PDPA and AI: Which Data Can You Send to AI, and Which You Should Not

Understand the PDPA basics that matter when you use AI at work: personal data, sensitive data, cross-border transfers, and a checklist before you hit Enter.

You receive an Excel file with 500 customers: names, phone numbers, emails and purchase history. Your manager asks which customer groups to call back first. The fastest route is to attach the whole file to an AI chatbot and ask. Before you hit Enter, pause for a moment. What you are about to do is send the personal data of 500 people outside your organisation, and that is exactly where Thailand's Personal Data Protection Act, the PDPA, comes in.

What is the PDPA and how does it relate to AI?

The PDPA is Thailand's Personal Data Protection Act B.E. 2562 (2019). According to the Government Public Relations Department, it came fully into force on 1 June 2022. The law gives rights to data subjects and sets duties for organisations that collect, use or disclose personal data.

Personal data is information that can identify a living person, directly or indirectly, such as a name, phone number, email, address or online identifier. When you send this kind of data to an AI service for processing, you are using or disclosing personal data, and it has to be done properly, just like sharing data with any other third party.

Three types of data to tell apart

1. General data that does not identify anyone

For example, total monthly sales, article content or product information. This is the easiest data to use with AI, though you still need to protect your company's trade secrets.

2. Personal data

Names, phone numbers, emails and purchase history tied to individuals. You need a lawful basis to use it, and you must use it for the purpose you told the data subject about.

3. Sensitive data

Section 26 of the PDPA treats data on race, ethnicity, political opinions, cult, religious or philosophical beliefs, sexual behaviour, criminal records, health, disability, trade union information, genetic data and biometric data as sensitive, with stricter conditions. This group should not go into general-purpose AI tools at all.

What people often overlook when using AI

• Consent is not the only route: the Personal Data Protection Committee's guideline on consent describes consent as the last legal basis, to be considered after the other bases under sections 24 and 26. Whatever the basis, the use must match the stated purpose.
• The AI provider may be a data processor: a processor must act only on the controller's instructions, so organisations should have a clear contract or data processing terms.
• Servers abroad: the PDPA has rules on sending or transferring personal data overseas, which require the destination to have adequate data protection standards, or the transfer to fall under an exception in Section 28, or appropriate safeguards to be in place.
• Breaches must be reported: a data controller must notify the Office of the Personal Data Protection Committee (PDPC Office) of a personal data breach without delay and, where feasible, within 72 hours, unless the breach is unlikely to pose a risk to data subjects' rights. If the risk is high, the data subjects must be notified as well.

In addition, the Personal Data Protection Committee has issued guidelines on personal data protection in the development and use of artificial intelligence. As summarised by Tilleke & Gibbins, they are not legally binding but reflect the Committee's interpretation of the PDPA. Key points: prompts containing identifiable information, usage logs, and AI outputs that can identify people can all be personal data, and contracts with AI providers should prohibit unauthorised use of client data, such as for model training.

Before sending data to AI, ask yourself: if the data owner saw what I am doing, would they be fine with it?

How to work with AI more safely

• Remove names or replace them with codes (for example, Customer A001) before asking AI to analyse.
• Send only the columns you need. Analysing purchase behaviour does not require phone numbers.
• Use company accounts approved by IT, and read the terms on whether the provider uses your data to train its models.
• Use a RAG system with access controls instead of pasting whole files. Read more in What is RAG.

Watch out for

This article is general information, not legal advice. What applies to you depends on your business, contracts and the data involved. Consult your Data Protection Officer (DPO) or a lawyer experienced in the PDPA before building AI systems that use personal data, and keep up with the latest announcements from the Office of the Personal Data Protection Committee (PDPC).

Checklist before you hit Enter

1. Can this data identify a person? If so, can you remove it or replace it with a code?
2. Is any sensitive data under section 26 mixed in?
3. Does this use match the purpose you told the data owner about?
4. Has the company approved this AI tool?
5. If the data leaks, do you know whom to notify?

To learn more about the PDPA in people work, read PDPA and candidate data. If your organisation is setting AI rules company-wide, start with AI Governance for SMEs.