Employer’s Data Obligation Under Thailand’s PDPA

Table of contents

Employers’ Obligations Under the PDPA

Employers have several obligations under the PDPA:

Consent, Notification, and Data Collection Requirements:

According to Section 19 of the PDPA, an employer shall not collect, use, or disclose personal data on employees unless the employee has given consent before or at the time of the collection, use, or disclosure.

  • Ethnic origin,
  • Political opinions,
  • Cult, religious or philosophical beliefs,
  • Sexual behavior,
  • Criminal records,
  • Health data, disability,
  • Trade union information,
  • Genetic data,
  • Biometric data, or
  • Any data which may affect the employee in the same manner.


However, the PDPA provides few exceptions regarding the consent and data collection requirements. Employers can process employees’ personal data when there is a legitimate reason, such as a medical emergency or for workers’ compensation claims, public interest, to meet contractual obligations, or to ensure employment protection.

  1. Employees should be informed about the purpose of collection, processing, retention period, and/or disclosure;
  2. The collection of personal data should be limited to the extent of its purpose of use;
  3. Employees have the right to withdraw consent at any time;
  4. Employers need to inform employees of any consequences associated with the withdrawal of consent;
  5. The employee’s right of access and correction (including the contact information of the person who handles any request for access to the data on the employer’s behalf).

Data Retention

The PDPA does not provide any retention period. However, it requires employers to ensure that they inform employees regarding their personal data retention period.

Data Transfer Obligations

Section 28 of the PDPA addresses the transfer of employee information to third parties, whether in Thailand or abroad. The PDPA states that the destination country and third parties should have adequate data protection standards.

Security Measures Requirements

Employers must take appropriate security measures to prevent unauthorized losses, alterations, or disclosure of employees’ personal data. The PDPA requires that employers implement a system to destroy personal data when the retention period is over, when the data is no longer necessary or when the employee requests its destruction.

Data Breach Requirements

Any personal data breach must be reported to the Office of the Personal Data Protection Committee without delay and, where feasible, within 72 hours after the employer has become aware of it.

Employees’ Rights under The PDPA

Under the PDPA, employees are entitled to a number of rights that the employer needs to honor in order to stay compliant. These rights are as follows:

Right to access:

Employees have the right to access the personal data that the employer collects, uses, and discloses.

Right to be informed:

The employer shall inform the employee about any collection, processing or storage of data prior to or at the time of the collection of the personal data.

Right to erasure:

The employee has the right to request the employer to delete any stored data, except where the employer is not obligated to do so.

Right to rectification:

Employees have the right to rectify incomplete or inaccurate personal data that the employer has stored.

Right to Withdraw Consent:

The employee has the right to withdraw their consent at any time for the purposes that they have consented to the processing of their personal data.

Operationalizing the PDPA

In order to achieve compliance, HR management needs to honor the obligations mentioned above. This can be done in the following ways:

  • Develop formal policies and procedures for data collection and handling.
  • Update privacy policies as needed.
  • Ensure privacy policies and notices are easily accessible.
  • Review and update data handling and security practices.
  • Maintain proper documentation.



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store