The Sensitive Data Your Company Holds Without Knowing It

Ask an HR manager whether the company holds sensitive data and the first answer is usually "no, we're not a hospital". Then you open the files: doctor's notes in the sick-leave folder, a blood-type field on the staff record, a food-allergy box on the seminar sign-up, and a fingerprint scanner that has sat by the lifts for years.

Every one of these is data that section 26 of Thailand's Personal Data Protection Act B.E. 2562 (2019), the PDPA, forbids collecting without explicit consent or an exception. The problem is rarely bad intent. It is that nobody knows the data is there.

This article walks through where sensitive data usually hides, then shows where the statute, the consultation answers of the Office of the Personal Data Protection Committee (the PDPC Office) and the Thailand Data Protection Guidelines 4.0 (TDPG) take each case.

What counts as sensitive data under the PDPA?

The Act itself never says "sensitive data"; that is the industry's name for section 26 data. The list sits in the first paragraph.

Exceptions (1) to (5) follow: preventing danger to life, legal claims, and compliance with law for set purposes such as labour protection and social security in section 26 (5) (c).

The term that trips organisations most is "biometric data", because fingerprint and face scanners have become ordinary office kit. Section 26 defines it:

Where does sensitive data hide in everyday operations?

The table gathers the usual hiding places. The right-hand column says which document discusses each one; "team example" means we drew it ourselves from the section 26 list rather than from a consultation or guideline.

An ID photo reveals religion. Is that sensitive data?

TDPG's answer is useful and saves many companies from overreacting. Whether data is processed as sensitive data depends on what you use it for, not merely on what it happens to reveal.

The same example carries a warning. If the company later groups customers whose ID photos show a headscarf, for any purpose, that use may become sensitive-data processing at once and will need a section 26 condition.

Does a sick-leave doctor's note need the employee's consent?

No, if it is collected so the employee can use statutory leave. TDPG gives exactly this example: the employer relies on the employment contract for the ordinary data on the certificate and on the labour-protection exception for the health data.

TDPG item S6 extends the same reasoning to sterilisation leave, maternity leave and social security claims. Watch the scope. A doctor's note in the leave file is there to decide the leave. If a manager later reads it during a performance review, that is a new purpose the original exception may not cover.

The food-allergy box on an event form is different, because no labour law requires it. The simplest route is to make it optional, say it is used only for catering, take explicit consent separately from anything else, and delete it after the event. That is our suggestion, not a statutory rule.

Fingerprint time clocks: what did the PDPC Office tell EXAT?

The Expressway Authority of Thailand (EXAT) collected staff faces and fingerprints for time recording; 3,314 people had enrolled, but one employee refused, worried the data might leak. EXAT asked the PDPC Office whether it could collect without consent and, if consent was needed and refused, what it could do.

The Office first confirmed this is biometric data under section 26 paragraph two. It then set out what must be shown before the labour-protection exception in section 26 (5) (c) applies.

In English: (1) the controller must need the data to comply with one or more laws; (2) the collection must serve labour-protection purposes; (3) it must be necessary to exercise the rights or perform the duties of the controller or the data subject. The decisive one is necessity. If there is evidence of buddy-punching such that, without biometrics, the employer cannot meet its labour-law duties, the exception may apply. If fraud is unproven, or a non-biometric method could solve the problem, it does not, and explicit consent is needed.

And if the employee refuses? Where biometrics are not necessary for time recording under the employment contract, EXAT must offer another way.

The Office closed with two points private employers should note. Biometric processing carries inherently high risk, so security must match it. And if the legal basis changes in line with the answer, staff should be re-notified and the section 39 record corrected.

TDPG item S41 takes a similar line, more strictly for employment.

For employee data across the whole employment cycle, see Employee data from hire to exit.

Everyone signed a consent form. Why is that not enough?

Because explicit consent must be freely given, like any consent. If refusing means losing the service or the job, the consent may have no effect at all. TDPG offers several examples.

Note the last case. Consent can be tied to a service when the data is genuinely necessary for something the data subject requested. A scanner installed for the company's convenience always needs an alternative.

Once you hold sensitive data, what other duties follow?

Section 26 data does more than raise the consent bar. It closes exemptions that small businesses might otherwise use, starting with the section 39 record of processing.

So a shop or small firm that assumes it is exempt from the record may lose that exemption with a single fingerprint time clock. Start the record with the plan in Data mapping in one week.

Second, the data protection officer. Section 41 (3) requires a DPO when the core activity is collecting, using or disclosing section 26 data. A company with doctor's notes in its leave files does not have that core activity, but a clinic, lab or health-screening firm may. See Which Thai companies must appoint a DPO.

Third, penalties. Section 84 sets a higher administrative fine for section 26 breaches than for ordinary ones.

How do you audit sensitive data in one afternoon?

No big project needed. Put the heads of HR, IT, facilities and sales in a room for two hours and work through this order.

1. Open every form people fill in, paper and online. Circle any field asking about health, religion, disability, blood type, allergies or criminal record.
2. Walk the building. Note every fingerprint reader, face scanner and camera that can recognise faces, and ask IT where templates are stored and who can access them.
3. For each point, ask whether the data is used as sensitive data or merely rides along (the TDPG S2 test).
4. Where it is used, look for a section 26 (1) to (5) exception first. If none fits, take explicit consent, separate from other consents.
5. Wherever consent is the basis, check there is an alternative that is no worse for people who refuse.
6. Delete fields you ask for but never use. Collecting less is risk removed.
7. Log every point in the section 39 record, flag section 26 data, and check whether any small-business exemption still applies.

The AIPDPA RoPA register lets you flag section 26 activities as you record them and print a section 39 report when the PDPC Office or a data subject asks. See the demo account.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)