How to run a legitimate-interest assessment (LIA) under Thai PDPA s. 24(5) Legitimate interest under section 24(5) of the Thai PDPA applies when processing is necessary for a legitimate interest of the company or another party, and that interest is not outweighed by the data subject's fundamental rights. You prove it with a three-part assessment: is the purpose legitimate, is the processing really necessary or is there a less intrusive way, and how does it balance against what people expect and the impact on them. Keep the record and review it every year.
An online shop emailed promotions to past customers on the basis of legitimate interest. When a customer complained, the regulator asked how the balancing was done. The shop could only say it thought it was fine, because nothing had been written down.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Section 24(5) applies only if the company's interest is not outweighed by the data subject's rights
- An LIA has three parts: purpose, necessity and balance
- Sensitive data under section 26 cannot rely on this basis
- People can object under section 32, so you need a channel for it
- Review each LIA at least once a year
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Write the purpose clearlySay what the data is used for, who benefits and whether that interest is lawful.
- Test necessityAsk whether a less data-hungry or less intrusive way exists. If it does, use it first.
- Balance against the individualConsider whether people would expect it, how serious the impact is, and whether vulnerable groups or sensitive data are involved.
- Add safeguardsFor example easy opt-out, shorter retention, or separating identifying data.
- Record and approveWrite down the outcome, the reasons and the approver. If the decision differs from the balancing result, record why.
- Review on a cycleSet a review every 12 months, or sooner when the activity changes.
Which activities suit legitimate interest?
It usually fits activities people expect and that have little impact, such as system security, fraud prevention or contacting existing customers about similar products.
If the activity would surprise people or clearly disadvantage them, consider another basis such as consent.
Why can't sensitive data use this basis?
Sensitive data under section 26, such as health, biometric data or criminal records, needs explicit consent or one of the specific exceptions in that section. Legitimate interest is not on the list.
What does an auditor want to see in an LIA?
Written reasoning for all three parts, the assessment date, the approver and the next review date.
Where the decision differs from the balancing result, the auditor will ask for the reason first.
- Purpose and who benefits
- Less intrusive options considered
- Impact and safeguards
- Approver and review date
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ The register says legitimate interest but there is no balancing record | ✓ Run LIAs retrospectively, starting with activities that touch many customers or marketing. |
| ✗ Legitimate interest used for health or biometric data | ✓ Switch to explicit consent or a section 26 exception and correct the register. |
| ✗ No way for people to object | ✓ Add an objection route to the privacy notice and the rights-request page. |
Run an LIA step by step from your register
AIPDPA walks you through the three parts, pre-fills answers from your processing register, asks for reasons when your decision differs from the suggestion, and gives you a numbered record with a review date.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Do we need an LIA for every activity?
For every activity that relies on legitimate interest, yes. It is the only evidence that the balancing was done.
How is an LIA different from a DPIA?
An LIA answers whether the basis can be used. A DPIA assesses the risk of activities that may seriously affect people. One activity may need both.
Can we send marketing on legitimate interest?
Sometimes, for example existing customers and similar products, but opting out must be easy and you must stop if someone objects.
How often should an LIA be reviewed?
At least once a year, and whenever the purpose, the data or the recipients change.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), s. 24(5) — legitimate interests, unless outweighed by the data subject's fundamental rights
- Personal Data Protection Act B.E. 2562 (2019), s. 32 — right to object
- Thailand Data Protection Guidelines (TDPG) 4.0 — legitimate interests assessment (guidance, not statute)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
Three guided parts: purpose, necessity and balance, pre-filled from your register, ending in a numbered LIA record valid for 12 months.
Get started →The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Get started →Questionnaire, risk register and sign-off in one place, with a printable report.
Get started →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.