The core answer
A company should not set one retention number for everything, because every document is governed by three clocks that run at different speeds. The first is the statutory minimum, for example at least five years for accounting records and tax invoices, and at least two years for wage documents and the employee register. The second is the limitation period for claims, which makes you want evidence for longer than the minimum, for example a contract that can be sued on within ten years. The third is the PDPA duty not to keep personal data without a reason and to have a system for deleting it when the period ends.
The practical method is a schedule by document type, stating the legal basis or business reason, the retention period and the owner, plus one mechanism the schedule must never lack: a litigation hold that stops deletion when a dispute is foreseeable. A schedule that deletes automatically on time can destroy your own evidence on the day you need it most.
The tables in this guide are an example that each company must adjust. Figures that come from a statute cite the section; figures that are our practical suggestion are labelled as suggestions.
1. Why one document has three clocks
Take one invoice for goods. For accounting and tax, the company must keep it under the Accounting Act and the Revenue Code. In a dispute, the invoice proves the claim or the payment, and stays useful until the claim is time-barred. Under the PDPA, if it contains an individual's name and address, the company needs a reason to keep it and must delete it when that reason ends.
| Clock | The question | Effect on the schedule |
|---|---|---|
| 1. Statutory minimum | How many years must we keep it, counted from when? | The floor. Nothing may be deleted earlier. |
| 2. Limitation period | How long can claims about this document still be brought? | Pushes retention above the minimum when the document is key evidence. |
| 3. PDPA | Do we still need the personal data in it? | The ceiling. Every period of retention needs a reason. |
The rule is therefore "longer than the statutory minimum only as far as limitation and real need justify, then delete with a record", not "keep everything forever" and not "delete the day the minimum ends".
2. Clock 1: how long the law says you must keep it
Accounting records. Section 14 of the Accounting Act B.E. 2543 requires books and supporting documents to be kept for at least five years from the date the accounts are closed, or until they are handed over under section 17. The Director-General may, with the Minister's approval, require longer retention for certain types of business, but not beyond seven years.
Tax records. Section 87/3 of the Revenue Code requires registered operators who must file returns and pay VAT to keep tax reports, tax invoices, copies and supporting documents at the place of business or another place the Director-General designates, for at least five years from the filing date or the date the report was prepared. The Director-General may require retention beyond five years but not beyond seven, and on ceasing business the documents held on that date must be kept for a further two years.
Payroll records and the employee register. Section 114 of the Labour Protection Act B.E. 2541 requires an employer with ten or more employees to keep documents on payment of wages, overtime, holiday work and holiday overtime (at minimum working days and hours, output for piece-rate workers, and the rate and amount each employee received). If wages are paid by bank transfer, the transfer record counts as the payment document. Section 115 provides that
- the employee register must be kept for at least two years from the end of each employee's employment;
- the payment documents must be kept for at least two years from the date of payment;
- if a petition under Chapter 12 is filed, a labour dispute arises under labour relations law, or a labour case is brought, both must be kept until a final order or judgment.
The last paragraph of section 115 is a litigation hold written into labour law for these records, and a good model for other documents.
No general statute sets a single period for ordinary contracts, email, chat, CCTV and the rest of the personnel file, so their periods come from clocks 2 and 3. For the share register and minutes, section 1138 of the Civil and Commercial Code requires a share register and section 1207 requires minutes of meetings, kept at the registered office; neither fixes a period, so we suggest, as practice, keeping them for the life of the company.
3. Clock 2: limitation periods say how long you can be pursued
A limitation period is the time within which a claim must be brought in court. After it, the other side can raise it as a defence, and your documents stop being useful in court for that claim. Before it, the documents are what you win or lose with.
- General ten-year period. Section 193/30 of the Civil and Commercial Code provides that where the Code or another law does not specify a period, the limitation period is ten years. Contracts and agreements with no special rule should be planned on ten years.
- Two-year period for certain claims. Section 193/34 sets two years for listed claims, such as a trader's claim for the price of goods delivered or work done, a claim for the hire of movable property, and an employee's claim for wages. The list is detailed, so do not conclude on your own whether a given matter falls under two years or ten.
- When time starts. The period does not run from the date the document was made. It depends on when the claim could first be enforced, and can be interrupted or suspended in some cases. That is why retention should be counted from the end of the event, such as the end of the contract or final payment, not from signing.
