Thailand's Personal Data Protection Committee (PDPC) has published its first technology-specific guidance under the Personal Data Protection Act (PDPA): the PDPA Guidelines on Personal Data Protection in the Development and Use of Artificial Intelligence. Digital Policy Alert records version 1.0 as published on 7 October 2026, and law firm Tilleke & Gibbins analysed it on 14 October. The exact issuance date varies between sources, so treat the 7 October date as reported rather than official. The more important point is the substance. The guidelines are advisory, and on the central question of lawful basis they take a more workable position than many peer regulators.
What the guidelines say
According to Tilleke & Gibbins, the guidelines cover the AI lifecycle, including generative and agentic systems. Four points stand out:
- A wide definition of personal data. Prompts, logs, embeddings and identifiable outputs are treated as personal data, so developers must account for them when mapping their data.
- Legitimate interest for scraping. Web scraping for AI training may be permissible under legitimate interest, subject to a documented assessment carried out beforehand and to opt-out mechanisms.
- Consent as a last resort. Organisations should assess the other lawful bases first and treat consent as the fallback.
- Process duties. A data protection impact assessment (DPIA) is expected before any high-risk AI project, and breaches should be reported to the PDPC within 72 hours of awareness.
The guidelines are advisory rather than legally binding. They arrive after a draft that the PDPC released on 17 February 2026, which Tilleke reported went through a short consultation, with comments open until 25 February. MLex, reporting the release, noted the text is published in Thai, which limits what foreign developers can read directly.
The strongest case for stricter rules
The case for a tougher approach deserves a fair hearing. Generative models can memorise and regurgitate personal information, and a person whose data sits in a training set cannot easily see it, object to it or have it removed. Deletion is especially hard once data is baked into model weights. Privacy advocates argue that opt-out regimes shift the burden onto individuals who do not know their data was collected. On this view, consent is the only basis that gives people real control, and an advisory document leaves too much room for firms to read their own interests generously.
That argument has force. But it proves less than it appears to.
Why the legitimate-interest line is the right call
A consent-first rule for training data fails on its own terms. Developers cannot obtain meaningful consent from millions of people whose public posts were collected at scale, and a rule that cannot be satisfied does not protect anyone. It pushes training to jurisdictions with looser norms and leaves Thai-language and Thai-context data underrepresented in the models Thai businesses will actually use. Legitimate interest, by contrast, comes with a built-in discipline: the controller must document a balancing test and give people a way to opt out. That is a proportionate trade, and it keeps accountability with the organisation rather than with individuals.
The guidelines' decision to demote consent therefore reflects how the PDPA's lawful bases are meant to work. The Act itself, available in an unofficial English translation published in the Government Gazette in 2019, offers several grounds for processing, and the guidelines simply direct organisations to use the one that fits.
Where the risk lies
Three features could turn a sensible framework into a compliance burden if applied carelessly.
First, the breadth of the personal-data definition. If every prompt and log is personal data, then every enterprise deploying a chatbot becomes a controller with mapping, retention and rights-handling duties. That is defensible for products that store user conversations. It becomes costly for small firms that merely pass queries through a third-party model. Regulators should say plainly that proportionality applies, and that duties scale with risk and with the organisation's actual control over the data.
Second, the DPIA expectation. The guidelines expect DPIAs for high-risk AI projects, which Tilleke describes as including automated decisions with significant effects, large-scale sensitive data and profiling. The definition of high-risk is where the burden will be set. If it stays narrow, DPIAs add useful discipline. If it widens to cover routine uses, they become paperwork that crowds out real risk management.
Third, the 72-hour breach window. This matches the clock used in many data protection regimes, but AI incidents such as prompt injection or model leakage can take days to scope. The PDPC should be prepared to accept a staged notification that is later supplemented, rather than treating a first report with gaps as a failure.
What the PDPC should do next
Soft law only works if the regulator commits to using it as a reference for good faith, not as a trap. Thailand's approach is more innovation-friendly than a binding AI statute precisely because it can be revised as practice develops. Three steps would protect that advantage:
- Publish an official English summary so foreign developers can engage with the text.
- State that organisations following the guidelines' documented-assessment approach will be treated as acting reasonably in any enforcement action.
- Review the guidelines after a year of use, with published data on how many DPIAs and opt-out requests they generated.
Thailand has avoided the trap of writing a rigid AI rulebook before the technology settled. The challenge now is consistency. If enforcement stays proportionate and the legitimate-interest route stays open, the guidelines can give developers legal certainty without sacrificing meaningful protection for individuals.