PDPA and HR: How to Handle Candidate Data Lawfully

Practical basics for HR on collecting, using and deleting candidate data under Thailand's PDPA, from application forms and sensitive data to retention periods.

An HR officer at a mid-sized company opens a shared drive folder and finds years of candidate resumes. Some files include ID card copies, medical results and photos. Everyone in the department can open them, and nobody remembers why they were kept. The obvious questions follow: is storing data like this unlawful, and where should you start fixing it?

This article is general information for a basic understanding, not legal advice. For your organisation’s situation, consult a legal adviser or your Data Protection Officer (DPO).

How the PDPA applies to recruitment

Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) has been fully in force since 1 June 2022, according to the PDPA guideline published by the Department of Intellectual Property. In recruitment, the company acts as the data controller, because it decides what data to collect and why. Data in resumes, application forms, test results and interview notes are all personal data.

Principles HR should remember

1. Inform candidates at the point of collection

The guideline summarises what must be communicated to data subjects under Section 23: the purpose, which data is required and the consequences of not providing it, the retention period, who may receive the data, how to contact the controller or DPO, and the data subject’s rights. In practice, HR usually prepares a candidate privacy notice, shown on the application page and attached to acknowledgement emails.

2. Use an appropriate legal basis

Section 24 sets out cases where data can be collected without consent, such as acting on the data subject’s request before entering a contract, or legitimate interest. Reviewing an application a candidate sent you therefore usually falls under these cases. Keeping it to consider for future roles, however, should be clearly disclosed, and separate consent is worth considering.

3. Be careful with sensitive data

Section 26 defines sensitive data, including race, political opinions, religion or philosophy, sexual behaviour, criminal records, health data, disability, trade union information, genetic data and biometric data. This category has stricter conditions and generally requires explicit consent or a legal exception.

Application forms: ask only what you need

Many companies still use old forms that ask for religion, marital status, weight, height or blood type. Question every field: is this data really used to decide whether to hire for this role?

• Normally fine to collect: name, contact details, education, experience, job-relevant skills.
• Review whether needed: photo, date of birth, marital status.
• Do not ask at application stage: religion, health data, criminal records. If the role genuinely requires a check, do it close to the offer stage, state the purpose and obtain consent properly.

Read more about background checks in background checks and the PDPA.

How long to keep it, and how to delete it

The law does not set a fixed number for candidate data, but organisations must set and disclose a retention period. The common principle is to keep data only as long as the purpose requires, such as the review period and a period in which disputes may arise. After that, delete it or make it non-identifiable. Agree the right period for your organisation with your legal team.

The safest candidate data is the data you never collected beyond what you needed.

Common leaks in recruitment

• Forwarding resumes to department heads on personal LINE, leaving files on several phones.
• Shared folders that anyone in the company can access.
• Emailing results to several candidates with everyone in the To field.
• Printing resumes for interviews and leaving them on the table.

The fix is a single channel for sharing candidate data, role-based access, and BCC or individual emails when sending results. The same principles apply to employee data. Read more in PDPA and employee data.

Get organised in 5 steps

1. Map where candidate data lives: email, drives, chat and paper.
2. Revise your application form and remove unnecessary fields.
3. Prepare a candidate privacy notice and have legal review it.
4. Set retention periods and schedule regular deletion of expired data.
5. Train everyone involved in interviewing, not just HR.

When posting jobs through the Plants.work employer page, apply the same principles: request only the data you actually use to decide, and tell candidates clearly how it will be used.