Digital communication has transformed the way businesses operate. Employees increasingly use messaging applications such as LINE, WhatsApp, Facebook Messenger, and personal email accounts to communicate with colleagues, customers, suppliers, and business partners.
These tools offer speed and convenience, particularly for companies with remote teams and flexible working arrangements. However, when business communications take place through personal accounts and privately owned devices, important legal and security questions can arise.
Who controls the information exchanged? What happens to customer data stored in an employee’s personal messaging account? Can an employer access business conversations when an employee leaves the company? And how should confidential information be protected when it is shared outside official business systems?
For companies operating in Thailand, these questions deserve particular attention. The Personal Data Protection Act B.E. 2562 (PDPA), contractual confidentiality obligations, cybersecurity requirements, and rules governing electronic records may all be relevant.
Understanding these risks can help businesses establish practical communication policies without unnecessarily restricting employees’ privacy.
Why Personal Messaging Apps Create Business Risks
Many businesses rely on informal communication channels to maintain relationships and respond quickly to operational needs.
For example, a sales employee may communicate with customers through a personal LINE account, while a manager may share confidential documents through WhatsApp. A supplier may also send invoices, payment details, or commercial information directly to an employee’s private email address.
Although these practices may appear harmless, they can create several problems.
Loss of business control: Important commercial conversations may remain in personal accounts that the company cannot access or manage appropriately.
Information security: Business documents and customer details may be stored on devices without adequate security controls.
Employee departures: When an employee resigns, customer relationships, business conversations, and important records may become difficult to retrieve.
Confidentiality breaches: Sensitive commercial information may be forwarded, downloaded, or shared with unauthorised individuals.
Unclear responsibilities: Employees may not know which information can be shared through personal communication channels and which must remain within approved company systems.
The problem is not necessarily the use of messaging applications themselves. It is the absence of clear rules governing how business information is handled.
How Thailand’s PDPA Applies to Business Messaging
Thailand’s Personal Data Protection Act regulates the collection, use, and disclosure of personal data relating to identifiable individuals.
Business messages frequently contain personal information, including:
- Customer names, telephone numbers, and email addresses.
- Employee contact information and internal records.
- Customer requests, complaints, and appointment details.
- Identification documents and payment-related information.
- Personal information exchanged during recruitment or commercial negotiations.
When employees use personal accounts to handle this information on behalf of their employer, the company should consider its responsibilities as a data controller or, where applicable, another relevant role under the PDPA.
The fact that information is exchanged through a private messaging application does not automatically remove the processing activity from the scope of data protection law.
Businesses should consider several important principles.
Lawful processing: The organisation must identify an appropriate legal basis for processing personal data. Consent is not automatically required for every business communication; the appropriate basis depends on the purpose and circumstances.
Purpose limitation: Customer and employee information should only be used for purposes that are properly established and communicated.
Data minimisation: Employees should avoid sharing unnecessary personal information through messaging applications.
Security measures: Organisations should implement appropriate safeguards against unauthorised access, disclosure, alteration, or loss.
Retention: Personal information should not remain indefinitely in personal accounts or on devices when it is no longer necessary for the relevant purpose.
A company should also consider whether its privacy notices, internal procedures, and relationships with third-party service providers accurately reflect the way information is actually handled.
Employee Privacy and Employer Access to Personal Conversations
One of the most sensitive issues arises when an employer wants to review communications stored on an employee’s personal device.
Businesses may have legitimate reasons to investigate suspected information leaks, recover commercial records, or protect confidential customer information. However, this does not mean that employers can automatically access every conversation on an employee’s private messaging account.
Personal devices and accounts may contain information unrelated to employment, including private conversations, family communications, financial details, and sensitive personal information.
Employers should therefore distinguish between:
- Business communications conducted through official company accounts.
- Work-related communications conducted through personal accounts.
- Private conversations unrelated to business activities.
- Information that may be required for a legitimate internal investigation.
Before introducing monitoring or information-recovery procedures, businesses should assess the purpose, necessity, proportionality, transparency, and legal basis of the proposed activity.
A clearly communicated workplace policy can help employees understand which business communications may be reviewed, under what circumstances, and how their personal privacy will be respected.
Importantly, an internal policy should not be treated as unlimited permission to access personal accounts or private messages.
Confidentiality and Intellectual Property Concerns
Business messaging can also expose confidential information and intellectual property to unnecessary risks.
Employees may exchange:
- Marketing strategies and campaign plans.
- Financial reports and commercial proposals.
- Customer databases and supplier information.
- Product designs and technical documents.
- Pricing structures and negotiation records.
- Internal business plans and strategic discussions.
If this information is shared through personal accounts, organisations may find it harder to control access, monitor distribution, and demonstrate that reasonable confidentiality measures were implemented.
Companies should establish clear rules concerning confidential information, including what employees can share, which communication channels are authorised, and how documents should be stored.
Employment agreements, confidentiality agreements, intellectual property provisions, and internal information-security policies should work together.
