Common risks when staff use AI with personal data, the PDPA principles that apply, ways to use AI safely, and a checklist for IT and legal teams.
AI tools make writing, summarizing and analysis much faster, and many employees already use them every day, often before their organization has set any guidelines. The obvious next question is: if staff use customer or employee data with AI, what risks does the organization face under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA), and how should it manage them?
This article is general information for a basic understanding. It is not legal advice. Organizations should consult legal experts about their own situation.
Common risks in everyday use
Most risks do not come from bad intent. They come from good intentions to get work done faster, for example:
- Pasting a customer list with phone numbers into an AI tool to help write follow-up messages
- Uploading job applicants’ resumes so the AI can summarize and compare them
- Copying customer conversations that contain health or financial information so the AI can draft a reply
- Uploading contracts or internal documents for the AI to summarize
In each case, personal data is sent to an outside provider, and the organization may not know where it is stored, for how long, or how it will be used.
PDPA principles that apply to AI
The PDPA does not prohibit AI, but several of its principles apply to processing data with AI just as they do elsewhere.
- A lawful basis. Using personal data needs a lawful basis, such as consent, performance of a contract or legitimate interest, and must match the purposes communicated to the data subject.
- Use only what is necessary. Collect and use only the data needed for the purpose. If the task can be done without names or ID numbers, do not send them to the AI.
- Extra care with sensitive data. Health, religion, criminal records, biometric data and other categories defined by law have stricter conditions than ordinary personal data.
- Transfers abroad. Many AI services process data on servers outside Thailand, and the PDPA has specific conditions for transferring personal data abroad.
- Data processors. When an outside service processes data on its behalf, the organization, as data controller, should have an agreement with the provider and make sure appropriate security measures are in place.
- Security measures. The organization must have measures to prevent unauthorized access, use or disclosure of data.
- Breach notification. If a data breach poses a risk to data subjects’ rights, the organization must notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, as the law requires.
- Data subject rights. Data subjects can ask to access, correct or delete their data, which is hard to do if the data is spread across several AI tools with no record.
Ways to use AI safely
Organizations do not need to ban AI altogether. Common options come in several levels and are often combined.
1. Set a clear AI usage policy
Start with what you can do immediately at almost no cost: state which tools are allowed, which types of data must not be used with outside AI, and what to do before using AI, such as removing names, ID numbers and phone numbers. Train staff so they understand the reasons, rather than just sending out a notice.
2. Choose AI services with business terms
Many AI providers offer business plans whose terms exclude training models on customer data, include encryption, set data retention periods and provide a data processing agreement. Read these terms carefully before allowing use with internal data.
3. Use an internal AI system with access control and logging
For work that regularly needs internal data, an organization’s own AI system lets you decide who can access what, log who asked what and which documents the answers came from, and delete data when a data subject asks.
4. Run AI on your own servers
For the most sensitive data, such as health information, customers’ financial data or trade secrets, some organizations run AI models on their own servers, so the data never leaves the organization. The trade-off is higher hardware and maintenance costs.
Checklist for IT and legal teams
- Do you know which AI tools employees are using?
- Is there an AI usage policy that lists allowed tools and prohibited data?
- Has data been classified: what is personal data, and what is sensitive?
- Have you read the terms of the AI services in use, including model training, storage location and retention?
- Is there a data processing agreement with providers that process personal data for the organization?
- Have the conditions for transferring data abroad been checked?
- Is usage of AI systems that access internal data logged?
- Has the privacy notice been updated if AI processes customer or employee data?
- Does the data breach response plan cover AI-related cases?
- Have employees been trained, with regular refreshers?
Summary
The PDPA is not an obstacle to AI. It is a framework for using AI responsibly. The best starting point is to know what employees are already using, set a clear and practical policy, and match tools to how sensitive the data is. Organizations that set guidelines early get more out of AI and reduce both legal and reputational risk.
