The short answer
You can use an AI agent and stay within Thailand’s PDPA (the Personal Data Protection Act B.E. 2562) if you treat the agent like any other system that handles personal data: tell people how their data is used, have a lawful basis, collect only what you need, keep it secure and respect people’s rights. The same principles apply under the GDPR if you serve people in the EU. This is general information, not legal advice.
Key takeaways
- An AI agent that collects names, numbers or messages is processing personal data.
- Your business is usually the data controller and stays responsible for compliance.
- Collect the minimum, explain it clearly, keep it secure and set a retention period.
- This is general information only; get legal advice for your own situation.
Does the PDPA apply to AI agents?
Yes. The PDPA applies to any processing of personal data, and an AI agent that talks to customers almost always handles personal data: names, phone numbers, LINE or WhatsApp profiles, email addresses and whatever people write in their messages.
Thailand’s Personal Data Protection Act B.E. 2562 (2019) came fully into force in June 2022 and is overseen by the Personal Data Protection Committee. It uses two roles that matter here:
- Data controller: the business that decides why and how personal data is used. If the agent answers your customers, that is usually you.
- Data processor: anyone handling the data on your behalf, such as the company that builds and hosts the agent, the AI model provider and the messaging platforms involved.
The practical point is that adding an AI agent does not move responsibility away from your business. It adds new systems that your existing data protection approach needs to cover.
Please note: this article is general information to help you ask the right questions. It is not legal advice, and you should speak to a qualified lawyer about your own business.
What do the PDPA and GDPR require, in plain English?
The PDPA was modelled closely on the EU’s GDPR, and both rest on the same core principles. Here is what each one means for an AI agent:
| Principle | What it means for an AI agent |
|---|---|
| Lawfulness, fairness and transparency | People should know they are talking to an AI assistant, what data it collects and why, with a link to your privacy notice. |
| Purpose limitation | Data collected to book an appointment should not be reused for unrelated purposes, such as marketing, without a proper basis. |
| Data minimisation | The agent asks only for what it needs to do the job, such as a name and phone number for a booking. |
| Accuracy | Customers can correct their details, and the agent records what they say rather than guessing. |
| Storage limitation | Chat logs and records are deleted or anonymised after a set period, not kept forever. |
| Security | Conversations are stored securely, access is limited to people who need it and systems are kept up to date. |
| Accountability | You can show what you collect, why, where it goes and who can see it. |
The GDPR can apply to a business outside the EU if it offers goods or services to people in the EU, and the PDPA has a similar reach for businesses outside Thailand serving people in Thailand. If you have international customers, assume both are relevant until a lawyer tells you otherwise.
What lawful basis covers an AI agent conversation?
Most routine AI agent conversations are covered by the fact that the customer asked you for something, such as information or a booking, and you need their details to provide it. Both laws recognise processing that is necessary to take steps a person has requested before entering a contract, or to perform one.
Other activities usually need a different basis:
- Marketing messages, such as promotions sent later, generally need consent or another clearly applicable basis, and an easy way to opt out.
- Legitimate interests can cover some uses, such as keeping records of enquiries to improve your service, but must be balanced against the customer’s rights.
- Sensitive personal data, which under the PDPA includes health information, biometric data, religious beliefs and several other categories, generally needs explicit consent or another specific legal ground. This matters most for clinics and anyone in healthcare, which is why we design clinic agents not to collect medical details in chat; see AI receptionist for clinics.
Which basis applies to which activity is exactly the kind of question to confirm with your legal adviser.
How do you make an AI agent PDPA-friendly? A practical checklist
An AI agent is easiest to keep compliant when privacy is designed in from the start, rather than added after launch. These are the steps we work through with clients:
- Say it is an AI. The agent introduces itself as an AI assistant and offers a person on request.
- Link your privacy notice in the chat or the channel profile, and make sure it mentions the agent and the services behind it.
- Minimise the questions. Remove anything the agent does not strictly need.
- Keep sensitive data out of chat unless there is a clear need and a proper legal basis for it.
- Separate marketing from service. Ask for marketing consent separately, never as a condition of getting an answer.
- Set a retention period for chat logs and records, and make sure deletion actually happens.
- Limit access to conversations and records to the people who need them.
- Put agreements in place with the providers who process data for you.
- Route rights requests to a person. If a customer asks to see, correct or delete their data, the agent passes the request to your team.
- Have a breach plan. Under the PDPA, certain breaches must be reported to the regulator within 72 hours of becoming aware of them, unless they are unlikely to put people’s rights at risk.
Where does conversation data go, and is it sent abroad?
Conversation data usually passes through several services, some of which may be outside Thailand. A typical AI agent involves the messaging platform (your website, LINE, WhatsApp or Instagram), the AI model provider that generates replies, the place where the agent runs, and any tools it connects to, such as your booking system or CRM.
Both the PDPA and the GDPR have rules on sending personal data to other countries. In broad terms, the destination needs adequate data protection standards, or appropriate safeguards must be in place. When choosing or reviewing an AI agent, ask:
- Which services handle the conversation, and where are they based?
- Does the AI provider use conversation data to train its models? Check the provider’s current terms for business use.
- How long does each service keep the data?
- What agreements and safeguards cover each service?
A good builder should be able to answer these clearly. If you are also reviewing your website, our guide to website security basics covers the other side of keeping customer data safe.
What does PJW Partners handle, and what stays your responsibility?
At PJW Partners, we build agents with minimal data collection, clear AI disclosure, sensible access controls and handoff rules for sensitive conversations as standard, and we explain which services each agent uses so you can document them. Those choices make compliance much easier, but they do not replace it.
As the data controller, your business remains responsible for its privacy notice, its choice of lawful bases, how it responds to customers’ rights requests and its own legal sign-off. We recommend that every business using an AI agent with customers asks a qualified lawyer to review the set-up, particularly in healthcare, finance or legal services.
You can see the kinds of agents we build on our AI agents page. If you would like an agent designed with data protection in mind from day one, tell us about your business and the data your enquiries involve.
Questions
Is this article legal advice? +
No. It is general information about the PDPA and GDPR principles. Speak to a qualified lawyer about how the law applies to your business.
Does using an AI agent make my business non-compliant? +
Not in itself. What matters is how the agent collects, uses, stores and shares personal data, and whether that is lawful, transparent and secure.
Do I need consent for every chat with an AI agent? +
Not necessarily. Answering a customer’s own request can rely on a different basis, but marketing and sensitive data usually need consent. Confirm the details with your lawyer.
Can a customer ask me to delete their chat history? +
Yes, people have rights over their personal data, including deletion in many cases. Your agent should pass these requests to a person who can act on them.
Does the GDPR apply to a business in Thailand? +
It can, if you offer goods or services to people in the EU or monitor their behaviour. If you have European customers, take advice on whether it applies to you.
Work with PJW Partners
Websites and AI agents that bring in customers.
Websites from $1,500 and AI agents from $1,000. Tell us about your business and we’ll reply within one business day.