The Personal Data Protection Act B.E. 2562 (PDPA) does not ban organisations from using AI. But whenever personal data goes into an AI tool, the organisation is still the data controller and is fully responsible, no matter whose tool it uses. The duties that bear directly on AI use already come from the Act itself. They are the legal basis for processing (sections 24 and 26), an agreement with the service provider (section 40), sending data abroad (sections 28–29), breach notification within 72 hours (section 37(4)) and the record of processing activities, or ROPA (section 39). The Office of the Personal Data Protection Committee (PDPC, สคส.) has had a final AI guideline since 7 Oct 2026. It was published in the Royal Gazette (ราชกิจจานุเบกษา) on 2 Nov 2026 and has no binding force. But it says clearly that entering personal data into public generative AI is high risk. It recommends enterprise versions with a data protection agreement, and a ban on the provider using the data to train models. The point many articles get wrong is that the PDPA has no section on automated decision-making. Having people review AI output is a recommendation of the guideline, not part of the Act. This article separates what the law requires from what the guideline recommends, with penalties, real fines and a checklist.
This article is a practical reading for setting up your processes. It is not legal advice. Conclusions on a specific case should go through a legal adviser or your organisation's data protection officer (DPO).
How the PDPA sees AI use
Personal data that flows into and out of an AI tool falls under the PDPA at every step. The PDPC guideline walks through each one, from entering data in a prompt, to converting data into vectors (embedding), to using data to train a model.
- The organisation is the data controller, because it decides what the personal data is used for.
- An AI provider that processes data on the organisation's instructions is a data processor. Examples are an enterprise account or an API that promises not to use the data to train models. This relationship needs an agreement under section 40.
- But if the provider decides for itself to collect the data to build its own model training sets, the PDPC guideline classes that developer as a separate data controller. Sending personal data into a tool like this is therefore more than hiring someone to process it. That is why the guideline warns that entering data into public AI may amount to unlawful disclosure (how data handling differs between enterprise and free AI tools (in Thai)).
The PDPC's final AI guideline (7 Oct 2026 · Royal Gazette 2 Nov 2026)
Its full title is the “Guideline on Personal Data Protection Practices for the Development and Use of Artificial Intelligence Technology” (แนวทางการดำเนินการด้านการคุ้มครองข้อมูลส่วนบุคคลเกี่ยวกับการพัฒนาและการใช้งานเทคโนโลยีปัญญาประดิษฐ์), version 1.0, and it runs to 80 pages. The Personal Data Protection Committee issued it under section 16(3). Its Office, the PDPC, prepared it with the Electronic Transactions Development Agency (ETDA, สพธอ.). The draft was open for comment on 19–25 Feb 2026, and the final version was published on the PDPC website on 7 Oct 2026. The document says it has no binding legal force. But it is the regulator's own explanation of how the PDPA applies to AI work.
These recommendations affect organisations that use AI in day-to-day work.
- Public AI: Putting the organisation's personal data into public generative AI is high risk. Organisations should have a policy that bans entering it, or use enterprise versions backed by a data protection agreement.
- Shadow AI: Staff must not connect personal AI tools to company data.
- Contracts: State that the AI provider must not use the organisation's data to train models without permission. If you use an API or the cloud, make a tight agreement, and avoid sending personal data through an API unless you need to.
- Human oversight: High-risk work should not be left fully automated. Someone must be able to intervene in, review or stop the AI's decisions at once.
- AI that makes up false information about people: Organisations have a duty to keep data accurate under section 35. So they should have a process to correct it when they find it, or when the data subject asks.
- Prompt injection: If an attack makes the AI disclose other people's personal data, this may count as a breach that must be assessed and notified under section 37(4).
- Chatbots with customers: Tell customers from the start that they are talking to an automated system.
- Staff: Have a usage policy that states clearly what is not allowed, and train staff to understand the risks of AI hallucination and data leaks.
What the law requires, and what the guideline recommends
| Topic | PDPA requires (the Act and notices) | PDPC AI guideline also recommends |
|---|---|---|
| Legal basis for processing | A basis under section 24 is required. Sensitive data must meet section 26. Disclosure must comply with section 27 | Use consent as the last resort and analyse the other bases first. Carry out a legitimate interests assessment (LIA) when relying on that basis |
| Agreement with the provider | Section 40: the controller must have an agreement with the processor. A B.E. 2565 notice requires the processor to keep data secure and to notify the controller of a breach within 72 hours of becoming aware of it | Ban using the data to train models, hand over logs when an incident occurs, and have a joint incident response plan |
| Sending data abroad | Section 28: the destination must have adequate standards or fall under an exception. Section 29: use appropriate safeguards, such as standard contractual clauses or binding corporate rules (BCR) certified by the PDPC. The notices under both sections took effect on 24 Mar 2024 | If people abroad can access the data, this may count as sending or transferring it abroad |
| Breach notification | Section 37(4): notify the PDPC without delay, within 72 hours of becoming aware of the breach, unless it poses no risk to people's rights. If the risk is high, notify the data subjects too. If you notify late, you must explain why within 15 days of becoming aware | A prompt injection that makes AI disclose other people's data may count as a breach |
| Data accuracy | Section 35: data must be accurate, up to date, complete and not misleading | Have a process to correct false information that AI creates about people |
| Automated decision-making | No specific section in the PDPA | High-risk work must have someone who can intervene in, review or stop the outcome. Explain the logic of the decision so the data subject can understand it |
| Record of processing activities (ROPA) | Section 39: records are required. Small businesses are exempt, unless the processing is not occasional, poses a risk to rights, or involves sensitive data | Add AI use to the ROPA |
| Data protection officer (DPO) | Section 41: required for government agencies, for regular and systematic monitoring of large amounts of data, or where core activities involve sensitive data. A B.E. 2566 notice uses 100,000 people or more as one threshold | The DPO should understand the basic principles of AI, even without being able to write code |
| Personal data in public AI | No specific ban, but disclosure needs a legal basis | High risk. Ban entering it, or use an enterprise version with a data protection agreement |
On sending data abroad: as of the date we checked, we found no list of countries that the PDPC has announced as having adequate standards. So an AI tool that processes data outside Thailand usually relies on the provider's standard contractual clauses under section 29. The section 29 notice accepts the ASEAN Model Contractual Clauses (ASEAN MCC) and the EU Standard Contractual Clauses (EU SCC). Asking for consent each time does not suit everyday use.
