The Pulse
Thailand Issues Nonbinding AI Data-Protection Guidance
Thailand’s Personal Data Protection Committee issued nonbinding guidance on applying the Personal Data Protection Act to AI development and use. The guidance addresses training data, prompts and outputs, vendor responsibilities, risk assess
AI.info Team · Written with AI ·
Thailand’s Personal Data Protection Committee issued nonbinding guidance on Oct. 12 explaining how the country’s existing Personal Data Protection Act applies to artificial intelligence development and use. The guidance covers the AI lifecycle, from model development and training through deployment, and addresses legal grounds for processing personal data, minimization, risk assessments, security and data-subject rights, according to MLex’s account of the announcement.
The PDPC applies the PDPA across AI development and use
The committee’s guidance does not create a separate AI statute. Instead, it interprets existing obligations under the Personal Data Protection Act, or PDPA, for organizations that develop or use systems processing personal information. Its nonbinding status distinguishes the document from enforceable law, while still giving organizations a regulator-issued account of how the existing framework applies to AI.
The guidance addresses the lawful basis for handling personal data, data minimization, risk assessment, data protection impact assessments and security safeguards. It also covers the rights of people whose information enters AI systems. That scope reaches beyond model training to the deployment stage, where systems may process information supplied by users or produce outputs about identifiable people.
Training data, prompts and vendors all come into view
AI-specific issues include using personal data to train models, handling prompts and outputs, and dividing responsibilities when organizations rely on outside AI providers. Those questions can involve several parties: a business choosing what information to submit, a provider operating the system, and a developer that may use data in building or refining a model.
The guidance also puts data minimization and risk assessment alongside legal grounds for processing. In practice, that means organizations need to consider personal data at more than the moment it enters a training dataset. Prompts, generated material and third-party processing arrangements are also within the areas the committee addresses, according to MLex.
Deletion requests pose a technical test
Requests to delete personal information can become difficult when data has already been incorporated into a trained model. The committee’s guidance examines that problem alongside broader data-subject rights, acknowledging a practical tension between legal requests and the technical work involved in locating or removing information within AI systems.
The issue matters to companies that may treat a training dataset as the main place personal data resides. The guidance’s coverage of prompts, outputs, vendors and trained models points to a wider set of records and processing stages that organizations may need to account for when responding to rights requests.
Final guidance follows a public draft
The committee had released a draft of the AI data-protection guidelines on Feb. 17 and invited public comment through Feb. 25, according to Tilleke & Gibbins. The October announcement marks the issuance of nonbinding guidance after that draft phase.
The document translates broad data-protection duties into AI-related areas organizations can examine across a system’s lifecycle. Its immediate significance is practical rather than legislative: teams handling personal data will need to account for training material, prompts, outputs, outside providers and deletion requests under the existing PDPA.