Data and AI law, read from the actual text
Data and AI law, read from the actual text, is AIPDPA's series of 68 articles on situations Thai organisations really face. Each reads the PDPA, PDPC notifications, TDPG 4.0 and related laws together, for DPOs, legal and HR teams, with the legal text quoted word for word.
Latest · page 2 of 6
HR and employee dataAI in hiring and staff evaluation: what HR must watch
Tools that read CVs, score interviews or rank employees must satisfy both the PDPA and the PDPC's AI guideline. If the results reach Europe, Annex III of the EU AI Act adds another layer. We set the three sources side by side and turn them into steps an HR team can actually follow.
PDPA in practiceAccess, Erasure, Objection: Answering Data Subject Requests on Time Under Thailand's PDPA
Each kind of PDPA request runs on its own clock: 30 days for a copy, 90 days for erasure, immediately for an objection to marketing. This article sets out the deadlines from the legal texts, how to verify the requester, when you may refuse, and a step-by-step playbook from intake to close.
AI at workWhen a customer asks a human to review an AI decision: what Thai businesses must do
A loan declined in three minutes, a claim flagged as fraud, a seller account suspended. The customer asks: who decided, and can a person look again? The answer sits in two places: rights the PDPA already gives, and what the PDPC's AI guideline recommends on top.
Data breachesA Data Leak at 2 a.m.: The First 72 Hours, Hour by Hour, Under Three Thai Laws
The clock starts when you become aware, not when the investigation ends. An hour-by-hour playbook that puts the PDPA, the 2022 breach notification, the Computer-Related Crime Act and the Cybersecurity Act on one timeline.
Data breachesWhat the Breach Letter to Affected People Must Say
The PDPC Office reads your regulatory notice with a trained eye. Your customers read their letter while wondering whether their bank account is safe. Clause 10 of the 2022 Notification sets four things you must tell them; the rest is the craft of writing so people know what to do next.
Data breachesA Half-Day Data Breach Drill for the Whole Company
Response plans that have never been rehearsed tend to fail at the very first question: when did the company actually become aware? Here is a four-hour drill script, scenarios adapted from the PDPC Office's own examples, and scoring tied to the legal deadlines.
PDPA in practiceCCTV in offices, shops and condos: what the PDPA expects
The duty to inform under Section 23 starts when the camera starts recording. What a sign needs to say, how long to keep footage, who may watch it, and what to check before handing it to police or a customer.
AI at workStaff Pasted Customer Data into ChatGPT: What Four Thai Rulebooks Say
One paste into a public chatbot, read against four Thai texts: the PDPC's AI guideline, ETDA's generative-AI guideline, PDPA Sections 28–29, and the Trade Secrets Act.
PDPA in practiceChildren's Data in Thailand: Whose Consent Counts, the Child's or the Parent's?
Section 20 of the PDPA says who consents for a child. But the first question is whether you need consent at all, and the PDPC Office has already answered both questions for a bank and for the education sector.
Cloud and cross-border dataMoving to the cloud: who Thailand's 2024 cloud security standard binds
The NCSA cloud cybersecurity standard took effect on 11 September 2026. Government agencies, critical information infrastructure operators and the cloud providers that serve them now have to classify data, pick certified providers and write tighter contracts.
HR and employee dataHow Far Can You Check a Job Applicant's Criminal Record? Thailand's 2023 Rules and the PDPC's Answer to the Thai Bankers' Association
A "no criminal record found" certificate does not count as criminal record data. A "prosecutor decided not to prosecute" entry does. The consultation answer to the Thai Bankers' Association draws lines any HR team can use tomorrow.
AI at workCustomer-service chatbots under the PDPA: what to tell users and how long to keep chats
Customers type their names, phone numbers, order numbers, sometimes their medical history. Every line is personal data your chatbot collects. Here is what Thailand's PDPA and the PDPC's AI guideline say about it.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)