Employees using ChatGPT with customer data: what AI policy does the company need?

Who This Guide Is For and What the Main Points Are

This guide is written for SMEs and companies whose employees already use AI tools to create text—for example, to help draft emails to customers, summarize contracts, or analyze sales tables—while management has never determined what can and cannot be entered.

There are three main points.

1. Using AI is not illegal in itself, but the data entered into it may cause the company to violate the PDPA or lose trade secret protection.
2. Thailand does not yet have an AI-specific law in force; most obligations therefore come from existing laws.
3. What the company can control immediately is a policy that is short, clear, and actually used.

This guide uses two labels throughout: [Law] means an obligation whose violation has legal consequences, and [Practice] means a recommendation that is good but not mandatory.

Does Thailand have AI-specific legislation yet?

[Legal] As of the review date, 13 October 2569, no AI-specific law has been found to have been published in the Royal Gazette.

The Ministry of Digital Economy and Society, together with ETDA, has prepared a draft law on artificial intelligence, which focuses on regulating high-risk uses. According to a Policy Watch report dated 1 August 2569, the draft has already passed the public consultation stage and must next go through the Office of the Council of State, the Cabinet, and the House of Representatives. The government aims to begin the legislative process within September 2569. Based on the review, no news has been found that the draft has passed any stage since then, and its content may still change; policy should therefore not be formulated by citing the wording of the draft.

In the meantime, existing laws apply, namely the PDPA, the Trade Secrets Act B.E. 2545, copyright law, and labour law.

How does ETDA address this?

[Guidelines] ETDA, through the Artificial Intelligence Governance Center (AIGC), has issued documents that can be cited, namely:

• Guideline on the Governance of Artificial Intelligence for Executives — an overview for executives who will adopt AI
• Guideline on the Governance of Generative AI for Organizations — announced on 30 October 2567, covering how Gen AI works, its advantages and limitations, risks and how to manage them, and approaches to applying it within an organization
• The AI Governance Guideline & Toolkits set of tools published through the AIGC

These documents are guidelines that ETDA publishes for organizations to adapt for their own use; they are not mandatory law, but they indicate the direction that regulators and large counterparties often use as criteria, namely using AI safely, transparently, with accountability, and assessing risk according to the level of the task. Anyone drafting a policy should open the latest version of the documents from the ETDA website to use alongside, because the details may be updated.

What Employees May Put into AI and What Is Prohibited

This is a practical guideline that turns the legal duties in the next section into something employees can use immediately. It classifies data into tiers and specifies which tools may be used for each tier.

An additional point to teach employees is that removing names alone may not be enough. If the remaining data can still point to a specific individual—for example, a job title combined with a specific event—it should still be considered personal data.

PDPA: What duties does a company have when it sends customer data to AI

[Law] When a company is a data controller, an employee sending customer data to an AI provider counts as the company's own use or disclosure of data. The main duties are as follows:

1. The purpose must match what was notified (Section 21 of the PDPA) A company must collect, use or disclose data in line with the purposes notified before or at the time of collection. If it is a new and different purpose, the company must notify and obtain consent first, unless the law permits otherwise.
2. There must be a legal basis such as consent, performance of a contract, or legitimate interests (Section 24 of the PDPA, on bases that do not require consent). The legitimate interests basis cannot be used where the fundamental rights of the data subject outweigh it.
3. The data subject must be notified (Section 23 of the PDPA) Before or at the time of collection, the company must notify the purposes, the categories of persons or agencies that may receive the data, the retention period, and the data subject's rights. A company privacy notice that has never mentioned AI providers should be updated.
4. There must be appropriate security measures (Section 37 of the PDPA), and when data is sent to a person other than the data controller, arrangements must be made to prevent that person from using or disclosing it without authority or unlawfully.
5. If the AI provider processes data on the company's instructions, there must be an agreement (Section 40 of the PDPA) The law requires a data processor to act only on the instructions of the data controller, to keep the data secure and to notify breaches, and requires the data controller to put an agreement in place between them. If a provider uses the data for its own purposes beyond those instructions, for example to train its own models, the provider may not be a pure processor, which is why the terms of each provider must be read.
6. Sending data abroad (Section 28 of the PDPA) If the provider stores or processes data outside the country, the destination must have adequate data protection standards under the criteria announced by the Personal Data Protection Committee, unless an exception applies, such as the data subject consenting after being informed that the destination's standards are not adequate, or where it is necessary to perform a contract with the data subject.

Sensitive data has stricter rules than these, and a data leak has a procedure for notifying the authorities. Read the overview at PDPA compliance checklist for businesses and for employee data at PDPA for HR work. For setting up a PDPA system across the whole organisation, see PDPA services.

