Formichella & Sritawat - Thailand’s PDPC AI Guidance: What Existing Law Requires—and What the Regulator Recommends

Thailand's Personal Data Protection Committee (PDPC) has issued guidance on the development and use of artificial intelligence (AI) systems that involve personal data. The PDPC released Version 1.0 of the 80-page guidance in October 2026. The notification adopting it, issued under Section 16(3) of the Personal Data Protection Act B.E. 2562 (2019) (PDPA) and dated October 22, 2026, was published in the Royal Gazette on November 2, 2026.
 

The timing matters because businesses already use AI to process customer information, screen applicants, assist employees, and deliver services, often through systems operated by overseas providers. The new guidance addresses familiar PDPA questions in an unfamiliar technical setting. It also follows the consultation considered in our earlier article, Thailand PDPA in Its Second Phase: What Recent Developments Really Indicate.
 

The guidance is official, but it is not binding legislation. It expressly states that it has no binding legal effect, does not determine liability, and does not constitute an authoritative resolution of legal questions under the PDPA. It provides an important reference for how the PDPC recommends applying existing law to AI; it does not make every technical or organizational recommendation a new statutory duty.
 

Responsibility depends on what happens to the data
The guidance draws a practical distinction between AI developers, service providers and businesses deploying their systems. Under Section 6 of the PDPA, a controller has the power and duties to make decisions concerning the collection, use or disclosure of personal data, while a processor acts on the controller’s instructions or on its behalf. Each party’s role follows from its actual activities, not the label chosen in a contract. The same organization may occupy different roles in different activities along an AI supply chain.

Consider a Thai business that uses an overseas chatbot to handle customer inquiries. The Thai business chooses the service, determines its purpose and decides what customer information is submitted. The Thai business is the controller for the processing it determines. The provider acts as a processor when it handles personal data solely on the business’s instructions. If the provider independently uses those conversations to train its own models, it acts as a separate controller for that activity.

Chapter 3 illustrates these different arrangements. The essential inquiry is what each party actually does with personal data. A contract describing every activity as processing on a customer's behalf will not resolve a mismatch between the terms and the provider's practices. Businesses should establish what data their vendors receive, whether prompts or outputs are retained or reused for training, who controls those uses, and what restrictions the agreements impose.

AI training does not provide a new lawful basis for processing
AI projects often reuse information collected for another purpose. Customer-service transcripts, employee records and transaction histories can be useful training material, but access to a dataset does not itself authorize its reuse. Sections 21, 24 and 26 of the PDPA still govern the purposes and lawful bases for the relevant processing. Businesses need to examine what individuals were told when the data was collected and whether the proposed training activity falls within the original purpose or a lawful exception.

The PDPC recommends examining available lawful bases before turning automatically to consent. It describes consent as a last resort and discusses legitimate interests under Section 24(5), supported by a documented legitimate interest assessment (LIA). That is practical advice, not a statutory ranking of lawful bases. The chosen basis must fit the particular processing and satisfy its conditions; an LIA cannot substitute for those conditions.

The distinction is especially important for sensitive personal data. Section 24(5) does not provide a lawful basis for processing personal data governed by Section 26. Section 26 sets out its own requirements and exceptions. Nor can a general claim of legitimate interests overcome the rights and reasonable expectations of children or other affected individuals. The guidance specifically calls for closer attention to their interests in the balancing exercise.

The guidance also takes a more nuanced position on public web data than a simple prohibition on scraping. It contemplates collecting publicly accessible personal data for AI training on a legitimate-interests basis in appropriate circumstances, subject to a properly documented LIA and the applicable PDPA conditions. The guidance recommends checking the lawfulness and provenance of the source, whether technical signals restrict collection, the necessity and proportionality of the data gathered, and ways for individuals to object. Public availability is not unrestricted permission: transparency, purpose limitation, minimization and the Section 32 right to object remain relevant, and the source may contain sensitive data or children's information that requires different treatment.

For organizations developing or buying AI models, this means recording the justification for training-data collection, identifying any new purposes and building workable objection and data-management procedures. A generic assurance that the data came from the open internet is not a substitute for that analysis.

Personal data may remain identifiable inside an AI model
Section 2.4 addresses a difficult question: when data enters a model and is transformed into embeddings, vectors or model parameters, does it stop being personal data? The PDPC cautions that technical transformation does not establish anonymization. An organization must assess whether individuals remain identifiable, directly or indirectly, taking account of the practical means by which information could be extracted or recovered.

The guidance discusses membership inference, model inversion and the reproduction of training material in an output. It also refers to European Data Protection Board Opinion 28/2024. That comparative reference helps explain the concern but does not mean every model trained using personal data must be treated as personal data forever. Section 6 of the PDPA asks whether an individual can be identified directly or indirectly; assessing the practical means of identification helps apply that definition to a particular model.

This matters for providers selling or licensing models as well as for businesses deploying them. The PDPC recommends proportionate inquiry into training-data provenance, the lawful basis used, anonymization measures, available model documentation and known limitations. The purchaser cannot always examine a provider's underlying datasets, but it can ask questions and document the basis for its decision to use the system.
 

Overseas AI services require examination of the actual data flow
AI services frequently rely on foreign cloud infrastructure, APIs and subcontractors. The guidance's Section 5.3 distinguishes overseas data transit or storage without access by an independent foreign recipient from arrangements in which a foreign provider or other entity can access personal data. That distinction can affect whether Sections 28 and 29 and the applicable cross-border transfer rules are engaged. It is not a general exemption for overseas hosting.