Sensitive data is a further layer
Sensitive data under section 26, such as religion, race, health data, biometric data and criminal records, has stricter conditions than general data. It usually needs explicit consent or a specific exception. It is also the only category with criminal penalties under section 79 for unlawful use, disclosure or sending abroad. In practice, do not enter this kind of data into general AI tools at all, unless you have a clear legal basis and use a tool the responsible team has approved. The PDPC guideline suggests considering an on-premises installation for highly confidential or sensitive data.
Penalties and real fines
| Type | Section | Maximum |
|---|---|---|
| Civil | Sections 77–78 | Compensation is payable even without intent or negligence, unless you can prove the damage came from force majeure, the data subject's own act, or following an official's order. The court can award punitive damages of up to twice the actual damages |
| Criminal | Section 79 (sensitive data) | Up to 6 months' imprisonment or a fine of up to THB 500,000. If done to gain an unlawful benefit, up to 1 year's imprisonment or a fine of up to THB 1,000,000 |
| Administrative fine | Section 82 | Up to THB 1 million, for example for not informing people of the purpose, not keeping a ROPA, or not having a DPO |
| Administrative fine | Section 83 | Up to THB 3 million, for example for having no legal basis for processing, unlawful disclosure, sending data abroad in breach of the conditions, or not notifying a breach |
| Administrative fine | Section 84 | Up to THB 5 million, for the same cases where they involve sensitive data |
These penalties are already in use. In August 2024, the Ministry of Digital Economy and Society (MDES, กระทรวงดิจิทัลเพื่อเศรษฐกิจและสังคม) announced that an expert committee (คณะกรรมการผู้เชี่ยวชาญ) had fined a private company a total of THB 7 million. The reasons were having no DPO, inadequate security measures and not notifying a breach. In August 2025, five more fines were reported, and the cumulative total passed THB 21.5 million.
The lesson closest to AI use is that several cases fined both the client and the contractor. A government agency that made no data processing agreement with its system developer was fined together with that company, THB 153,120 each. A private hospital that hired a contractor to destroy medical records but did not monitor the work was fined THB 1,210,000, and the contractor was fined a further THB 16,940. AI providers sit in the same structure. They are processors that the organisation must have an agreement with and must oversee.
What you can do this week
- Make clear whether teams use enterprise or free AI tools, and require enterprise accounts (how enterprise and free versions differ (in Thai)).
- Check that you have a section 40 agreement with every provider, with a 72-hour notification clause and a ban on using the data to train models.
- Check which mechanism each tool relies on for sending data abroad.
- Set a list of data that must "never be entered", and teach staff how to mask data before use (data checklist before you enter anything into AI (in Thai)).
- Add AI use to the ROPA, and put the data sets you will use in order first (getting company data in order before using AI (in Thai)).
- Add AI incidents, such as prompt injection, to your breach response plan.
- Make sure every decision that affects a person has a human reviewer with the authority to change the outcome, even though the law does not require it.
Where you still need an adviser
Choosing the legal basis case by case, the impact assessment (DPIA) for high-risk work, drafting contract clauses and interpreting exceptions are decisions for a legal adviser or the DPO. You can use AI to summarise documents and prepare questions, but the conclusions must come from experts. For the full picture of AI law, including the draft act now on the way, see AI law and regulation in Thailand.
Sources
- Personal Data Protection Act B.E. 2562, Royal Gazette
- Guideline on Personal Data Protection Practices for the Development and Use of Artificial Intelligence Technology, PDPC (7 Oct 2026), and the version published in the Royal Gazette (vol. 143, special issue 261 ง, 2 November 2026 (B.E. 2569))
- Committee notice on sending or transferring personal data abroad under section 28 and under section 29, PDPC
- ASEAN MCC and EU SCC standard contractual clauses, PDPC
- Committee notice on the criteria and procedures for personal data breach notification, B.E. 2565, PDPC
- Committee notice on the appointment of a data protection officer, B.E. 2566, Royal Gazette
- Committee notice on the exemption from keeping records for small businesses, B.E. 2567, PDPC
- MDES and PDPC fine a private company THB 7 million, Ministry of Digital Economy and Society
- PDPC fines government and private bodies, cumulative total over THB 21.5 million, InfoQuest (Aug 2025)
Read next
Read an AI use policy framework for Thai organisations (in Thai) to turn these duties into rules staff can follow. See the AI risks organisations must control (in Thai), and the AI Governance & Responsible AI course and the AI Security course, which can run in-house. Or see the details of our corporate AI training.