Thailand's New PDPA Guidelines for AI: Your Old Training Data Still Lives on Retired Servers

อ่านภาษาไทย

Thailand's Regulator Just Said Your AI Data Is Personal Data

On 7 October 2026, Thailand's Personal Data Protection Committee office (PDPC / สคส.) published version 1.0 of its guidelines on personal data protection for developing and using artificial intelligence. The 80-page document was prepared with the Electronic Transactions Development Agency (ETDA) and issued under Section 16(3) of the PDPA, as reported by Thai Data and, on 13 October, Thansettakij.

The guidelines cover analytic AI, generative AI and agentic AI across the whole system life cycle: planning, data preparation, training, deployment and, importantly for us, the end of a system's use. They are advisory, not a new binding rule, but they show clearly how the regulator reads the existing PDPA.

Four Points Every IT Team Should Notice

• Prompts, logs, embeddings and outputs can be personal data. If a person can still be identified directly or indirectly, the PDPA applies, not only to the customer database you started with.
• A trained model is not automatically anonymous. The guidelines say a model trained on personal data is not anonymous by default, because data can sometimes be extracted from model weights or leak in outputs.
• Technical limits do not cancel the right to erasure. For RAG systems, records should be removable from the vector database, and data should be removed from caches and fine-tuning datasets. Where data is baked into model weights and "machine unlearning" is not possible, the guidelines suggest interim measures such as output filtering.
• Deleting from a knowledge base is not the same as deleting from the model. Thansettakij highlights that hiding a record from retrieval does not mean it is gone from the model itself.

What This Means for Your Company

Most Thai companies experimenting with AI now have data in places their old retention policy never imagined: GPU workstations used for fine-tuning, on-prem servers running vector databases, NAS boxes holding exported chat logs and training sets, and developer laptops with local copies of "sample" customer data. When the pilot ends or the hardware is upgraded, all of that is still personal data on a disk.

• Retiring an AI system is a PDPA event. The guidelines explicitly run through to the end of a system's life. When you decommission a model server, the drives holding training sets, embeddings, prompt logs and model checkpoints need a documented end.
• "We deleted the folder" is not evidence. If you cannot fully unlearn data from a model, you can at least make sure the physical copies of datasets, checkpoints and logs are destroyed when the hardware leaves your control.
• Old GPU boxes get resold. High-value AI hardware is tempting to sell on. Sell the GPU if you like; the SSDs and NVMe drives that held your datasets should be destroyed, not handed over.

A Simple AI Hardware Exit Checklist

1. List every machine that ever stored AI training data, embeddings, prompt logs or model checkpoints, including test rigs and staff laptops.
2. Record which datasets and models each one held, so you can match it against your ROPA and any erasure requests under the PDPA data destruction requirements.
3. When a model server or vector-database host is retired, book server data destruction with serial numbers logged.
4. Pull loose SSDs, NVMe cards and backup disks for hard drive and SSD destruction, and fold a wider refresh into one IT asset disposal project with certificates filed against your PDPA records.

For server jobs we collect from your Bangkok office, log serial numbers on collection, keep a full chain of custody through physical destruction, and issue a Certificate of Data Destruction for each unit (serial number, method and date) plus an inventory report. Photo and video evidence is available. We handle devices only; we do not shred paper.

Get an instant quote or call 082-797-3702 to destroy the servers and drives that still hold your old training data, prompt logs and model checkpoints, so your AI pilot does not outlive its PDPA basis.

Sources: Thai Data, "PDPC issues PDPA guidelines for AI development and use, version 1.0" (8 Oct 2026); Thansettakij, "AI–PDPA guide: 5 things organisations must know before using data" (13 Oct 2026); PDPC, guidelines on personal data protection for developing and using AI, version 1.0 (7 Oct 2026).