Choosing the right PDPA basis means knowing that ordinary personal data can be collected without consent where another basis in Section 24 applies, such as contract, legal obligation or legitimate interest. Sensitive data under Section 26 needs explicit consent unless an exception applies. This is for DPOs and marketing teams who want to know when consent is not needed and when it is, following TDPG 4.0.
- PDPA Section 24 offers six bases besides consent, including contract, legal obligation and legitimate interest.
- TDPG 4.0 item C14: if processing is genuinely necessary for a contract, there is no need to ask for consent as well.
- TDPG 4.0 item C34: employers and employees have unequal bargaining power, so consent often cannot be the basis.
- Sensitive data under Section 26 cannot rest on contract; it needs explicit consent unless a Section 26 exception applies.
- TDPG 4.0 is guidance, not law. Where it differs from the Act, the Act prevails.
Picture a company that has just started on PDPA compliance. HR adds a line to the job application form: 'I consent to the company collecting, using and disclosing my personal data.' Sales puts the same line on purchase orders, and the membership app makes users tap 'accept all' before they can sign in. Everyone feels covered.
The trouble is that much of this consent has no legal effect, and some of it creates new problems for the company. If an employee or customer withdraws consent tomorrow, can the company stop paying salaries, stop delivering goods or stop filing tax returns? It cannot. Those activities should never have rested on consent in the first place.
This article sets Sections 19, 24 and 26 of the Personal Data Protection Act B.E. 2562 (2019), or PDPA, beside Chapter C of TDPG 4.0, the chapter on lawful bases. It ends with a table showing which basis fits common business activities.
Does the PDPA require consent before every collection?
No. Section 19 paragraph one makes consent the starting rule but ends with 'except', and Section 24 is the exception businesses use most. Ordinary personal data can be collected without consent if one of the Section 24 bases applies.
The Data Controller shall not collect, use, or disclose Personal Data, unless the data subject has given consent prior to or at the time of such collection, use, or disclosure, except the case where it is permitted to do so by the provisions of this Act or any other laws.
Section 24 lists six bases: archives, research or statistics; preventing danger to life or health; contract; public task; legitimate interest; and legal obligation. For an ordinary private business, three of them do most of the work: contract, legal obligation and legitimate interest.
(3) it is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
(5) it is necessary for legitimate interests of the Data Controller or any other Persons or juristic persons other than the Data Controller, except where such interests are overridden by the fundamental rights of the data subject of his or her Personal Data;
TDPG 4.0 item C4 observes that most businesses deal mainly with the contract and consent bases. Heavily regulated businesses lean on legal obligation. Legitimate interest tends to appear in specific situations and calls for careful risk assessment.
Why does TDPG 4.0 call consent a risky basis?
Because a person can withdraw consent at any time, and the company may then have to stop using the data. TDPG 4.0 item C14 therefore advises that if processing is genuinely needed to perform a contract, asking for consent on top adds nothing.
consent is a highly risky basis for processing, because processing may have to stop at any time the data subject withdraws consent. Therefore, if the processing of personal data is genuinely for the necessity of performance of a contract, there is no need whatsoever to also request consent.
The second risk is proof. TDPG 4.0 item C13 says the controller bears the burden of proving that the person chose to consent voluntarily. When consent is bundled into the terms of a service, that proof is hard to make.
This lines up with Section 19 paragraph four, which bars making unnecessary consent a condition of a contract or service. The last paragraph of Section 19 states the result: consent requested in breach of these rules does not bind the data subject.
In requesting consent from the data subject, the Data Controller shall utmost take into account that the data subject's consent is freely given. Also, the entering into the contract, including any provisions of the service shall not be a condition to obtaining consent for the collection, use, or disclosure of Personal Data that is not necessary or not related to such contract entering, including the provisions of the service.
The third risk is trust. TDPG 4.0 item C8 warns that asking for consent too often leads customers to believe they can withdraw it while the contract is still running. That produces complaints that never needed to happen.
