Data Protection Impact Assessment (DPIA) in Thailand: when and how to do one A Data Protection Impact Assessment (DPIA) should be done before you start high-risk processing, such as AI that analyses behaviour, biometric checks or large-scale processing. That is the recommendation of the Thailand Data Protection Guidelines (TDPG) 4.0, which list the DPIA among a controller's core tools alongside the RoPA, the DPO and processor agreements. TDPG is guidance, not a statute, but a completed DPIA is your evidence that risk was assessed first.
A retail chain plans to replace punch cards with face scanning at every branch and to let an AI model analyse loyalty-card shopping habits. At the project meeting, the IT manager is asked whether anyone has assessed the impact on personal data before go-live. Nobody has an answer.
What you need to know
The 4 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- TDPG 4.0 recommends a DPIA before high-risk processing starts, such as AI behaviour analysis, biometric checks and large-scale processing.
- TDPG 4.0 is guidance, not law, but it places the DPIA among the controller's core accountability tools.
- If you genuinely need consent from minors, TDPG 4.0 recommends a DPIA as well.
- Your RoPA should link to the DPIA for each high-risk activity, together with related breaches and sensitive data.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Screen activities in your RoPAGo through every activity in your Record of Processing Activities (RoPA) and flag those that match TDPG 4.0's high-risk examples: AI behaviour analysis, biometrics, large-scale processing or consent from minors.
- Describe the processingSet out what data you collect, from whom, why, who can access it, who receives it and how long you keep it, consistent with your RoPA.
- Test necessity and proportionalityA good practice is to ask whether you could reach the same goal with less data or a less intrusive method, and whether your lawful basis really holds.
- Identify risks to individualsRate the likelihood and severity of harm to people's rights and freedoms, such as a data leak, unfair decisions or tracking beyond what people expect.
- Choose measures to reduce riskPick technical, organisational and physical measures, such as tighter access, collecting less or pseudonymising, then rate the risk that remains.
- Sign off and link to the RoPAHave a decision-maker accept the remaining risk, ask your Data Protection Officer (DPO) for a view if you have one, and link the DPIA to the activity in your RoPA, as TDPG 4.0 suggests.
What is a DPIA and how is it different from a RoPA?
A DPIA assesses the privacy impact of a high-risk processing activity before it starts. A RoPA records all of an organisation's processing: what data it holds, why, how it is protected and how long it is kept. TDPG 4.0 calls the RoPA the first document a supervisory authority will ask to see.
The two work together. TDPG 4.0 suggests linking the RoPA to the DPIA for activities that are high-risk or meet DPIA criteria, and to related breaches and any sensitive data collected.
Which activities need a DPIA?
TDPG 4.0 gives three examples of high-risk processing that should have a DPIA before it begins: AI that analyses behaviour, biometric checks and large-scale processing of personal data. It also recommends a DPIA in some specific situations.
One TDPG 4.0 example is a public library that wants to use a century of member records for statistics but lacks contact details for many members; the guideline recommends publishing a privacy policy and carrying out a DPIA.
- AI analysis of customer or employee behaviour.
- Biometric identification or verification, such as face scanning.
- Large-scale processing of personal data.
- Seeking consent from minors where it is genuinely necessary.
- Reusing old data for a new purpose when you cannot notify everyone affected.
Is a DPIA legally required in Thailand?
This guide relies on TDPG 4.0, which is guidance rather than a statute. TDPG 4.0 lists the DPIA among the controller's duties for high-risk processing, alongside the RoPA, appointing a DPO, processor agreements and a breach notification procedure within 72 hours.
In practice, a DPIA completed before launch is clear evidence that you considered the risk to individuals and chose your safeguards for a reason.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Running the DPIA after the system is already live. | ✓ TDPG 4.0 places the DPIA before high-risk processing starts, so build a DPIA screen into every new project approval. AIPDPA's DPIA workspace pre-fills the questionnaire from your RoPA, keeps a risk register and handles sign-off, so you can start today without designing forms. |
| ✗ The DPIA is a Word file nobody can find, with no link to the RoPA. | ✓ TDPG 4.0 suggests linking high-risk RoPA entries to their DPIA. In AIPDPA, an approved DPIA links back to its RoPA activity, so an auditor can trace the activity straight to its assessment. |
| ✗ Nobody knows which AI tools touch personal data. | ✓ List your AI systems first, then put those that analyse behaviour or use biometrics through a DPIA. AIPDPA's AI registry and AI Risk Radar assess AI systems against Thai law, NIST, ISO 42001 and the EU AI Act, and Kooru TrustAI offers an in-depth AI-use risk review. |
Finish your DPIA before the system goes live
AIPDPA's DPIA workspace gives you a questionnaire pre-filled from your RoPA, a risk register and sign-off, ready to use. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Is a DPIA mandatory under Thai law?
This guide relies on TDPG 4.0, which lists a DPIA among a controller's duties for high-risk processing. TDPG is guidance, not a statute, but a DPIA is the clearest way to show you assessed risk before you started.
Should we do the DPIA before or after launch?
Before. TDPG 4.0 recommends assessing the impact before high-risk processing starts, while the design is still easy to change.
We want face-scan time clocks for staff. Do we need a DPIA?
You should do one. TDPG 4.0 names biometric checks as an example of high-risk processing that calls for a DPIA before it begins.
Who should carry out the DPIA?
The data controller is responsible. A good practice is for the project owner, IT and the DPO to work on it together and for a senior decision-maker to sign it off; joint controllers should agree who leads.
Where should we keep the finished DPIA?
A good practice is to keep it with the activity in your RoPA, since TDPG 4.0 suggests linking high-risk RoPA entries to their DPIA, so an auditor finds both in one place.
Sources
This guide relies on 4 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Thailand Data Protection Guidelines (TDPG) 4.0, para. B9 — the controller's DPIA duty (guidance, not statute)
- Thailand Data Protection Guidelines (TDPG) 4.0, key tools and processes — DPIA before high-risk processing
- Thailand Data Protection Guidelines (TDPG) 4.0, para. C54 — DPIA where consent is sought from minors
- Thailand Data Protection Guidelines (TDPG) 4.0 — joint-controller arrangements and linking the RoPA to DPIAs
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
Questionnaire, risk register and sign-off in one place, with a printable report.
Join the waitlist →The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Join the waitlist →An AI registry and AI Risk Radar against Thai law, NIST, ISO 42001 and the EU AI Act, plus a workplace AI-use policy.
Join the waitlist →An AI-use risk review and an AI governance setup for your organisation.
See the service →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.