Businesses collect personal information every day. Customer registrations, employee records, website enquiries, payment transactions, marketing databases and recruitment applications all generate information that organisations need to manage responsibly.
However, collecting personal data is only one part of data protection compliance. Businesses must also understand how long they can retain that information, when it should be deleted and what procedures should apply when an individual requests its removal.
Under Thailand’s Personal Data Protection Act B.E. 2562 (2019), commonly known as the PDPA, organisations cannot treat personal data as information that may be stored indefinitely. They must establish appropriate retention periods and systems for erasing or destroying information when it is no longer necessary, subject to applicable legal exceptions.
This article explains the key legal requirements and practical steps Thai businesses should consider when developing a data retention and deletion policy.
1. Why Data Retention Matters Under Thailand’s PDPA
Personal data retention refers to the period during which an organisation stores information relating to identifiable individuals.
Examples include:
- Customer names, telephone numbers and email addresses.
- Employee and former employee records.
- Identification documents and financial information.
- Website visitor information and online activity records.
- Marketing databases and customer communication histories.
- Job applications and recruitment records.
Keeping this information longer than necessary can increase privacy, cybersecurity and regulatory risks.
For example, an organisation that retains outdated customer databases indefinitely may expose individuals to unnecessary risks if its systems are compromised.
The PDPA therefore requires businesses to consider the purpose of collecting information and establish appropriate arrangements for reviewing and disposing of personal data.
2. What Does the PDPA Say About Data Retention?
Section 37 of the PDPA establishes important responsibilities for data controllers.
In particular, Section 37(3) requires data controllers to establish an examination system for erasing or destroying personal data when:
- The applicable retention period has expired.
- The personal data is no longer relevant or necessary for its original purpose.
- The data subject requests deletion or destruction.
- The data subject withdraws consent, where consent was the applicable legal basis and no other legal basis permits continued processing.
This obligation is subject to specific legal exceptions, including circumstances involving legal claims and compliance with applicable laws.
Section 39 also requires relevant data controllers to maintain records that include the retention period of personal data, subject to applicable exemptions.
Importantly, the PDPA does not establish one universal retention period for every category of personal information. Businesses must determine appropriate periods by considering the purpose of processing, applicable legal obligations and relevant industry requirements.
3. How Should Businesses Determine Data Retention Periods?
A practical retention policy should identify how long different categories of personal information need to be stored.
Businesses should avoid applying one general retention period to every document or database.
Instead, they should assess each category individually.
Customer information
Customer information may need to be retained while a commercial relationship remains active or for a legally required period after a transaction.
Employee records
Employment records may need to be maintained for payroll administration, employment obligations, tax requirements and potential labour disputes.
Recruitment information
Information relating to unsuccessful job applicants should not automatically remain in recruitment databases indefinitely. Organisations should establish a reasonable retention period based on their recruitment purposes and any applicable legal requirements.
Marketing databases
Customer information collected for marketing should be reviewed regularly. Businesses should consider whether the original purpose remains valid and whether the applicable legal basis continues to support its use.
Website and analytics information
Cookies, tracking identifiers, website logs and analytics records should be reviewed to ensure that their retention remains consistent with the purposes communicated to users and applicable data protection requirements.
For every category, businesses should document the purpose, retention period, applicable legal basis and disposal procedure.
4. What Happens When Someone Requests Data Deletion?
Section 33 of the PDPA gives data subjects the right to request the erasure or destruction of their personal data, or its anonymisation, in specified circumstances.
These include situations where:
- The information is no longer necessary for the purpose for which it was collected, used or disclosed.
- Consent has been withdrawn and no other legal basis permits continued processing.
- The data subject successfully exercises an applicable right to object.
- The personal data has been unlawfully collected, used or disclosed.
However, this right is not absolute.
A business may have grounds to retain certain information where an applicable legal exception applies, including the establishment, exercise or defence of legal claims or compliance with legal obligations.
When a deletion request is received, organisations should:
- Verify the identity of the requesting individual where appropriate.
- Identify the personal information covered by the request.
- Determine the applicable legal basis and whether an exception permits continued retention.
