快速回答
Shipping an LLM product under PDPA requires startups to run local PII scrubbing on prompts before API dispatch, upgrade to enterprise API tiers that contractually forbid model training, and explicitly disclose automated data processing in updated privacy notices.
返回博客
|12 July 2026
Shipping an AI Product Safely Under PDPA: The Practical Compliance Checklist for Thai Startups Using LLMs
Many Thai startups are unknowingly violating the PDPA by shipping AI features that send customer data overseas. Here is your battle-tested, practical compliance checklist.
i
iReadCustomer Team
作者
暂无内容
常见问题
常见问题
Why do startups using LLMs need to worry about Thailand's PDPA?
Every prompt sent to an external LLM API counts as a cross-border personal data transfer under PDPA. If these prompts contain customer emails, names, or identifiable actions, they violate Section 28 of the law unless backed by secure DPAs and proper structural privacy protections.
Can startups use LLMs without requesting explicit consent from users?
Yes, if you scrub all identifying data before the API call or establish a legitimate interest. If the data is fully sanitized beforehand, it falls out of the scope of personal data processing under the PDPA.
Consent vs Legitimate Interest: which is better for shipping AI features?
Legitimate interest is usually better for core optimization and standard product features because it avoids user friction. Consent should be reserved for processing sensitive data, high-impact automated profiling, or marketing integration.
What is the cost of achieving PDPA compliance for an early-stage startup?
Basic compliance for a single AI feature can be done in days for under 15,000 Baht using open-source tools and template agreements. This is highly cost-effective compared to administrative fines that can peak at 5,000,000 Baht.
How do you handle a user's deletion request within an AI model structure?
Never use raw user data for fine-tuning. Instead, use Retrieval-Augmented Generation (RAG) so that you can delete the user's data from your active database or vector storage instantly when requested without having to re-train the entire model.
