Data and AI law, read from the actual text
Data and AI law, read from the actual text, is AIPDPA's series of 68 articles on situations Thai organisations really face. Each reads the PDPA, PDPC notifications, TDPG 4.0 and related laws together, for DPOs, legal and HR teams, with the legal text quoted word for word.
Latest · page 5 of 6
PDPA in practiceFinishing a RoPA That Works, and Knowing When You Need a DPIA
Many Thai companies start a record of processing activities (RoPA) and stall at a half-filled spreadsheet. This article sets out what section 39 of the PDPA actually requires, who can be exempt, how the TDPG 4.0 guidelines suggest doing the work, and which activities should go on to a data protection impact assessment (DPIA).
CybersecurityClassifying systems step by step under Thailand's 2023 security classification standard
Before you know which controls a system needs, you have to rate it low, medium or high. The 2023 notification of Thailand's National Cybersecurity Committee gives the full method in dense legal language. Here it is step by step, with four example systems.
Cloud and cross-border dataWhen data leaves Thailand: section 28, step by step
Foreign SaaS, offshore support, monthly reports to head office: not every one counts as a transfer abroad. Walk it through in order, from the definition in the section 28 notification to section 29 and then the exceptions.
PDPA in practiceThe Sensitive Data Your Company Holds Without Knowing It
Doctor's notes, the food-allergy box on an event form, the fingerprint scanner by the lifts: all section 26 data that cannot be collected without explicit consent or an exception, and each one drags other duties along with it.
Overlapping lawsFormer Employees' Records: What You May Keep and When You Must Erase
A former employee emails HR: "Delete all my data under the PDPA." HR knows the employment contract, payslips and a disciplinary file may still be needed; IT asks about backups. Section 33 paragraph two of the PDPA answers the first question, and the PDPC's 2024 erasure Notification answers the second. The answer is never "delete everything" or "keep everything": it is file by file.
PDPA in practiceYou don't need consent for everything: pick the right PDPA basis
Many Thai companies add an 'I consent' box to every form because it feels safest. TDPG 4.0 says plainly that consent is a high-risk basis, and in HR it often does not work at all.
Intellectual propertyAn Employee Quits and Takes the Customer List and Source Code: What Can the Company Do?
Thailand's Trade Secrets Act protects only information the company actually kept secret. The PDPA then asks how the company let customer data walk out the door. The same set of controls answers both questions.
AI at workThailand's AI bill and PDPA amendment: what to prepare now
Neither the draft Thai AI Act nor the MPs' bill to amend the Personal Data Protection Act is law yet. What follows draws on AIPDPA team notes, which are not legal text. Every step we suggest doing today is tied to the PDPA that is actually in force.
Intellectual propertyUsing Photos, Articles and Music From the Web on a Company Site: Where Thai Copyright Law Bites
The photo you found on Google, the article you condensed, the trending track under your clip, the screenshot from someone else's page: all of them have an owner. A credit line is not a licence, and removing a watermark is a separate offence.
PDPA in practiceBefore You Sign a Vendor That Touches Customer Data: What to Check
The contract a vendor sends you is written to protect the vendor. Here is what Thailand's PDPA section 40 and two 2022 PDPC notifications require that contract to contain, and what to ask before anyone signs.
CybersecurityDoing IT work for critical infrastructure: what to prepare before you sign
Thailand's Cybersecurity Act puts the duties on critical infrastructure operators, not their vendors. The requirements still reach you, through the contract, remote access rules, training and recovery plans. How heavy they get depends on the level of the system you touch.
Global AI rulesWhat to ask an AI vendor: lessons from the OECD reports
In 2025, twenty global AI organisations told the OECD how they manage risk. What they disclosed, and what they still keep close, gives a Thai company a clear list of questions to put to an AI vendor before signing.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)