Thailand’s PDPA already governs AI work — waiting for a new AI law is not a strategy

Much of the public conversation about AI in Thailand still waits for a future statute. That wait is a dangerous operating model: the PDPA already governs personal data used in embeddings, automated decisions, profiling, monitoring, and agent workflows. The practical question is not “when will AI law arrive?” — it is whether identity, purpose, access, retention, and evidence are built into everyday systems. ### What the PDPA means for AI teams Map every data flow, document the purpose and lawful basis, minimize collection, define retention, and make human review and user rights operational. Keep audit evidence for prompts, retrieval, actions, and approvals. Separate people from agents: a service account should be scoped, attributable, and revocable rather than a borrowed human session. ### A practical identity layer Outborn Account can provide the organisation identity and membership context behind connected systems. AppKit can enforce the organisation check; Governance can record purpose, approval, and evidence; Agent Connect can govern external signals and agent actions. Build these controls now, and join the Outborn Account waitlist for the organisation identity layer behind the ecosystem.

An AI feature that handles identifiable employee or customer data must be analyzed through the normal personal-data lifecycle: purpose, legal basis, notice, access, retention, processors and safeguards. Calling a feature 'AI-powered' does not replace those obligations.

Map the data path of a recruiting assistant that summarizes candidate files using an external model provider. Identify data controller and processor roles, retention windows, international transfers and how data-subject requests are handled.

Conceptual illustration for research and implementation planning.

Preserve a processing inventory, data-flow diagram, processor terms, permissions and evidence of deletion or correction. Regulatory interpretation needs Thai legal review.

Primary source: Official documentation. The scenario is illustrative, not a record of a completed deployment test.