Thailand’s Personal Data Protection Act is a relevant starting point for AI use, but a government compliance platform cannot by itself prove that new AI-specific obligations exist.
What the official source confirms
Thailand’s Personal Data Protection Committee operates its Government Platform for PDPA Compliance and publishes materials about implementing the Personal Data Protection Act B.E. 2562. These resources support the existence of a general personal-data regime. They do not establish a universal requirement for every chatbot to display a specific AI disclosure or store prompts only in Thailand.
Classify the prompt and any retrieved content
If a customer service model receives names, phone numbers, purchase histories and complaint summaries, these remain data to assess under privacy rules. Retrieved records and embeddings can also reveal people. Consider whether the model vendor receives the information as an independent actor or under documented processing instructions, and whether logs or support staff can access it.
Avoid confusing training with inference
A vendor may process inputs to answer a question without using them for future model training. These two activities need independent review, as do telemetry, safety monitoring, search-index creation and quality evaluation. Ask the vendor for contractual data-processing terms tied to the exact product and region, not broad marketing claims.
A safer deployment example
An internal HR assistant can answer questions about leave policy from non-personal published guidance without scanning individual medical certificates or disciplinary records. If it must process staff records, restrict retrieval by user role, mask unnecessary identifiers, establish deletion and correction paths, and log decisions by qualified personnel.
Reason for the review label
Official AI-specific implementing provisions and any later statutory amendments were not verified to legal-publication standard in this pass. Regulatory categories, effective dates, transfer restrictions and exemptions require Thai-language primary-law review before a Thailand-specific compliance claim is marked final.
Sources & Further Reading
- Government Platform for PDPA Compliance — Thailand Personal Data Protection Committee.
Jurisdiction/scope: Thailand; PDPA basics, AI-specific legal details unverified. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.