Data and AI law, read from the actual text
Data and AI law, read from the actual text, is AIPDPA's series of 68 articles on situations Thai organisations really face. Each reads the PDPA, PDPC notifications, TDPG 4.0 and related laws together, for DPOs, legal and HR teams, with the legal text quoted word for word.
Latest · page 3 of 6
PDPA in practiceData Mapping in One Week: From Nothing to Your First RoPA
Most companies do not get stuck on the RoPA template. They get stuck because nobody knows where the data goes. This plan splits the work by day so each team maps its own data, then turns the map into a section 39 record within a week.
Data breachesSent an Email or File to the Wrong Person? When Thai Law Says You Must Report It
A payroll file sent to the wrong address, a hundred customers exposed in the CC line, an invoice delivered to a stranger. No hacker is involved, yet each one is a personal data breach under Thailand's 2022 breach notification rules. The PDPC Office has already assessed three such cases, and its answers are stricter than many firms expect.
HR and employee dataEmployee data from hire to exit: what HR must do under the PDPA
HR holds more personal data than any other team, and much of it is sensitive. A stage-by-stage walk through applications, health checks, clock-in systems, monitoring, resignation and the reference call that comes afterwards.
Global AI rulesThe 10 AI practices the EU AI Act bans outright, and which Thai businesses could be caught
Most AI systems under the EU AI Act only need documents or user notices. One group cannot be sold or used at all. Those bans have applied since 2025, and two more start on 2 December 2026.
Global AI rulesWhen does the EU AI Act apply to a Thai company?
The EU's AI law does not bind anyone in Thailand unless they fall within Article 2 — by selling an AI system into the EU market, for example, or by sending AI output to be used in the EU. We walk through the text word for word, with the new dates set by the 2026 amendment.
Cloud and cross-border dataSending data to group companies abroad: BCR or standard clauses?
A Thai subsidiary sends staff and customer data to its parent every day. Even inside one group, that is a transfer abroad. Section 29 offers two routes: Binding Corporate Rules certified by the PDPC Office, or contract clauses on the Committee's terms.
CybersecurityIs Your Company Critical Information Infrastructure?
Nobody becomes a critical information infrastructure organisation by self-assessment. But once you are one, the duties come with fixed deadlines, and some of them flow down to the IT contractors who work for you.
Global AI rulesISO 42001 or NIST AI RMF: where should a Thai company start?
When a foreign customer's supplier questionnaire asks which AI governance framework you follow, the two names usually offered are ISO/IEC 42001 and the NIST AI RMF. Neither is Thai law, and they do very different jobs: one can be certified, the other is a checklist you choose from.
Overlapping laws90-Day Logs vs the Right to Erasure: When Thailand's Computer Crime Act and the PDPA Pull Apart
A customer emails asking you to delete everything. IT replies that the logs cannot be touched. Both are half right. Here is which data must stay, which must go, and when.
PDPA in practiceMarketing to Existing Customers in Thailand: When You Need Consent, and When You Don't
Your marketing team has a customer list, a LINE Official Account and an ad pixel on the website. Before every send, someone asks whether consent is needed. This article lines up PDPA sections 19, 24 and 32 with the TDPG 4.0 guidelines and a published PDPC consultation answer to show where the line actually falls.
CybersecurityOne Security Checklist for Both PDPC and NCSA Rules
The PDPC's 2022 security notification and the NCSA's 2023 minimum standard speak different dialects, but they ask for the same things more often than you would think. This article lines them up topic by topic and merges them into one checklist.
Intellectual propertyAn NDA That Actually Protects Your Trade Secrets
Signing an NDA does not by itself protect the information. Thailand's Trade Secrets Act protects only information its owner keeps secret by appropriate measures, and some things can be barred only if the contract says so expressly.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)