Which basis fits which activity? A decision table
The table below covers activities that Thai companies carry out routinely. The last column shows whether the conclusion comes from the Act itself or from TDPG 4.0, which is guidance. If your facts differ from the example, assess again.
| Activity | Better basis | Why consent is the wrong tool | Source |
|---|---|---|---|
| Collecting employees' bank details to pay salaries | Contract (Section 24 (3)) | Paying wages is a contractual duty; the company must pay even if consent is withdrawn | TDPG items C5–C9 (employee bank account example) |
| Delivery address and receipt email in an online shop | Contract | Goods cannot be delivered without an address; consent adds nothing | TDPG items C5–C9 |
| Sending salary data to the Revenue Department | Legal obligation (Section 24 (6)) | The company has no discretion whether to send it | TDPG items C56–C57 |
| Retaining computer traffic data required by law | Legal obligation | A statutory duty; withdrawal of consent does not end it | TDPG items C3 and C56 |
| CCTV for building security | Legitimate interest, with an LIA | People walking past have no real way to refuse | TDPG item E44 |
| Tracking browsing behaviour for ad targeting | Consent or legitimate interest | Not necessary for the sales contract, so contract does not apply | TDPG item C11 |
| Marketing newsletters after a purchase | Consent | A good fit: customers can refuse without losing the main service | TDPG item C13 and the example after item C33 |
| Keeping the names of customers who opted out of newsletters | Legitimate interest | Used to stop further mailings; no consent is needed to respect a refusal | TDPG examples after item C65 |
| Debt collection or preparing a lawsuit | Legitimate interest | Not ordinary performance of the contract, and asking the debtor for consent makes no sense | TDPG item C11 |
| Data about an insured person's spouse | Consent or legitimate interest | The spouse is not a party to the contract | TDPG item C6 |
| Medical certificate for a company medical-expense claim (sensitive) | Explicit consent (Section 26) | Consent works here: it benefits the employee, who can choose not to claim | TDPG item HR92 |
| Fingerprint time clock (sensitive) | Freely given explicit consent, or a different clock-in method | The employment contract is not enough for biometric data; consider less intrusive options | TDPG item S41 |
Why does employee consent so often fail?
Because employees are rarely in a position to refuse their employer, so their consent is seldom as free as Section 19 paragraph four demands. TDPG 4.0 item C34 says so directly.
Since consent must be given genuinely voluntarily, in cases where there is a significant difference in bargaining power between the data controller and the data subject, consent often cannot be used as the basis, such as in the case of a public authority carrying out its mission, and the relationship between an employer and an employee, except in cases where the data subject genuinely has the option to refuse to provide the data.
TDPG's own example of valid employee consent is an employer asking staff to appear in a documentary filmed on site, where they can easily decline and sit somewhere off camera. The test is simple: if the employee says no and nothing at all happens to their job, consent can work.
Core HR work such as personnel files, payroll, social security and tax belongs on contract or legal obligation. Workplace monitoring belongs on legitimate interest with clear notice. The stage-by-stage detail is in our article on employee data from hire to exit.
When can you rely on legal obligation?
When you can point to the provision that requires the processing and you have no real choice. TDPG 4.0 item C56 asks controllers to identify the provision or the order of a competent state body, and item C57 adds a condition that many companies overlook.
This lawful basis cannot be used where the data controller has discretion as to whether to process this data in order to comply with the law, or has another suitable alternative for complying with the law other than processing personal data. Where processing is carried out under this lawful basis, the data subject does not have the right to erasure, data portability, or the right to object to the processing
The last sentence of item C57 matters in practice. With the right basis, a company can answer an erasure request by explaining that the law still requires retention. A company that told staff it kept the data 'with your consent' is stuck between its own words and its legal duty once that consent is withdrawn.
How do you test a legitimate interest?
It has to pass three tests: a lawful purpose, genuine necessity, and no excessive impact on the person's rights. TDPG 4.0 cites an advisory opinion of the Office of the Personal Data Protection Committee (PDPC Office) on this and adds a duty to record the reasoning.
