Thailand Issues AI Privacy Guidelines for Training Data, Prompts and Deletion

Thailand has issued new privacy guidelines explaining how companies must handle personal data when developing, training and deploying artificial intelligence systems.

The Personal Data Protection Committee said the guidance applies existing obligations under Thailand’s Personal Data Protection Act, or PDPA, to the full AI lifecycle. That includes model training, deployment, prompts, outputs, third-party AI services and requests from individuals seeking access to or deletion of their information.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

Thailand Uses Existing Privacy Law to Govern AI

The guidelines are non-binding, but they clarify how Thailand’s existing privacy rules should be applied when organisations use AI.

Thailand does not currently have a dedicated binding AI law covering personal-data use. Instead, organisations developing or deploying AI are expected to follow the PDPA’s existing principles, including lawful processing, purpose limitation, transparency, data minimisation, security and accountability.

This approach allows regulators to address AI-related privacy risks without waiting for an entirely new legislative framework.

Thailand’s privacy regulator had already signalled in July that businesses should use the PDPA as the foundation for AI governance rather than delay compliance until specific AI legislation arrives.

AI Training Data Comes Under Scrutiny

One of the most important questions addressed by the guidelines is whether personal information can be used to train AI models.

Companies must identify a lawful basis before processing personal data for AI development. Depending on the circumstances, that could include consent, contractual necessity, legal obligations or legitimate interests permitted under the PDPA.

Organisations are also expected to collect only the data they actually need.

That becomes particularly important in AI development because training datasets can contain huge quantities of information gathered from customers, employees, public sources or external databases.

A company cannot assume that information collected for one purpose can automatically be reused to train an AI system without considering whether that new use complies with privacy law.

Prompts and AI Outputs Can Also Contain Personal Data

The guidance extends beyond the original training dataset.

Personal information can enter an AI system when employees or customers type data into prompts. It can also appear in the answers, summaries or recommendations generated by the system.

That means companies using tools such as AI chatbots, automated customer-service systems or workplace assistants need to consider what information users are entering and how the AI provider stores or processes it.

This is particularly important where prompts contain financial information, health records, identity details, employee data or other sensitive information.

The guidelines also address situations where companies rely on outside AI providers rather than developing their own models.

Businesses may therefore need to establish clearly whether they or their AI vendor are acting as the data controller or processor and what each side is responsible for protecting.

High-Risk AI May Require Privacy Impact Assessments

Thailand is also encouraging organisations to assess privacy risks before deploying AI systems that process large amounts of personal or sensitive data.

Data Protection Impact Assessments can help companies identify how data is collected, what could go wrong and whether additional safeguards are needed before an AI system is launched.

This becomes more important where AI is used to make or influence decisions that could significantly affect people.

Examples could include systems used in recruitment, financial services, healthcare, insurance or large-scale customer profiling.

Thailand’s PDPA does not currently create a separate risk-classification system specifically for AI. But regulators increasingly expect companies to apply a risk-based approach when AI processing could seriously affect individuals.

Deleting Data From AI Models Creates a New Problem

The guidelines also confront one of the hardest privacy questions created by generative AI.

Traditional databases allow organisations to locate a person’s record and delete it relatively easily. AI models are different because information used during training can become embedded in the model’s internal parameters.

That makes it difficult to determine whether an individual’s information has truly been removed after a deletion request.

Thailand’s guidance specifically addresses the difficulty of fulfilling data-subject rights when personal information has already been incorporated into trained models.

Companies may therefore need technical and organisational measures that go beyond simply deleting the original training file.

The issue is likely to become increasingly important as privacy regulators worldwide examine whether existing rights to correction and erasure can be meaningfully enforced against generative AI systems.

Thailand Is Building a Wider AI Governance Framework

The privacy guidelines are part of a broader attempt to build AI governance while the technology is still rapidly developing.

Thailand has also been preparing national AI plans covering 2027 and 2028–2032. Those proposals include an AI Governance Sandbox, a National AI Cloud and a National AI Data Bank.

The government’s approach so far has been to encourage AI adoption while gradually introducing safeguards around privacy, security and responsible development.

That balance matters because stricter privacy controls can protect individuals but can also affect how easily companies obtain the large datasets needed to train advanced AI systems.

What This Means for You

For businesses using AI in Thailand, simply purchasing an AI service does not remove responsibility for personal data.

Companies may need to know where their training data came from, why they are legally allowed to use it, what employees put into AI prompts, how third-party providers process that information and what happens if an individual asks for their data to be corrected or deleted.

For users, the guidelines strengthen the principle that personal information does not lose privacy protection simply because it enters an AI system.

The broader message is becoming clearer across global AI regulation: companies cannot treat AI models as a legal black box. If personal information goes in, existing privacy obligations continue to follow it.