How Trade Secrets Are Lost When Using AI

[Law] Section 3 of the Trade Secrets Act B.E. 2545 defines a trade secret as trade information that is not generally known, has commercial value because it is secret, and whose owner takes appropriate measures to keep it secret. If any one of these elements is missing, protection under this Act is not granted.

The last element is the risk point of AI. If a company lets employees put formulas, customer lists, costs, or source code into public tools where the provider can store it or use it to train models, with no rules or controls whatsoever, the opposing party in a case may argue that the company did not take appropriate measures. Courts consider this on a case-by-case basis, according to the type and value of the information, the size of the business, and how easy it is to access; so it cannot be answered with certainty whether a single instance of placing information ends the right. But having no policy at all makes it difficult to prove that measures exist.

[Practice] Measures that should be taken so that they can be proven include: labeling confidentiality levels, having employees sign to acknowledge the policy, limiting approved tools, keeping access records, and including confidentiality prohibitions in employment contracts and contracts with counterparties. See the basics of choosing between patenting and keeping something secret at Patenting or Keeping It as a Trade Secret. Customer data that the company is bound to under an NDA carries a separate contractual duty, and placing it into AI may be a direct disclosure to a third party.

Do AI Answers Need Human Review Before Being Sent to Clients?

[Practice guideline] Thai law does not yet impose a general requirement that a human must review the work, but in terms of liability, the company is the one sending the document to the client, no matter who drafted it. AI may give incorrect information, cite sections that do not exist, or invent facts on its own.

At least three rules should be laid down:

• Content that leaves the firm must be reviewed and signed off by a person responsible before it is sent.
• Figures, legal provisions, and product quality claims must always be checked against the original source.
• Work that decides significant matters concerning individuals — such as hiring decisions or refusing a service — must have a human as the final decision-maker.

If AI is used to create images, text, or code for publication, copyright and the tool's terms of use for its output should also be checked.

What to Check in a Contract with an AI Provider

[Practice note] (the parts concerning the PDPA under items 5 and 6 above are legal obligations) Before approving a tool, request the provider's terms and conditions and check these points:

1. Use of data for model training — Is it prohibited or can it be turned off, and what is the default?
2. Retention period — How long are prompts and outputs kept, and is there human review?
3. Location of data storage — Which country, and which sub-processors are used?
4. Security — Encryption, access controls, and notification of a data breach within the agreed timeframe.
5. Data deletion — Can data be deleted when the company requests it or when the contract ends, and can this be confirmed in writing?
6. Data processing agreement — The provider acts only on the company's instructions and supports requests to exercise data subject rights.
7. Liability and indemnification — How does the provider limit liability, and who is liable if data leaks from the provider's side?

Standard terms of public services are usually non-negotiable. If any point fails, choose an enterprise plan that can be configured, or restrict use to low-risk data classifications only. We can help draft and review at contract drafting and review services.

What Should Your Company's AI Policy Contain

[Guideline] It does not need to be long — it should be readable in 1 to 2 pages.

1. Scope — applies to employees, contractors, and all types of AI tools, including AI features in the software you already use.
2. The list of approved tools and which accounts may be used (personal accounts must not be used for company work).
3. Data tiers per the table above, with examples that employees in the company actually encounter.
4. Approval process — for new tools or use with high-tier data, who must be asked and who decides.
5. Pre-export review per the preceding section.
6. Record-keeping — keep a register of tools and projects that use AI with personal data, to support records of processing activities under the PDPA.
7. Training — train employees when they start work and review periodically, and keep evidence of attendance.
8. Incident reporting channel — employees who place data incorrectly must know whom to notify, and must be supported in reporting quickly, not hiding it.
9. Consequences of a breach — refer to the work rules; see Employment Contracts and Employee Handbooks, because disciplinary penalties require a supporting regulation.

What to Do If an Employee Has Already Entered the Data Incorrectly

1. Have the employee stop using it and report immediately, without imposing any penalty before the facts are known.
2. Record what data it was, whose data it was, when it was entered, on which tool, and which type of account was used.
3. Check the tool's terms to see whether the data is used to train models, then request deletion of the data or opt out of training through whatever channel the provider makes available.
4. Assess whether this is a personal data breach that must be notified, which is subject to a timeframe set by law; a lawyer should be consulted immediately.
5. If it involves confidential client information under an NDA, review the duty to notify the client.
6. Update the policy and retrain staff, and keep evidence of the corrective action.

Read more

• PDPA compliance checklist for businesses 2026
• PDPA for human resources (HR) in Thailand
• Registering a patent, a petty patent, or keeping it as a trade secret: how to choose
• Service: PDPA legal advisors
• Service: Employment contracts, salary structure and employee handbook
• Service: Drafting and reviewing contracts and business documents