PDPA and AI: how to use language models with Thai customer data

Every AI project in Thailand eventually meets the same question from legal: "Can we send this data to the model?" The honest answer is usually yes, with conditions. This guide explains those conditions in plain language so business and IT teams can design AI systems that pass review the first time.

It is a practical summary, not legal advice. Involve your Data Protection Officer early.

PDPA in one minute

Thailand's Personal Data Protection Act B.E. 2562 (2019) has been fully in force since 1 June 2022. It applies to any organisation that collects, uses or discloses personal data of people in Thailand, wherever the organisation is based. The regulator is the Personal Data Protection Committee (PDPC).

For AI teams, the rules that matter most are:

• Lawful basis. You need one for each purpose: consent, contract, legal obligation, legitimate interest and a few others.
• Purpose limitation. Data collected to deliver an order cannot quietly be reused to train a marketing model.
• Sensitive data. Health, biometric, religious and criminal-record data need explicit consent or a specific legal ground.
• Cross-border transfer. Sending personal data abroad needs adequate protection at the destination or an approved safeguard.
• Data subject rights. People can ask what you hold, correct it, object, or ask you to delete it.

Penalties include administrative fines of up to THB 5 million per violation, plus civil and criminal liability. The bigger cost is usually a halted project.

Where AI creates PDPA risk

Choosing where the model runs

There are three common patterns, and most enterprises end up using more than one.

Global cloud model with safeguards

Fast to start and strong on reasoning. Suitable when prompts contain little or no personal data, or when identifiers are masked before they leave your systems. Check the provider's data processing terms: no training on your data, clear retention, and regional processing where offered.

Private model in a Thai or regional cloud

An open-weight model hosted in a data centre in Thailand or the region. Personal data stays in a controlled environment, which simplifies cross-border questions. You trade some convenience for control.

On-premise or sovereign infrastructure

For banks, hospitals and government agencies with the strictest requirements. The model runs on GPUs you control. It needs more upfront engineering but gives the clearest answer to auditors.

Key takeaway: classify the data in each use case first. The data class, not the hype around a model, should decide where processing happens.

A PDPA checklist for AI projects

Before a use case goes live, you should be able to tick every line:

1. The purpose is written down and matches the privacy notice.
2. A lawful basis is recorded for each purpose.
3. A data protection impact assessment (DPIA) is done for high-risk processing.
4. Personal data in prompts is minimised and identifiers are masked where possible.
5. The model's location and the provider's data terms are documented.
6. Cross-border transfers have a safeguard on file.
7. Retention periods are set for prompts, outputs and logs.
8. Access to logs is limited and audited.
9. People can still reach a human, and decisions that affect them are reviewable.
10. There is a process to handle access and deletion requests that includes AI logs.

What good looks like

The strongest programmes treat privacy as a design input, not a gate at the end. They keep one register of AI use cases with the data class, model location and owner for each. New projects start from approved patterns, so legal reviews take days instead of months.