This article provides general information and does not constitute legal advice. Specific advice should be obtained for your circumstances.
Since 2019, Thai law has given individuals the right to see the personal data a business holds about them. What it never said was how that request should be handled. As of 14 September 2026, it does – and the regulator has also set out how the PDPA applies to artificial intelligence.
At a glance
- The PDPC’s notification on data subject access requests was published in the Government Gazette on 16 July 2026 and took effect on 14 September 2026.
- Controllers must respond within 30 days, extendable by a further 30 days with reasons, and may refuse only on specified grounds.
- New PDPC guidelines treat AI prompts, logs, embeddings and outputs as potentially personal data. They are advisory, but signal how the regulator will read the law.
From a right on paper to a process in practice
Section 30 of the Personal Data Protection Act B.E. 2562 (2019) lets a person ask for access to, and a copy of, their personal data, and ask where data obtained without their consent came from. The new notification is the first instrument to spell out the procedure. It does not create a new right, but it removes the room for improvisation.
The request journey, step by step
- Receive – offer at least in-person and postal channels; electronic channels can be added.
- Verify – confirm the identity of the requester, or of the authorised representative acting for them.
- Respond – within 30 days, by the method the requester asked for where practicable.
- Extend if needed – by up to 30 more days, for example for large volumes, telling the requester why.
- Refuse only on listed grounds – such as protecting the rights and freedoms of others.
- Record – keep evidence of how each request was handled.
The right of access has existed since 2019. What changed in September is that the clock now starts ticking the day a request arrives.
Fees, where permitted, must be reasonable, must not exceed actual cost and must stay within the schedule attached to the notification. They must also be disclosed before a request is made.
AI under the PDPA: the regulator’s view
In October 2026, the PDPC published its Guidelines on Personal Data Protection in the Development and Use of Artificial Intelligence. They cover the whole lifecycle of an AI system, from design and data preparation through training, deployment and decommissioning, and apply to analytic, generative and agentic AI alike.
- Prompts, interaction logs, embeddings and AI outputs can all be personal data if they can identify someone, directly or in combination with other data.
- A model trained on personal data is not presumed to be anonymised; the organisation has to demonstrate it.
- Whether a business is a controller or a processor depends on who actually decides the purposes and means of processing, not on what the contract calls it.
The guidelines are not legally binding. But they are the PDPC’s own interpretation of the Act, and businesses that deploy chatbots, analytics or AI-assisted HR tools should expect them to frame any future investigation.
What to do now
- Update your privacy notice and request forms to show the available channels, fees and response times.
- Name an owner for access requests and set internal deadlines well inside the 30-day limit.
- Inventory AI tools in use, identify where personal data enters prompts or training sets, and confirm who is controller for each.
Speak with our legal team
SBC helps businesses operating in Thailand review privacy notices, data subject request procedures and the use of AI tools under the PDPA. To discuss how these changes affect your business, get in touch.
Discuss this topicLegal references
- Notification of the Personal Data Protection Committee on access to and copies of personal data B.E. 2569 – Royal Gazette Vol. 143, Special Part 175 Ngor, 16 July 2026
- Personal Data Protection Act B.E. 2562 (2019), section 30
- Office of the PDPC – Guidelines on Personal Data Protection in the Development and Use of Artificial Intelligence (October 2026)
Legal information in this article is general and is not legal advice. It reflects publicly reported developments as at October 2026; please confirm the position against the official Thai texts and seek advice on your specific circumstances.
Digital Law practiceBangkok-based legal counsel providing Thailand-focused advice for local and international clients.
Learn about SBC Law OfficeThe information on this website is general in nature and is not legal advice. It may not reflect the latest legal developments and should not be relied on for any specific situation. Using this website does not create a lawyer–client relationship. For advice on your own circumstances, please send us an enquiry at info@sbcinterlaw.com. Read the full disclaimer.