Background Checks in Thailand: How to Stay Within the Law

Doing background checks the wrong way under PDPA risks fines and lawsuits. Know what you can check, how to get consent, and when to use a licensed vendor.

Many Thai companies still run background checks the old way, emailing former employers or calling people in their network without written consent, and that puts them squarely at risk of breaching PDPA. In 2026 the law and its enforcement have tightened, with precedent cases ending in fines and reputational damage. A proper Background Check does more than comply with the law. It also reduces the risk of a bad hire and builds trust on both the candidate side and the company side.

The Legal Framework HR Needs to Know

Background checks in Thailand fall under several laws that work together.

Relevant laws

1. PDPA, the Personal Data Protection Act, covering the collection, use and disclosure of candidate data
2. Employment law, for criminal record checks
3. The Investigation Business Act, for vendors that perform background checks
4. Industry-specific laws, such as in finance and healthcare, that add further requirements

The key PDPA principle for background checks is having a lawful basis for processing data. Most companies rely on the candidate's written consent, clearly stating what will be checked, how long it will be kept and who it will be shared with.

What You Can Check Under the Law

Not everything you want to check can automatically be checked. There must be a reason directly related to the job.

Items you can normally check

• Education history, by contacting the university directly through its set procedures
• Employment history, by contacting the former company's HR with the candidate's permission
• Professional licences, such as the Council of Engineers or the Medical Council, through the relevant agency's system
• Criminal records, through the police system, submitted by the candidate
• Financial credit, only for positions where it is directly relevant

Items to be careful with or that are not allowed

• Checking social media without telling the candidate breaches PDPA
• Contacting people in the candidate's network without permission
• Asking about health, religion or politics when unrelated to the job
• Collecting data from a former company's HR without obtaining fresh consent
• Hiring an unlicensed investigation vendor

Every item you check must have an explanation of why it is relevant to this position. If you can't explain it, you shouldn't check it.

How to Obtain Consent Properly

Consent under PDPA must meet several conditions. It is not just a tick box.

Conditions consent must meet

1. Clearly state the types of data to be collected, such as education and employment history
2. State the purpose of collection: assessing suitability for employment
3. State who will receive the data, such as HR and the vendor used
4. State the retention period, such as 6 months after the process ends
5. State the candidate's rights, such as the right to correct, delete or withdraw consent
6. Explain how to contact the company's DPO with any questions

A practical consent form should be 1 to 2 pages in plain language, not legal jargon that candidates won't read. Many companies use digital consent through DocuSign, which keeps an audit trail.

A background check is not an investigation. It is a verification of the information the candidate provided, all done respectfully and within the law.

Choosing a Background Check Vendor

In many cases companies use a vendor for speed and expertise. Choosing the wrong one creates compliance risk that the company bears itself.

Vendor selection criteria

• Holds a valid investigation business licence
• Has a DPA (Data Processing Agreement) with the company that clearly defines responsibilities
• Has PDPA-compliant processes for storing and destroying data
• Has an auditable audit log
• Has insurance covering damages from errors
• Has references from large companies in Thailand that use its services

Paying a low price to an unlicensed vendor leaves the company fully liable if something goes wrong. Many large companies in Thailand have started auditing their entire vendor lists in 2026 to cut vendors that don't comply.

Handling Background Check Results

When you find information that doesn't match what the candidate declared, it must be handled systematically.

Steps when you find a red flag

1. Verify the accuracy of the information first; it may be an error
2. Give the candidate a chance to explain and submit additional evidence
3. Consider the context and its relevance to the position
4. Document the decision with the reasons and keep an audit trail
5. Communicate the outcome to the candidate respectfully, without disclosing specific details that could create risk

Rejecting a candidate on the basis of a background check while openly disclosing every detail can create defamation and PDPA issues. Communication should go through legal review.

Storing and Deleting Data

Background check data that you store has a retention period specified in the consent. Keeping it beyond that period breaches PDPA.

The standard used in Thailand in 2026 is to keep data for no more than 6 months after the process ends for unsuccessful candidates, and for the duration of employment for those who are hired. After the contract ends, the data must be deleted or anonymised as stated in the privacy notice.

To connect this with the growing skillfishing trend, read What Is Skillfishing to understand why background checks matter even more, and PDPA and Candidate Data for a deep dive into the law.

For organisations using AI in screening, read AI candidate screening so the whole system complies as one, and Agentic AI in HR to see the future of HR automation.

For HR professionals who want to learn about PDPA compliance in recruitment, explore legal-HR courses in Plants.work Learn or consult a legal adviser via the Mentors page. In short, a lawful background check isn't difficult, but it must be systematic, deliberate and respectful of people's data.