The assessment depends on who can access the information, where and for what purpose, whether the recipient is a controller or processor, and which transfer mechanism applies. As explained in Cross-Border Customer Data Under Thailand’s PDPA, the transfer mechanism, role allocation and actual data flows must be examined together. The new AI guidance applies those questions to model services and cloud arrangements, where contract language may not describe all of the technical processing.

For a Thai business purchasing such services, vendor due diligence and the agreement should address access, permitted reuse, subcontractors, security, retention, incident support and any required transfer safeguards. A statement that the vendor stores information securely will not, on its own, answer the cross-border legal question.

AI risks require safeguards, but not every recommendation is a statutory duty
The guidance recommends AI-specific data protection impact assessments (DPIAs), security testing, meaningful human oversight, audit trails and controls for autonomous AI agents. It identifies higher-risk uses such as automated credit decisions, employment screening, large-scale processing of sensitive data or children's information, and systems capable of taking consequential actions without repeated human approval. The recommendations are valuable, but businesses must identify the legal source of any mandatory duty rather than assume every recommended control is compulsory.

The automated-decision discussion illustrates the point. Thailand's PDPA has no direct equivalent to Article 22 of the EU General Data Protection Regulation (GDPR), which establishes a distinct framework for certain solely automated decisions. Section 32 of the PDPA gives data subjects an objection right in specified circumstances: processing based on public task or legitimate interests under Sections 24(4) or 24(5), direct marketing, and certain research-related processing. It does not create a freestanding right to contest every automated decision simply because AI was used. Other PDPA rights, applicable sector laws and general legal remedies may still matter in a particular case.

The guidance recommends that people making consequential decisions have the authority and ability to review AI outputs and change the result, rather than merely approve a machine-generated recommendation. It also recommends DPIAs for high-risk applications. Those measures can help a business meet its existing duties of lawful processing, purpose limitation and security, but their inclusion in nonbinding guidance does not alone create a general statutory DPIA duty or an independent right to human review of all automated decisions.

For agentic AI, the guidance addresses a further risk: an agent may call other systems, access records, send information or alter data with limited human intervention. It recommends least-privilege access, identifiable agent accounts, activity logs and human approval for high-impact or irreversible actions. Organizations should examine these safeguards in light of the systems they actually deploy, the personal data involved and the enforceable legal requirements that apply.
 

Technical limitations do not resolve data subject rights

Section 33 of the PDPA gives individuals the right, in specified circumstances, to request deletion, destruction or anonymization of personal data. That can be straightforward for records held in an ordinary database. It is more difficult when training has incorporated information into model parameters, and deleting the source record does not remove its influence on the model.

The guidance discusses machine unlearning and possible responses to these limitations. They include deleting material from retrieval databases, filtering outputs and removing information during later retraining. Such measures can reduce the risk of further processing or disclosure, but the guidance does not establish that any particular measure necessarily satisfies an applicable statutory erasure requirement. Their adequacy requires a fact-specific assessment under Section 33 and the relevant subordinate rules.

The practical lesson is to consider retention, erasure and technical architecture before deployment. Data protection rights do not disappear because a model is difficult to modify, and a recommended workaround is not a statutory safe harbor.

 

Official guidance has practical significance without becoming binding law
Publication in the Royal Gazette establishes the official provenance of the PDPC's guidance and gives businesses a common reference for AI development and deployment. Its coverage is broad: responsibility across the AI supply chain, lawful bases for training, personal information within models, international processing, data subject rights and operational safeguards. Its nonbinding status remains explicit despite formal publication.

The guidance provides a reference point for assessing compliance with existing PDPA duties. When examining an organization’s safeguards, the PDPC can be expected to consider the practices it has recommended. But a departure from those practices does not, by itself, establish a breach. The legal question remains whether the organization complied with the applicable statutory requirements, taking account of its processing and the risks involved.

As we explained in Regulating AI: Start with the Problem, Not the Model, Thailand should start with laws already in force and identify what genuinely requires a new rule. The PDPC guidance shows how an existing regulator can address AI-related practices within an existing statute, while leaving important questions of interpretation, technical feasibility and legal enforceability open.
 

Businesses should therefore take the guidance seriously without treating it as a substitute for the law. The appropriate starting point is to identify the personal data involved, the actual roles of the parties and the applicable PDPA duties. Only then should an organization decide which additional safeguards are proportionate and useful for its systems. The distinction is between a legal requirement and a regulator's recommended practice, not between compliance and ignoring risk.
 

Principal source
Personal Data Protection Committee, Notification on Guidelines for Personal Data Protection in the Development and Use of Artificial Intelligence, B.E. 2569 (2026), dated October 22, 2026, published in the Royal Gazette on November 2, 2026, Volume 143, Special Part 261 Ng, page 24, with the Version 1.0 guidelines (80 pages) attached.
Official Royal Gazette publication
 

Disclaimer
This article provides general information and commentary based on publicly available materials as of November 3, 2026. The PDPC guidance is nonbinding and must be distinguished from the PDPA and enforceable subordinate legislation. Whether particular measures are legally required depends on the facts, the processing involved, and the applicable law. This article is not legal advice.
© 2026 Formichella & Sritawat. All rights reserved.