In this regard, where the data controller discloses data on the basis of legitimate interest, the details of that disclosure and the reasoning used in exercising the balancing discretion must be recorded in the record of processing activities (ROPA)
- Purpose test: write down what the company gains, for example fraud prevention or system security.
- Necessity test: ask whether a less intrusive method exists and whether another basis would do.
- Balancing test: would the person expect this, how sensitive is the data, and what safeguards reduce the impact?
- Record the result in the RoPA with the reasoning, so you can answer a complaint later.
One more point: TDPG 4.0 item C64 says that a long privacy policy does not automatically make processing 'expected'. If the wording is vague, or nobody can be assumed to have read it, it does not carry that weight.
How is sensitive data different?
For sensitive data the rule flips. Explicit consent is required unless one of the exceptions written into Section 26 itself applies. Section 26 has its own list of exceptions, and neither contract nor legitimate interest is on it; TDPG 4.0 item C5 confirms that sensitive data cannot rest on contract.
Any collection of Personal Data pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data, or of any data which may affect the data subject in the same manner, as prescribed by the Committee, is prohibited, without the explicit consent from the data subject, except where:
The exceptions businesses meet most often are Section 26 (4), establishing or defending legal claims, and Section 26 (5), compliance with law for listed purposes such as occupational medicine, assessing an employee's working capacity, and employment protection or social security. Outside those, you are back to explicit consent.
Where consent from employees is unavoidable, refusal must be real, for example by offering a card or PIN instead of a fingerprint scan. Criminal record data has its own PDPC notification; see our article on criminal record checks in hiring.
Switching away from consent: what do you have to do?
Tell people first; a silent switch is not allowed. TDPG 4.0 item C3 says the basis cannot be changed without first notifying the data subject, and Section 23 (1) requires the notice to cover purposes relying on Section 24 as well.
- List every form and screen with a consent box and match each one to an activity in your RoPA.
- Separate activities that work on contract, legal obligation or legitimate interest from those that genuinely need consent.
- Rewrite the privacy notice to state the basis per purpose, and tell existing data subjects before relying on the new basis.
- Keep consent boxes only for choices people can really decline, set apart from other text as Section 19 paragraph three requires.
- Run an LIA for every legitimate interest activity and file it with the RoPA.
Ties unnecessary consent to the service, contrary to Section 19 paragraph four; consent obtained in breach of the rules does not bind the data subject under the last paragraph of Section 19.
Too broad and not genuinely refusable. Separate checks required by law, checks on legitimate interest, and sensitive data that needs explicit consent.
Matches TDPG 4.0 items C5 and C13: contract for what is necessary, consent for optional extras people can decline.
This is a legal duty without discretion under TDPG 4.0 items C56–C57. If staff withdrew consent, the company would still have to send it.
Frequently asked questions
Is it unlawful to collect consent for everything just in case?
Not always, but it cuts both ways. Consent tied to a service without need does not bind the data subject under Section 19, and if consent is withdrawn the company may have to stop using data it still needs. TDPG 4.0 items C8 and C14 advise against asking for consent excessively.
If we do not ask for consent, do we still have to give notice?
Yes. Section 23 requires notice before or at the time of collection, and Section 23 (1) expressly covers purposes that Section 24 allows without consent. The basis changes; the duty to inform does not.
Can we rely on employee consent?
Only for things employees can genuinely refuse without losing out. TDPG 4.0 item C34 notes the large gap in bargaining power between employer and employee, so consent often cannot serve as the basis.
Can employee health data rest on the employment contract?
No. Health data is sensitive under Section 26 and needs explicit consent or a Section 26 exception, such as compliance with law on occupational medicine or employment protection under Section 26 (5). TDPG 4.0 items C5 and S41 also say the contract basis is not enough for sensitive data.
Is TDPG 4.0 legally binding?
No. TDPG 4.0 is guidance for interpreting the Act and designing processes. It does not bind like the Act, and where the two differ the Act prevails.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 19 · Section 23 (1) · Section 24 · Section 26
- TDPG 4.0 Thailand Data Protection Guidelines (guidance, not law) — C5–C14 · C34 · C56–C57 · C62–C65)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)