA) asking the Metropolitan Waterworks Authority (MWA) for water-user records. This article sets both opinions beside the Personal Data Protection Act and turns them into a workflow any company can use.

Does the PDPA apply to the police officer asking for data?

Not to the police side of it. The PDPC took the view that an inquiry official gathering evidence under the Criminal Procedure Code is carrying out work under the criminal justice procedure, which Section 4(5) of the PDPA excludes. It also falls under Section 4(2) as a public-safety function.

The PDPC added that even outside the PDPA's main rules, the Royal Thai Police must still secure the data to the required standard under the third paragraph of Section 4. Data sent to an investigator does not leave the law entirely.

Can a company really disclose to an inquiry official without consent?

Yes, on conditions. The PDPC reasoned in two layers. First, on what basis was the data originally collected? Second, does sending it to the police fit the purpose the data subject was told about?

Layer 1: was the data collected on a consent-exempt basis?

Section 27 bars using or disclosing personal data without consent, unless the data was collected under an exemption in Section 24 or Section 26. The gate is the basis at the time of collection, not the moment of disclosure.

For Hospital B, the PDPC listed several bases for holding treatment records: performance of a contract under Section 24(3), a contract with a medical practitioner under Section 26(5)(a), and legal obligation under Section 24(6). As an example of that obligation, the opinion cites Section 35 of the Medical Facilities Act, under which treatment records must be kept in a verifiable state for at least five years.

The same logic works outside hospitals. Most customer data is collected to perform a contract or to meet accounting and tax duties. Where that is the basis, Section 27 lets the company disclose without asking the customer again.

Layer 2: can you disclose for a purpose you never told the customer about?

Customers did not hand over their data so that it could go to the police, so Section 21 matters. It forbids use beyond the notified purpose unless the new purpose is notified and consented to, or the PDPA or another law permits it. The PDPC relied on the second route.

In plain English: where another statute such as the Criminal Procedure Code authorises the request, disclosure outside the original purpose is permitted by Section 21. The opinion also cites Section 7 of the National Health Act, which allows health data to be disclosed where a specific law requires it, read with PDPA Section 3, which lets specific laws apply first while the PDPA's collection, use, disclosure and rights provisions still apply on top. The National Health Act itself is not in our corpus, so we go no further than the opinion's own summary.

Does the same apply when another state agency asks?

Much the same, minus the Section 4 exemption. When the BMA asked the MWA for monthly water usage and lists of new water users to collect wastewater fees, the PDPC treated both bodies as data controllers, each needing its own lawful basis.

The requester, the BMA, could collect without consent under Section 24(4) as a public-interest task within its legal powers, and from a source other than the data subject under Section 25(2). The sender, the MWA, could disclose if the disclosure fell within Section 24 read with Section 27, paragraph one. Conditions followed.

The same opinion gives three more points a private company can use straight away. The requester should collect and use only what is necessary under Section 22. The sender should list in its privacy notice the categories of bodies that may receive the data, under Section 23(4). And if the transfers are routine, the two sides should put the arrangement in writing.

The PDPC also floated a smarter option: the BMA could ask the MWA to bill the wastewater fee itself, so the user list never has to leave the MWA. In business terms, before you ship a whole dataset, ask whether the job can be done without moving the data at all.

A request has arrived. What do you do, in order?

The steps below combine what the two opinions say with AIPDPA's own good-practice suggestions. Where a step is good practice rather than a legal duty, it says so.

1. Check the request. Who is asking, from which agency, under which legal power, for whose data and for which period? (Good practice: insist on a written request and do not give data over the phone.)
2. Open your RoPA. Find the basis on which the requested data was collected. If it is a Section 24 or 26 basis, Section 27, paragraph one allows disclosure.
3. Send only what is asked. Extract the items the letter names; do not attach the whole customer file. (Good practice, building on the necessity principle the PDPC applied to the BMA.)
4. Send it securely. A sealed envelope, or an encrypted file over a traceable channel. Your Section 37(1) security duty stays with you, as the PDPC stressed at the end of the Hospital B opinion.
5. Log it. Date, recipient, data sent and basis used, under Section 27, paragraph three, with Section 39(6).
6. Check your privacy notice. Are state agencies or officials acting under law listed among the recipients under Section 23(4)?
7. For recurring requests from the same body, sign a data sharing agreement covering purpose, method, conditions and each party's duties, as the PDPC recommends.

What do the opinions leave unanswered?

An advisory opinion answers the facts it was asked about. To use it well you need to know where it stops. At least four questions are not answered by the material in our corpus, so this article does not pretend to answer them.

• The inquiry official's power to demand documents comes from the Criminal Procedure Code, which is not yet in our corpus, so the form of a summons and its deadlines are not covered here.
• Data collected on consent alone. The Hospital B reasoning assumes a consent-exempt basis, so it does not address this case directly.
• Whether to tell the customer that their data went to the police. The opinions are silent, and telling them could conflict with the confidentiality of an investigation. Ask the requesting officer first.
• Requests from foreign authorities raise cross-border transfer rules under Section 28, which are outside the scope of this article.

How binding is a PDPC advisory opinion?

Both opinions were issued by the ad hoc sub-committee that answers queries on behalf of the Personal Data Protection Committee. They are views given to the body that asked, not administrative orders or penalty decisions. The AIPDPA team note attached to this file in our corpus therefore classes it as guidance, not legislation.

Still, until Thai courts produce PDPA case law, the regulator's own reading is the strongest authority available. Use it alongside your own reasoning, and write down in the file why you decided to disclose.

For more PDPC answers to common business questions, read The PDPC Has Answered: 8 Real PDPA Questions. If you are not sure on what basis each dataset was collected, start with choosing the right PDPA lawful basis.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)