How to set retention periods and erase personal data under Thailand's PDPA

An HR officer at a factory receives an email from a job applicant rejected two years ago, asking the company to delete his application and ID card copy. The team deletes the file from the shared drive and replies that it is done. Nobody thinks about the copies in the interviewer's inbox, the paper file or the cloud backup.

What you need to know

The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.

• Section 37(3) requires a system to delete or destroy data when its retention period ends, when it is no longer needed, on request, or after consent is withdrawn.
• Erasure requests under Section 33 must be handled without delay and no later than 90 days after receipt.
• Erasure must reach copies and backups, and the data must not be reasonably recoverable or re-identifiable.
• If technical limits delay erasure, you must make the data hard to use or disclose and erase it as soon as you can.
• Data collected unlawfully under Section 33(4) must be deleted or destroyed; anonymising it instead is not allowed.

↑ Back to contents

How to do it in 6 steps

Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.

1. List data by activityStart from your Record of Processing Activities (RoPA): what each activity collects, why, and every place it is kept, including inboxes, paper files and backups.
2. Set a retention period per data setTie each period to the purpose, such as a period another law requires or the time you may still need the data for legal claims, and write down the reason.
3. Schedule reviewsBuild the examination system Section 37(3) requires, for example a monthly or quarterly review that finds data past its period, no longer needed, or covered by withdrawn consent.
4. Choose the right erasure methodDelete or destroy the data, including copies and backups, so it cannot be recovered (Clause 3, paragraph two). If you anonymise instead, remove direct identifiers first and then reduce indirect ones (Clause 6).
5. Log requests and start the 90-day clockRecord the date each Section 33 request arrives, check whether an exemption applies, and act without delay within 90 days (Clause 3).
6. Keep a disposal logA good practice is to log what was erased, when, by whom and how, so you can show that your Section 37(3) system actually works.

↑ Back to contents

How long does the PDPA let you keep personal data?

Sections 33 and 37 do not set a fixed number of years. Section 37(3) requires erasure once the retention period ends or once data is irrelevant or beyond what the purpose needs, so each controller must set its own periods to match the purpose of each activity.

The Act lets you keep data for specific reasons: freedom of expression, purposes under Section 24(1) or (4) or Section 26(5)(a) or (b), establishing, complying with, exercising or defending legal claims, or complying with the law.

↑ Back to contents

How many days do you have to erase data when a customer asks?

You must act without delay and no later than 90 days from receiving the request, under Clause 3 of the PDPC Notification on Criteria for the Deletion or Destruction of Personal Data, or for Rendering Personal Data Non-Identifiable, B.E. 2567 (2024). The Notification has been in force since 12 November 2024.

Section 33 gives the right in four cases: the data is no longer needed for its purpose; consent is withdrawn and there is no other legal ground; the person objects under Section 32 and you cannot refuse; or the data was collected, used or disclosed unlawfully.

↑ Back to contents

Do you have to erase backups too?

Yes. Clause 3, paragraph two of the 2024 Notification says erasure must cover copied and backed-up data, and you must make sure no one can recover it or re-identify the person by any means that could reasonably be anticipated.

If technical reasons delay erasure, for example data waiting to be overwritten, Clause 4 requires you to make the data hard to use or disclose, stop it being used for services or decisions about the person, block access, protect it according to risk, and erase it as soon as possible.

↑ Back to contents

Can you anonymise data instead of deleting it?

Often yes, if you follow Clause 6: strip all direct identifiers first, then reduce the chance of identification from indirect identifiers to a sufficiently low level. The exception is unlawfully collected data under Section 33(4), which Clause 7 says must be deleted or destroyed.

If the person asked for one method and you use the other, Clause 3, paragraph three requires you to tell them.

• Direct identifiers include names, national ID, passport and taxpayer numbers, and customer or account numbers.
• Phone numbers, personal email addresses and vehicle registration numbers also count as direct identifiers.
• So do identifiable face images, identifiable biometric data and user account names.
• Indirect identifiers to reduce include date of birth, age, job title, address and IP address; pseudonymisation is one option.

↑ Back to contents

Common problems and how to fix them

Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.

↑ Back to contents

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)