Data and AI law, read from the actual text
Data and AI law, read from the actual text, is AIPDPA's series of 68 articles on situations Thai organisations really face. Each reads the PDPA, PDPC notifications, TDPG 4.0 and related laws together, for DPOs, legal and HR teams, with the legal text quoted word for word.
Latest · page 4 of 6
PDPA in practicePDPA for Small Shops and SMEs: The First 10 Steps
A notebook of delivery customers, a LINE group of regulars, a camera over the till, files on three staff. A small shop holds every kind of personal data a big company does. The good news: most of the work is done once, if you know where to start.
Data breaches10 Breaches the PDPC Has Already Assessed: How Far Does Encryption Get You?
A lost encrypted USB stick needs no notification. Ransomware with no backup must be reported to both the PDPC Office and data subjects. The difference lies in three words in Clause 4 of the 2022 Notification: confidentiality, integrity and availability.
PDPC opinionsThe PDPC Has Answered: 8 Real PDPA Questions from Thai Organisations
Banks, a hospital, a building manager and a state enterprise sent real questions to Thailand's PDPC. Here are the 8 answers private companies most need, quoted word for word.
PDPC opinionsEight More PDPA Questions the PDPC Office Has Answered
A sequel to the first eight answers. This time: the issues legal teams meet every month, from police and agencies asking for data by email, to members wanting contact lists for an election, to supplier contact details and face scans of children opening bank accounts.
Overlapping lawsPolice Want Customer Data: What a Thai Company May Hand Over
A request from an inquiry official lands on the legal team's desk and the first question is always whether customers must consent first. The PDPC has already answered, and the answer does not end at "yes, send it".
PDPA in practiceHow to Write a Privacy Notice People Actually Read
Most privacy notices run to ten pages, are copied from a template, and nobody finishes them. Thai law does not ask for that. Section 23 requires six things; the rest is writing.
PDPA in practiceData Processing Agreements: The Clauses You Cannot Leave Out
Your payroll bureau, cloud CRM and email agency are all data processors, and Thailand's PDPA requires an agreement with every one of them. Yet most service contracts say nothing about personal data at all.
Data breachesWhen a Vendor Leaks Your Data: Who Must Notify Whom, and How Fast
Payroll platforms, cloud CRMs, delivery firms: every vendor that holds customer data for you is a data processor. When the leak happens on their side, Thai law sets out the notice duties link by link, and the main liability stays with the company that hired them.
CybersecurityRansomware Has Hit: What Three Thai Laws Require, and in What Order
Every file is locked and a ransom note is on the screen. Who needs to know first? The PDPA says the PDPC Office. The Cybersecurity Act adds a separate report for some organisations. The Computer-Related Crime Act makes the company a victim of a crime. Here is how the three fit together, and how far backups really help.
HR and employee dataRedesigning Jobs Around AI: A Practical Guide for HR
ETDA's AI Governance Center tells HR to start from individual tasks, not the org chart. The PDPC's AI guideline adds a warning: if AI will evaluate employee performance, do a DPIA before switching it on.
Intellectual propertyRegister Your Trademark Before You Launch: Thai Law Rewards the First Filer
You have the name, the logo, the printed boxes and the ad budget, but no filing yet. Thailand's Trademark Act gives exclusive rights to the registered owner and dates those rights from the day the application was filed.
PDPA in practiceA Retention Schedule an Auditor Will Accept
“We keep personal data only as long as necessary” cannot be audited. An auditor wants a table that shows, row by row, how long each dataset is kept, when the clock starts, which law justifies it, and who deletes it at the end.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)