Businesses should also consider whether employees and external service providers understand their confidentiality responsibilities when communicating through third-party applications.
What Happens When an Employee Leaves the Company?
Employee departures are an important moment for businesses that rely heavily on personal messaging applications.
Consider a situation in which a sales representative has managed customer relationships through a personal LINE account for several years.
When that employee leaves, the organisation may discover that important conversations, customer requests, quotations, and commercial arrangements are stored exclusively in the employee’s private account.
This creates several operational and legal concerns:
- Important business records may become unavailable.
- Customer communication may be interrupted.
- Confidential information may remain on personal devices.
- The company may have difficulty demonstrating previous agreements or instructions.
- The departing employee may retain information that should be protected.
Businesses should address these situations before they occur.
A structured offboarding procedure should identify relevant business records, establish an appropriate process for transferring company information, revoke access to corporate systems, and confirm the handling of confidential materials.
Any collection or transfer of information from personal devices should be conducted within an appropriate legal framework, respecting employee privacy and applicable data protection requirements.
The objective should be to preserve legitimate business records without unnecessarily collecting unrelated personal information.
Electronic Messages as Business Records and Evidence
Messaging applications are increasingly used to discuss commercial arrangements, confirm instructions, negotiate prices, and coordinate contractual obligations.
As a result, electronic messages may become relevant when a commercial disagreement arises.
Thailand’s Electronic Transactions Act B.E. 2544 (2001) provides a legal framework for electronic transactions and recognises the legal relevance of electronic data messages. Electronic information should not be rejected as evidence solely because it is in electronic form.
However, the existence of a message does not automatically establish every legal element of a contractual claim.
Businesses may still need to consider:
- The identity of the person who sent the message.
- The authenticity and integrity of the communication.
- Whether the message was complete or taken out of context.
- The authority of the employee involved.
- Whether the parties intended to create a binding agreement.
- Whether the relevant contractual requirements were satisfied.
For this reason, companies should avoid treating messaging applications as their only record of important contractual decisions.
Significant agreements, approvals, changes in scope, and financial commitments should be documented through appropriate business procedures and retained in accessible company systems.
Practical Steps to Reduce Legal and Security Risks
Businesses do not necessarily need to prohibit all personal messaging applications. Instead, they should establish a structured approach based on the sensitivity of the information and the operational needs of the organisation.
The following measures can help.
1. Establish an acceptable-use policy
Define which messaging applications may be used for business communications and identify situations in which personal accounts should not be used.
2. Introduce official communication channels
Provide employees with approved business accounts and systems for customer communications, document sharing, and internal collaboration.
3. Classify business information
Identify information that can be shared through ordinary messaging channels and information that requires stronger protection.
4. Train employees
Explain how to recognise phishing attempts, suspicious attachments, accidental disclosures, and requests for confidential information.
5. Strengthen access security
Encourage strong authentication, device security, secure account recovery, and appropriate access controls.
6. Establish retention and recordkeeping procedures
Determine which communications need to be retained as business records and how they should be transferred into approved company systems.
7. Review employment and confidentiality agreements
Ensure that employment contracts, confidentiality provisions, and internal policies address the handling of company information and customer data.
8. Prepare an employee departure procedure
Establish clear processes for preserving relevant business records, removing corporate access, and handling confidential information when employees leave.
9. Review third-party applications
Assess the security, privacy practices, contractual terms, and data-processing arrangements of messaging services used by the organisation.
10. Create an incident response process
Establish procedures for reporting accidental disclosures, compromised accounts, lost devices, and other incidents involving personal or confidential information.
Building a Practical Communication Policy for Thai Businesses
An effective communication policy should reflect how employees actually work.
A policy that simply prohibits personal messaging applications may be difficult to enforce if employees regularly communicate with customers through these channels.
Instead, organisations should develop practical rules that address different communication scenarios.
For example, a business could allow ordinary scheduling messages through approved channels while requiring customer identification documents, financial records, and confidential contracts to be exchanged through more secure systems.
The policy should also explain how employees must report accidental disclosures, how business records are preserved, and what happens when a device is lost or an employee leaves.
Management, human resources, IT, and legal advisers should work together to ensure that the policy is practical, proportionate, and consistent with the company’s legal obligations.
Regular reviews are also important because communication technologies, business operations, and cybersecurity risks continue to evolve.
Conclusion: Convenience Should Not Replace Legal Protection
Personal messaging applications have become an important part of modern business communication. They allow employees to respond quickly, maintain customer relationships, and coordinate work across different locations.
However, convenience should not come at the expense of privacy, confidentiality, information security, or business continuity.
For companies operating in Thailand, the challenge is to balance operational flexibility with appropriate legal safeguards.
By establishing clear communication policies, protecting personal data, preserving important business records, and respecting employee privacy, organisations can reduce unnecessary risks while maintaining efficient working relationships.
A proactive legal review can help businesses identify weaknesses in their communication practices and develop procedures that reflect their actual operations.