Thailand Issues New Privacy Guidelines for AI Data Management

Thailand’s Personal Data Protection Committee has issued new privacy guidelines regarding the management of personal data in artificial intelligence (AI) systems. Announced on 9 October 2023, these guidelines clarify how Thailand’s existing Personal Data Protection Act (PDPA) applies throughout the entire AI lifecycle, covering aspects from model training to deployment, prompts, outputs, and individual requests for data access or deletion.

The guidelines are non-binding but serve to clarify and reinforce existing obligations under the PDPA, which includes principles such as lawful processing, purpose limitation, transparency, data minimization, security, and accountability. Thailand currently lacks a dedicated binding law governing AI and personal data use, leading regulators to adapt the PDPA as a framework for managing AI-related privacy risks as they arise.

One significant aspect addressed is the use of personal information for training AI models. Companies are required to establish a lawful basis for processing personal data, which may include obtaining consent, contractual necessity, legal obligations, or legitimate interests as permitted under the PDPA. Organizations must also ensure they only collect data that is essential for AI development, as the datasets involved can be extensive, often comprising information from customers, employees, and public sources.

The guidelines emphasize that companies cannot assume that data collected for one purpose is automatically suitable for AI training. Careful consideration must be given to whether such uses comply with privacy laws. Personal data may be input into AI systems through user prompts and could also be reflected in the answers or recommendations generated by these systems. This is particularly relevant for sensitive information, such as financial records or health data.

For businesses that utilize external AI providers, the guidelines mandate a clear understanding of roles, specifying whether the organization or the AI vendor acts as the data controller or processor. This delineation is crucial for both parties to understand their responsibilities in protecting personal data.

Additionally, Thailand encourages organizations to conduct Data Protection Impact Assessments (DPIAs) prior to deploying AI systems that handle substantial amounts of personal or sensitive data. DPIAs can help identify data collection methods and potential risks, and they are especially important when AI influences significant decisions in areas like recruitment or healthcare.

A notable challenge addressed by the guidelines relates to generative AI. Unlike traditional databases, where a person’s record can be easily located and deleted, AI models embed information within their internal parameters, complicating the process of ensuring that an individual’s data has been fully removed following a deletion request. The guidelines highlight the need for companies to implement technical and organizational measures that extend beyond simply deleting the original training data.

These privacy guidelines are part of Thailand’s broader strategy to develop AI governance as the technology rapidly evolves. The government is also working on national AI plans for the periods of 2027 and 2028–2032, which include initiatives like an AI Governance Sandbox and a National AI Data Bank.

For businesses operating in Thailand, the guidelines underscore that simply acquiring an AI service does not absolve them of responsibility regarding personal data. Companies must be aware of the origins of their training data, the legal grounds for using it, user inputs into AI prompts, and how third-party providers manage that information. The guidelines reinforce the principle that personal information retains its privacy protection, even when integrated into AI systems.