Employee data under the Thai PDPA: what HR must check, from payroll to fingerprints Most employee data relies on the employment contract or legal duties, such as payroll, tax and social security. Some of it is sensitive data under section 26 of the Thai PDPA, such as fingerprints, health data and criminal records, which needs explicit consent or a specific exception. HR should go topic by topic, from recruitment to leaving, and check what is collected, on what basis, whether staff were told, and how long it is kept.
A factory switched to fingerprint clock-ins, put cameras across the floor and GPS on its delivery trucks. When staff complained, the company could not find what it had told anyone or what consent it had asked for.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Most employee data relies on contract or legal duty
- Fingerprints, health and criminal records are sensitive data under section 26
- CCTV, GPS and email monitoring need notice and must stay within purpose
- Set retention periods for people who leave
- Leave sensitive topics to a person who records reasons
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- List the 14 HR topicsPayroll, attendance, recruitment, performance, family data, leavers, fingerprints, health, criminal records, data about other people, CCTV, IT monitoring, GPS and whistleblowing.
- Set a lawful basis per topicSplit topics by contract, legal duty, legitimate interest or consent.
- Separate sensitive dataSection 26 topics need explicit consent or a specific exception, and a less intrusive alternative is worth considering.
- Tell your staffPublish privacy notices for employees and applicants that state any monitoring.
- Set retentionDecide how long to keep unsuccessful applicants' and leavers' data, then delete on schedule.
- Separate decider and approverFor sensitive topics, one person decides and another approves, so there is a second look.
Which HR topics involve sensitive data?
Section 26 lists health, disability, biometric data, criminal records, trade union data and more. HR meets the first few most often.
- Fingerprint or face clock-ins
- Medical checks and certificates
- Pre-employment criminal checks
- Trade union data
How far can CCTV and GPS go with staff?
It is fine with a clear purpose such as safety or logistics, notice in advance, and no use beyond that purpose, for example no GPS tracking outside working hours.
Private areas such as toilets or rest rooms should have no cameras at all.
How long can we keep unsuccessful applicants' data?
Set a clear period and tell applicants up front. If you want to keep them on file for future roles, ask for separate consent.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Fingerprint clock-ins introduced without consent | ✓ Ask for explicit consent and offer an alternative, such as a staff card, for those who decline. |
| ✗ No privacy notice for employees | ✓ Publish separate notices for staff and applicants and have them acknowledged on day one. |
| ✗ Leavers' files kept forever | ✓ Set retention by limitation periods or legal duties, then delete or destroy on a cycle. |
Check employee data across all 14 topics
AIPDPA walks you through each employee-data topic, works out gaps from your real register, cameras and notices, leaves sensitive topics to a person with reasons, and issues a numbered report.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Does payroll data need consent?
Usually not, because it is needed for the employment contract and tax and social-security duties, but staff must be told.
Can we review staff work email?
Yes, with a clear purpose stated in policy. Review only what is needed and log who accessed it.
Whose data is employees' family information?
It belongs to those family members. Tell them the purpose, and for minor children keep section 20 in mind.
Can employees ask to see their own data?
Yes. Employees are data subjects and can request access just like customers, within the legal deadline.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), s. 24 — lawful bases
- Personal Data Protection Act B.E. 2562 (2019), s. 26 — sensitive data including health, biometric data and criminal records
- Thailand Data Protection Guidelines (TDPG) 4.0 — processing employee data (guidance, not statute)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
Payroll, attendance, fingerprints, health, CCTV, GPS and whistleblowing, with gaps from your real register and sensitive topics left to a person.
Get started →The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Get started →A camera register and assessment following the NCSA guideline: 96 checklist items, levels B · E · H, review cycles and printable reports.
Get started →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Get started →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.