Thailand: AI Personal Data Protection Guidelines (PDPC)

ThailandGuidanceApplicable

Thailand’s Personal Data Protection Committee has issued its guidelines on applying the Personal Data Protection Act B.E. 2562 (2019) (PDPA) to the development and use of artificial intelligence. They cover the AI lifecycle for analytic, generative and agentic AI. They are addressed to personal data controllers, processors, AI developers and AI deployers. The guidelines are not legally binding. They explain how existing PDPA duties may apply and set out good-practice expectations on privacy notices, legal basis, risk and impact assessments, security, breach response and data subject rights. They contain no dedicated hiring or employment rules. Warden Watch focuses on the provisions most relevant to employment. These include treating AI-assisted recruitment screening and employee performance evaluation as high-risk uses, meaningful human review of significant automated decisions, and controls over AI vendors.

Impact

What this means for HR and vendors

HR and recruitment teams

HR teams using AI to screen applicants or assess employees may need to treat those tools as high-risk personal data processing. Organizations should ensure candidates and employees receive clear, AI-aware privacy notices. They should also complete a data protection impact assessment before deployment and give reviewers real authority to overturn automated outcomes. This increases the importance of channels for contesting decisions, bias checks on data and outputs, vendor due diligence and data processing agreements, and breach response plans. Because the guidelines are non-binding, they mainly show how the regulator may read existing PDPA duties.

HR technology vendors

The guidelines do not create standalone duties for HR technology providers. Instead, they set expectations that customers will pass on through contracts and due diligence. The guidance says legal role depends on who decides the purposes and means of processing, not on a vendor’s label. A provider that uses customer data to train its own model may become a controller itself. Providers may therefore face requests for data processing agreements, limits on secondary use of customer data, deletion support, and logs and cooperation after an incident.

Key obligations

What organizations need to do

Practical obligation briefings focused on what the requirement is, who it applies to, when it applies and what teams should consider doing.

DeployerTransparency & Notice

Mechanisms for Data Subject Rights Requests in AI Systems

OBLIGATION

APPLIES TO

STATUS

Keep up with changes to employment AI rules and cases.

Get an email when we add important regulation or litigation, or when a tracked matter materially changes.

Not legal advice

This page is regulatory intelligence only. Organizations should seek guidance from legal counsel before making compliance decisions.

Employment-focused extraction

This may be part of wider regulation. The Warden Watch extracts and displays the parts relevant to employment, HR and recruitment decision-making.

HR and recruitment teams

HR technology vendors

AI-Aware Privacy Notice

Advance Notice of Significant Automated Decisions

Explanation of Automated Decision Inputs and Logic

Meaningful Human Review of Significant Decisions

Channel to Request Human Review and Contest Decisions

Data Protection Impact Assessment for High-Risk AI

Fairness and Bias Mitigation in AI Use of Personal Data

Regular Checks for Bias in Data and Outputs

Vendor Due Diligence and Data Processing Agreements for AI Services

Provider Support for Incident Investigation and Log Access

Retain AI-Specific Digital Evidence and Logs

Breach Notification to the PDPC Within 72 Hours

Mechanisms for Data Subject Rights Requests in AI Systems

Keep up with changes to employment AI rules and cases.

Manage Consent Preferences