How to choose a lawful basis for processing under PDPA Section 24 A lawful basis is the legal ground that lets you collect personal data. Section 24 of the Personal Data Protection Act B.E. 2562 (2019) bars collecting personal data without consent unless one of six bases applies: archives, research or statistics; preventing danger to life, body or health; performing a contract; a public-interest task or official authority; legitimate interests; or complying with the law. Choose the best-fitting basis for each purpose and record your reasoning.
A factory's HR team has every employee sign one consent form covering everything from payroll to photos on the company page. One worker refuses to sign. Now HR is unsure whether it can even pay his salary into his bank account.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Consent is only one of seven options; Section 24 gives six bases that need no consent.
- The contract, public-task and legitimate-interest bases apply only where the processing is necessary, as Section 24 puts it.
- Legitimate interests cannot be used where they matter less than the data subject's fundamental rights in their personal data.
- Sensitive data such as health or criminal records falls under Section 26, which has its own list of exceptions.
- A good practice is to choose a basis per purpose and record it in your Record of Processing Activities (RoPA).
How to do it in 7 steps
Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Break activities into purposesOne activity usually serves several purposes; customer data may be used both to deliver orders and for marketing. Each purpose should have its own basis.
- Ask whether a law requires itIf you collect the data to comply with a law that applies to you, Section 24(6) is usually the closest fit. A good practice is to note the specific law and section.
- Test contract necessityIf the data is necessary to perform a contract with the data subject, or to act on their request before entering one, Section 24(3) applies, but only to the data that is genuinely needed.
- Balance before relying on legitimate interestsBefore using Section 24(5), write down your interest, why you need the data and how it affects the person. If their rights weigh more, this basis is not available.
- Check the bases with special conditionsVital interests, public tasks or official authority, and archives or research each have their own conditions; research and statistics, for example, need appropriate safeguards as prescribed by the Personal Data Protection Committee.
- Use consent when nothing else fitsIf no Section 24 basis applies, obtain consent that meets Section 19: explicit, separate from other text and easy to withdraw.
- Record and reviewLog the basis and reasoning for each purpose in your RoPA and review it whenever the purpose or the way you use the data changes.
What lawful bases does Section 24 provide?
Section 24 lets you collect personal data without consent in six situations. If none applies, you need consent.
- (1) Archives, historical documents, research or statistics, with appropriate safeguards as prescribed by the Committee.
- (2) Preventing or suppressing a danger to a person's life, body or health.
- (3) Necessary to perform a contract with the data subject, or to act on their request before entering into it.
- (4) Necessary for the controller's public-interest task or the exercise of official authority vested in it.
- (5) Necessary for the legitimate interests of the controller or another person, unless those interests are less important than the data subject's fundamental rights.
- (6) Compliance with a law that applies to the controller.
Should you rely on consent just to be safe?
Not when a Section 24 basis fits better. Consent can be withdrawn at any time under Section 19, so if you rely on it for something your business must do anyway, such as payroll, that work stalls the moment someone withdraws.
A good practice is to keep consent for genuine choices, such as receiving marketing, and to use other bases for what a contract needs or a law requires.
When can you rely on legitimate interests?
When collecting the data is necessary for your legitimate interests or those of another person, unless those interests are less important than the data subject's fundamental rights in their personal data, under Section 24(5).
A good practice is to write a balancing record each time, covering the interest, why the data is needed, the impact on the person and how you reduce it, so you can show the balance was struck before processing began.
Common problems and how to fix them
Most organisations slip on the same 4 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ One consent form for everything, so essential work stops when someone refuses. | ✓ Split purposes and match each to the best-fitting basis. The AIPDPA RoPA register pre-fills from your org structure and has a lawful-basis picker that cites Sections 24 and 26 for every activity. |
| ✗ Claiming legitimate interests with no balancing record anyone can see. | ✓ Section 24(5) fails if the person's rights weigh more, so record your balancing reasons on the activity before processing starts. If your team lacks time, Kooru's outsourced monthly DPO can prepare and review them. |
| ✗ Stretching the contract basis to cover marketing or analytics the contract does not need. | ✓ Section 24(3) covers only what is necessary to perform the contract. Find another basis or obtain consent for the rest, and track consent-based activities and their evidence in the AIPDPA consent register. |
| ✗ No record of which basis each activity uses, so you cannot answer an auditor. | ✓ Record the basis and reasoning for every activity in your RoPA. AIPDPA prints a Section 39 report on demand, the evidence an auditor asks for. |
Pick the right basis first time, with reasons an auditor can read
The AIPDPA RoPA register pre-fills from your org structure, offers a lawful-basis picker citing Sections 24 and 26, and prints a Section 39 report on demand. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
How many lawful bases are there under the PDPA?
For ordinary personal data, consent plus the six bases in Section 24, so seven options in total. Sensitive data follows the separate list in Section 26.
Which lawful basis applies to employee data?
It depends on the purpose. Data needed to perform the employment contract may rely on Section 24(3), data a law requires employers to keep may rely on Section 24(6), and optional uses such as staff photos for promotion need another basis or consent.
When does the legal obligation basis apply?
When collecting the data is how the controller complies with a law that applies to it, under Section 24(6). A good practice is to note the law and section in your records so the basis can be traced.
Can health data rely on Section 24?
Not on its own. Health data is sensitive data under Section 26, which requires explicit consent unless one of the exceptions in Section 26 itself applies.
Can one activity use more than one lawful basis?
An activity often has several purposes, and each purpose may rest on a different basis. A good practice is to tie the basis to the purpose, not to a system or department.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 24
- Personal Data Protection Act B.E. 2562 (2019), Section 19
- Personal Data Protection Act B.E. 2562 (2019), Section 26
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Join the waitlist →See which activities rely on consent, where the proof is and who has withdrawn.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →A professional DPO on retainer, without a full-time hire.
See plans →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.