Artificial intelligence is rapidly becoming part of everyday business operations in Thailand. Companies now use AI-powered chatbots, automated recruitment systems, customer analytics, document processing tools and generative AI platforms to improve efficiency and support decision-making. However, these technologies often involve collecting, using or disclosing personal information, creating important legal and compliance considerations.
In October 2026, Thailand’s Personal Data Protection Committee PDPC issued new guidelines addressing personal data protection in the development and use of artificial intelligence. The guidelines were subsequently published in the Royal Gazette on November 2, 2026. They provide practical direction on how Thailand’s Personal Data Protection Act (PDPA) applies throughout the AI lifecycle, from data collection and model training to deployment and ongoing operation.
For businesses adopting AI technologies, understanding these guidelines is an important step towards responsible innovation and effective data protection.
Understanding Thailand’s New AI Data Protection Guidelines
The new PDPC guidelines address how organizations should apply existing personal data protection principles when developing or using artificial intelligence systems.
Rather than introducing a completely separate AI law, the guidelines explain how existing PDPA requirements relate to AI technologies, including:
- Generative AI systems and large language models.
- Automated data analysis and profiling.
- AI-powered customer service platforms.
- Recruitment and employee management tools.
- Automated decision-support systems.
- AI agents capable of performing tasks with limited human intervention.
The guidelines cover different stages of AI development and use, including planning, data preparation, model training, testing, deployment and system decommissioning.
Importantly, the guidelines are advisory rather than legally binding legislation. Businesses must distinguish between obligations established by the PDPA and additional practices recommended by the PDPC.
Personal Data Can Appear in AI Prompts, Outputs and Training Data
One important consideration is that personal information may appear in many parts of an AI system, not only in its original training datasets.
For example, employees might enter customer names, email addresses, telephone numbers, financial information or internal business records into an AI-powered assistant.
Depending on the circumstances, information contained in prompts, system logs, generated responses and technical representations such as embeddings may qualify as personal data under the PDPA if an individual can be identified directly or indirectly.
This creates potential compliance risks when businesses use publicly available AI tools without understanding how submitted information is stored, processed or reused.
Organizations should therefore establish clear internal rules concerning the information employees can share with AI platforms.
Who Is Responsible: AI Developers, Providers or Businesses?
AI systems frequently involve several different organizations. A business may purchase an AI service from an external provider, integrate it into its website and use it to process customer information.
Determining the responsibilities of each party is essential.
Under Thailand’s PDPA, organizations may act as:
Data Controllers
A data controller determines the purposes and means of collecting, using or disclosing personal data. A company deciding to use customer information in an AI-powered service may therefore be responsible for the relevant processing activities.
Data Processors
A data processor handles personal data on behalf of a data controller and according to its instructions.
AI Service Providers
An AI provider may act as a processor when providing services under a customer’s instructions. However, if it independently uses customer information for purposes such as training its own models, it may have separate controller responsibilities for that processing.
Businesses should not assume that outsourcing AI operations automatically transfers their legal responsibilities to the technology provider.
AI Training and the Lawful Use of Personal Data
AI development often requires large datasets for training, testing and improving model performance.
However, the availability of personal information does not automatically mean that it can be used freely for AI training.
Under the PDPA, organizations must identify an appropriate lawful basis for processing personal data. Depending on the circumstances, this may include consent, contractual necessity, legal obligations or legitimate interests.
The new PDPC guidelines also address the use of publicly accessible personal information for AI training.
Publicly available information may, in appropriate circumstances, be processed on the basis of legitimate interests. However, organizations should assess the origin of the information, the purpose of collection, necessity, proportionality and the rights of affected individuals.
Businesses should also pay particular attention to sensitive personal data, which is subject to additional requirements under Section 26 of the PDPA.
A responsible AI training strategy should include documented decisions about data sources, lawful bases, retention periods and appropriate safeguards.
Using Third-Party AI Platforms and Overseas Services
Many AI solutions rely on international cloud infrastructure, external APIs and service providers located outside Thailand.
