How to handle sensitive data such as health and criminal records (Section 26) Sensitive data under Section 26 of the Personal Data Protection Act B.E. 2562 (2019) is data that needs extra care, such as health, disability, criminal records, biometrics like fingerprints or facial templates, religion and race, and it may not be collected without explicit consent unless a Section 26 exception applies. Criminal records must be collected under a competent authority's control or with the protective measures set by the Committee's 2023 notification.
A security services firm makes every applicant, even for accounting jobs, hand in a criminal record check, then keeps the copies in a cabinet anyone can open. A few months later it installs fingerprint scanners for clocking in, without asking a single employee.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Section 26 lists the sensitive categories and lets the Committee add other data that affects people in a similar way.
- You may collect sensitive data only with explicit consent or under one of the exceptions in Section 26(1) to (5).
- Biometric data means data from technology that uses physical or behavioural traits to identify a person, such as facial, iris or fingerprint templates.
- Collecting criminal records outside a competent authority's control requires a legal duty to check or explicit consent, and only for the purposes the notification lists.
- The 2023 criminal record notification has been in force since 8 April 2024.
How to do it in 7 steps
Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Find where sensitive data livesReview job application forms, medical certificates, time-clock systems, cameras and customer databases, and flag every activity that involves sensitive data in your Record of Processing Activities (RoPA).
- Choose explicit consent or an exceptionFor each activity, check whether an exception in Section 26(1) to (5) applies. If none does, obtain explicit consent before collecting.
- Use a dedicated consent formKeep the request for sensitive data separate from everything else and name the data and purpose. A good practice is to offer an alternative to people who decline, such as an ID card instead of a fingerprint.
- Check the rules before asking for criminal recordsCollect them only where a law requires the check or with explicit consent, for the purposes in Clause 5 of the notification, such as hiring or suitability for a position. If the data is essential, state that need from the job advertisement stage.
- Explain the effect of refusingWhen you ask for consent to collect criminal record data, Clause 6 of the notification requires you to explain what happens if the person refuses or later withdraws.
- Put protective measures in placeClause 7 requires appropriate organisational and technical measures, plus physical measures where needed, so criminal record data is used only as necessary. For all sensitive data, a good practice is to restrict access and store it apart from general files.
- Assess the risk firstA good practice is to run a Data Protection Impact Assessment (DPIA) before processing sensitive data at scale or introducing new technology such as facial recognition.
What counts as sensitive personal data under the PDPA?
Section 26 bars collecting the following data without explicit consent unless an exception applies, and lets the Personal Data Protection Committee add other data that affects people in a similar way.
- Race, ethnicity and political opinions.
- Cult, religious or philosophical beliefs.
- Sexual behaviour.
- Criminal records.
- Health data and disability.
- Trade union information.
- Genetic data and biometric data.
When can you collect sensitive data without consent?
Only when one of the exceptions in Section 26(1) to (5) applies. This list is separate from the Section 24 bases, and several items require appropriate protective measures.
- Preventing or suppressing a danger to life, body or health when the person cannot consent for any reason.
- Legitimate activities of political, religious, philosophical or trade-union foundations, associations or non-profits for members, former members or regular contacts, without disclosure outside.
- Data the person has made public with their explicit consent.
- Necessary to establish, comply with, exercise or defend legal claims.
- Necessary to comply with a law for set purposes, such as occupational medicine and assessing an employee's working capacity, public health, labour protection and social security, research, or substantial public interest.
Can you collect criminal records from job applicants?
Yes, in the cases the notification allows. If the collection is not under a competent authority's control, you must follow the Personal Data Protection Committee's 2023 criminal record notification, published in the Royal Gazette on 8 January 2024 and in force 90 days later, from 8 April 2024.
Clause 5 permits collection only where a law requires a criminal record or disqualification check, or with explicit consent, and only for listed purposes such as hiring or assessing a person's suitability for a position.
The notification defines criminal record data as data on criminal investigation, prosecution or punishment that is official or certified by a competent state agency, whether or not the case is final.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Requiring a criminal record check for every role without saying why in advance. | ✓ Check the Clause 5 conditions first. If the data is essential, state the need from the job advertisement and explain the effect of refusing under Clause 6. AIPDPA Ready-to-use documents includes Thai and English consent forms, ready to use straight away. |
| ✗ Installing fingerprint or facial recognition systems without asking staff. | ✓ Fingerprints and facial templates are biometric data under Section 26, so without an exception you need explicit consent. Assess the risk before installation in the AIPDPA DPIA workspace, with its questionnaire, risk register and sign-off. |
| ✗ Keeping medical certificates and record checks in a shared file anyone can open. | ✓ Store them separately, restrict access and log who views them. AIPDPA security controls map your measures across PDPC guidance, the ETDA framework and NCSA standards, so you can see what is missing. |
See at a glance which activities touch sensitive data
The AIPDPA RoPA register flags activities involving sensitive data, offers a lawful-basis picker citing Sections 24 and 26, and screens which activities need a DPIA, all in one system. See the demo account, no sign-up needed.
Included in every plan, from 2,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
What is sensitive personal data under the Thai PDPA?
Section 26 lists race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health, disability, trade union information, genetic data and biometric data. The Committee may add more.
Do we need consent for fingerprint time clocks?
Fingerprints are biometric data under Section 26, so unless an exception in that section applies you need explicit consent before collecting them. A good practice is to offer another way to clock in for anyone who declines.
Can we ask job applicants for a criminal record check?
Yes, if a law requires the check or the applicant gives explicit consent, for hiring or suitability purposes under Clause 5 of the 2023 notification. You must also explain the effect of refusing.
What basis covers employees' annual health check results?
If processing is necessary to comply with a law for occupational medicine or assessing an employee's working capacity, the exception in Section 26(5)(a) may apply. Otherwise you need explicit consent; a good practice is to limit who can see the results.
When did the criminal record notification take effect?
It was published in the Royal Gazette on 8 January 2024 and applies 90 days after publication, so it has been in force since 8 April 2024.
Sources
This guide relies on 2 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 26
- Personal Data Protection Committee Notification on Protective Measures for Collecting Criminal Record Data Outside the Control of a Competent Authority B.E. 2566 (2023), Clauses 3 and 5–7
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
The register fills itself from your org chart, picks the lawful basis with its section, and prints a Section 39 report in one click.
Join the waitlist →Questionnaire, risk register and sign-off in one place, with a printable report.
Join the waitlist →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Join the waitlist →PDPC, ETDA and NCSA requirements in one place — do the work once, evidence several standards.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.