Former Employees' Records: What You May Keep and When You Must Erase

Suppose a salesperson left three months ago and now writes to HR: "Please delete all my data under the PDPA." The file holds a job application, an ID card copy, the employment contract, past payslips, annual appraisals and one written warning.

HR teams tend to answer in one of two ways. Some delete everything to make the problem go away, then discover they have nothing to defend a labour claim with. Others refuse outright because "the law says we must keep it", without being able to say which law. Both make the same mistake: they never sorted the file.

A former employee asks for erasure. Must the company delete everything?

No. Section 33 paragraph one of the Personal Data Protection Act B.E. 2562 (2019) grants a right to erasure, but paragraph two exempts data that still has to be kept for certain reasons. Data outside those exceptions must go; data inside them may stay.

For someone who has left, the usual ground for the request is section 33(1): the data is no longer needed for the purpose it was collected for, because the employment relationship has ended.

Paragraph two is the heart of the matter. Read all of it, because "compliance with the law" and "legal claims" are different grounds that expire at different times.

The two grounds HR actually relies on

• Compliance with the law applies when a specific law requires the employer to keep that document. The company should be able to name the law, the section and the period.
• Legal claims applies when the document may be needed to sue, be sued or defend a dispute with the former employee. It lasts only as long as such a dispute can still arise.

Which files can stay, and which must go?

TDPG 4.0, the Thailand Data Protection Guidelines, is an industry guideline and does not bind like the Act. It includes a sample retention policy for employee data. The table below takes the periods from that sample and adds the section 33 paragraph two ground each file would most likely rely on.

The TDPG table explains its 10-year period as protection against claims for compensation, and cites prescription periods in the Civil and Commercial Code for its 2-year periods. Those explanations are TDPG's own; we have not checked them against the Code, which is not in our library.

TDPG also says the employer's retention rules must cover former employees, not just current staff, which is why a leaver's file still needs an owner.

Disciplinary files that ended in no finding

Files that tend to outlive their purpose are investigations that cleared the employee. TDPG 4.0 addresses them directly, and the advice holds during employment and after departure alike.

When do the exceptions run out, and who has to follow up?

Section 33 paragraph two exceptions are not permanent. When the legally required period ends, or a dispute can no longer arise, the reason for keeping the file is gone. Erasure then does not wait for a second request, because section 37(3) requires the company to run its own erasure system.

The PDPC's 2024 Notification on deletion, destruction and anonymisation, in force since 12 November 2024, extends this duty: the section 37(3) system must apply the same criteria as erasure on request, including the rules on copies and backups.

In practice, the simplest method is to tie erasure dates to the termination date: the pay file has its own due date, the contract file another, and a named person reviews what has fallen due on a regular cycle rather than waiting for someone to ask.

Section 23(3) of the PDPA also requires the retention period to be disclosed when data is collected, and TDPG HR62 suggests telling staff that this period continues after employment ends. A retention schedule prepared in advance is therefore both an HR tool and the answer given to every employee on day one.

What must be erased, by when, and how thoroughly?

Within 90 days of receiving the request, under clause 3 of the 2024 Notification, and the erasure must reach copies and backups too. The work therefore does not stop at the HR system; it follows the files on managers' laptops, email attachments and IT backups.

If some backups cannot be wiped at once for technical reasons, clause 4 requires the data to be put beyond practical use until erasure is complete: not restored, protected from access, and deleted as soon as possible. Backups and logs are covered in more depth in our article on 90-day logs and erasure.

How do you reply when you can erase only part of the file?

With reasons. Clause 8 of the 2024 Notification separates the two cases: what has been erased must be confirmed, and what cannot be erased must be explained. A one-line "the law requires us to keep it" is not enough.

Some files involve other people too, such as a grievance file naming the complainant and witnesses. Clause 5 allows the data not to be erased where erasure may harm other people's data rights or interests, but the significant necessity must be explained to the requester.

In AIPDPA, HR can set retention rules per type of staff record; the system flags what has fallen due and keeps a disposal log, and erasure requests from former staff come in through a portal that tracks the deadline. For the full HR cycle from hiring to exit, see our employee data article.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)