When personal data is transferred internationally or made accessible to overseas organizations, businesses must consider the cross-border transfer requirements under Sections 28 and 29 of the PDPA, as applicable.
Organizations should examine:
- Where personal data is stored and processed.
- Whether overseas providers or subcontractors can access the information.
- Whether personal data is reused for independent purposes.
- What contractual protections are available.
- Whether an applicable cross-border transfer mechanism is required.
AI service agreements should clearly address data processing responsibilities, confidentiality, security measures, retention, deletion and permitted uses of customer information.
Choosing a reputable AI provider is important, but it does not replace the need for appropriate legal and contractual safeguards.
Managing AI Risks Through Security and Human Oversight
AI systems can introduce risks that traditional data protection procedures may not fully address.
For example, an AI recruitment platform might analyse applicant information, while an automated customer service system could generate responses based on personal records.
If these systems produce inaccurate, inappropriate or discriminatory results, individuals and businesses may face practical and legal consequences.
The PDPC guidelines recommend several safeguards, particularly for higher-risk AI applications:
- Conducting AI-focused data protection impact assessments where appropriate.
- Implementing suitable technical and organizational security measures.
- Maintaining records of relevant processing activities.
- Establishing appropriate human oversight.
- Testing AI systems for potential risks and vulnerabilities.
- Reviewing access permissions and data retention practices.
- Monitoring systems after deployment.
These measures should be proportionate to the nature of the AI system, the information involved and the potential impact on individuals.
Businesses should also remember that recommended safeguards in the guidelines are not automatically separate statutory obligations. Their legal duties must be assessed under the applicable provisions of the PDPA.
What Happens When Individuals Request Access or Deletion?
Individuals have rights concerning their personal information under Thailand’s PDPA, including applicable rights to access, correct, erase and object to certain processing activities.
AI technologies can make these requests more complicated.
For example, personal information might be stored in prompts, conversation histories, system logs, datasets or other technical components.
Deleting an original customer record may not automatically remove every copy or representation of that information from an AI-related environment.
Organizations should therefore understand how their AI providers manage personal information and whether their systems can support requests concerning access, correction or deletion.
Businesses should establish procedures for identifying where personal information is stored, coordinating with relevant service providers and responding to data subject requests within applicable legal requirements.
A Practical AI Compliance Checklist for Thai Businesses
Companies operating in Thailand should review their existing AI practices and identify potential gaps in their personal data protection procedures.
The following checklist provides a useful starting point:
- Identify AI systems: Create an inventory of AI tools used by employees, departments and external service providers.
- Review personal data: Determine what personal information is collected, submitted, generated or stored by each system.
- Establish lawful bases: Confirm that personal data processing has an appropriate legal basis under the PDPA.
- Review AI providers: Examine service agreements, privacy policies, data retention practices and model-training arrangements.
- Assess international transfers: Identify overseas data access, storage and processing arrangements.
- Strengthen security: Apply suitable access controls, confidentiality measures and technical safeguards.
- Establish internal policies: Explain which AI tools employees may use and what information they must not submit.
- Prepare for data subject requests: Ensure that procedures exist to locate and manage personal information across AI-related systems.
- Monitor AI performance: Review systems periodically and address newly identified risks.
- Document compliance: Maintain appropriate records of decisions, assessments and safeguards.
Taking these steps can help businesses adopt AI technologies while maintaining responsible personal data management.
Conclusion: Responsible AI Adoption Requires Effective Data Protection
Artificial intelligence offers significant opportunities for businesses in Thailand, from improving customer experiences to streamlining internal operations. Nevertheless, organizations must understand that introducing AI does not remove their existing responsibilities under personal data protection law.
Thailand’s new PDPC guidelines provide an important reference for understanding how the PDPA applies to modern AI technologies. They also encourage businesses to pay closer attention to data collection, model training, third-party providers, international transfers and individual rights.
Companies that review their AI practices now can better identify compliance risks, improve internal governance and build greater confidence among customers, employees and business partners.
At PimLegal, understanding the relationship between technology, business operations and Thai law is essential to helping organizations navigate the evolving digital landscape.