- Assess whether the information must be deleted, destroyed or anonymised.
- Document the decision and actions taken.
- Communicate the outcome to the data subject as required.
Thailand’s PDPC notification on criteria for deletion, destruction and de-identification, effective from 11 November 2024, also establishes requirements concerning the handling of deletion requests, including a period of up to 90 days in the circumstances covered by the notification.
Businesses should therefore ensure that their internal procedures reflect the applicable requirements rather than relying on informal or inconsistent deletion practices.
5. Why Deleting Information from One System May Not Be Enough
Modern organisations rarely store personal information in only one location.
Customer and employee information may be distributed across:
- Internal databases and business applications.
- Cloud storage platforms.
- Customer relationship management (CRM) systems.
- Email accounts and communication platforms.
- External service providers.
- Marketing automation tools.
- Backup and disaster recovery systems.
Deleting information from a primary database does not necessarily mean that every copy has been removed.
Businesses should therefore map where personal data is stored and establish procedures covering relevant systems, copies and backups.
Where third-party processors handle personal information, organisations should also review contractual arrangements and deletion responsibilities.
A clear procedure should explain how deletion instructions are communicated, implemented and verified across relevant systems.
6. Data Anonymisation: An Alternative to Deletion?
In certain situations, organisations may have legitimate reasons to preserve information for statistical analysis, research or operational reporting.
Where appropriate, anonymisation may provide an alternative to retaining identifiable personal data.
Anonymisation involves processing information so that individuals can no longer be identified, directly or indirectly, using means reasonably available.
For example, a business may wish to analyse historical customer purchasing trends without retaining names, telephone numbers or other identifying information.
However, simply removing a person’s name is not necessarily sufficient. Other information, such as unique identifiers, transaction histories or combinations of personal details, may still make identification possible.
Businesses should therefore assess whether anonymisation is effective and whether the resulting information continues to qualify as personal data under applicable law.
7. The Risks of Poor Data Retention Management
An inadequate retention and deletion policy can create several business risks.
Regulatory exposure
Failure to establish appropriate data disposal procedures may result in non-compliance with the PDPA.
Data breaches
Retaining unnecessary personal information increases the volume of data that could be exposed in a cybersecurity incident.
Operational inefficiency
Uncontrolled data storage makes it more difficult to identify, manage and retrieve relevant information.
Third-party compliance risks
Businesses may lose visibility over personal data stored by cloud providers, marketing agencies and other external service providers.
Reputational damage
Customers and employees may lose confidence in organisations that cannot demonstrate responsible personal data management.
Effective retention management is therefore not simply an administrative exercise. It is an important part of corporate governance and risk management.
8. A Practical Data Retention Compliance Checklist
Thai businesses should consider implementing the following measures:
- Identify personal data: Map the categories of personal information collected and stored.
- Define purposes: Document why each category of information is processed.
- Set retention periods: Establish appropriate retention periods based on business purposes and applicable legal requirements.
- Update privacy notices: Ensure that individuals receive relevant information about retention periods or the criteria used to determine them.
- Implement deletion procedures: Establish processes for erasing, destroying or anonymising information when required.
- Manage deletion requests: Create a consistent procedure for receiving, assessing and responding to data subject requests.
- Review third-party providers: Check whether contracts address data retention, deletion and return of personal information.
- Manage backups: Include relevant backup and recovery systems in the disposal strategy.
- Maintain records: Document retention decisions, deletion activities and applicable legal exceptions.
- Conduct regular audits: Review retention schedules and disposal procedures periodically.
Conclusion: Treat Data Retention as an Ongoing Compliance Responsibility
Data protection compliance does not end when personal information is collected. Businesses must also manage the entire information lifecycle, including storage, access, review, retention and eventual deletion.
Under Thailand’s PDPA, organisations should establish clear retention periods, maintain appropriate disposal procedures and ensure that deletion requests are assessed in accordance with applicable legal requirements.
A structured data retention policy can help businesses reduce unnecessary data exposure, improve internal governance and demonstrate a more responsible approach to personal information.
For organisations operating in Thailand, reviewing existing data storage practices is an important step towards stronger PDPA compliance.