Hypothetical example: Company A signs a three-year manufacturing contract that ends in 2026. If it keeps the contract, specifications and delivery records until 2036 (end of contract plus ten years), it covers the general period under section 193/30. If it keeps them only five years, matching its accounting records, it may not have the signed contract when sued in year six.
4. Clock 3: the PDPA sets the ceiling
The PDPA does not say how many years each category of data may be kept, but it imposes three duties.
- Tell people the retention period (section 23). The controller must tell the data subject, before or at collection, which data is collected and for how long. If the period cannot be fixed, it must state the period reasonably expected under collection standards. The company's privacy notice should therefore match this schedule.
- A system to delete at expiry (section 37(3)). The controller must have an audit system to erase or destroy personal data when the retention period has ended. Section 37(1) also requires appropriate security measures.
- Right to erasure (section 33). A data subject may ask for deletion, destruction or anonymisation in certain cases, for example where the data is no longer needed for its original purpose, or consent is withdrawn and there is no other basis. The right does not apply to the extent retention is necessary for freedom of expression, certain archival, research, statistical, public-interest or public-health purposes, establishing, complying with, exercising or defending legal claims, or complying with law.
Practical conclusion: the reason for keeping a document must be writable, for example "required by section 87/3" or "kept to defend claims until ten years after the contract ends". If you cannot write the reason, the personal data in that document is the first candidate for deletion. For employee data see PDPA for HR in Thailand.
5. A sample retention schedule by document type
This table is an example starting point. Each company must adjust it for its industry, size, contracts and the notices that apply to it. The "basis" column shows which periods come from a statute and which are our suggestions.
| Document | Basis | Suggested period | Owner |
|---|---|---|---|
| Contracts and amendments (including quotations, purchase orders and delivery records that evidence performance) | General ten-year limitation period (CCC 193/30); the period itself is our suggestion | Ten years from end of the contract or final payment, not from signing | Legal (if none, the owner or an office manager) |
| Invoices, receipts, tax invoices, books and supporting documents | Accounting Act s.14 and Revenue Code s.87/3: five years, extendable to seven | At least five years by law; we suggest seven as a safe default, and longer where a related contract is still within limitation | Accounting |
| Payroll, overtime, time records, transfer slips | Labour Protection Act ss.114-115 (two years from payment), overlapping with accounting and tax records | At least five years (accounting and tax); never below two years under labour law; until final judgment if a dispute exists | HR with accounting |
| Employee register | Labour Protection Act s.115 (two years from end of each employment) | At least two years after the employee leaves; we suggest keeping a short core record (name, position, dates, reason for leaving) longer, matched to possible claims | HR |
| Personnel files, warnings, disciplinary and investigation records | No statutory period; purpose is defending dismissal disputes; PDPA | We suggest two to five years after departure (treat dismissals for serious misconduct or disputed cases as under litigation hold until resolved), then review | HR |
| Recruitment files of unsuccessful candidates | PDPA (necessity and notice of period); no fixed period | We suggest six to twelve months after the post is filled; for a talent pool, obtain consent and state the period | HR |
| Company email | No general period; depends on content | Keep by content type: email that is a contract or accounting record is filed with that record; for general mailboxes we suggest a set age limit (for example three to five years), except items under litigation hold | IT sets the tooling; content owners set periods |
| LINE and other work chat | No general period; evidence of instructions and deals | Messages that agree terms, order extra work or confirm delivery are exported to the contract or project file; routine chat is deleted per policy | Project managers and IT |
| CCTV footage | PDPA (necessity for security purposes); no fixed period | We suggest 30 to 90 days, with incident clips copied to an incident file | IT / security |
| Share register, minutes, board resolutions, registration documents | Sections 1138 and 1207 of the Civil and Commercial Code (share register required; minute book kept at the registered office) fix no period; treat as permanent corporate records as a matter of practice | Life of the company, and afterwards as the liquidator or adviser directs | Company secretary / legal |
Note: if a notice of the Director-General requires your type of business to keep records longer than five years, use the period in that notice. Before changing the figures, check the current notices with your bookkeeper or accounting firm.
6. Emails and chats as evidence
Email and LINE are often the key evidence of agreements never put into a formal contract, such as extra work ordered, prices confirmed or work accepted. But the usual question in court is whether the record is genuine and complete, so keeping it properly matters as much as keeping it long.
- Export the whole conversation with its metadata. Use the app's export function (dates, times, account names). For email, keep the original file with its headers. Screenshots are a supplement; a lone screenshot is easy to alter and often lacks context.
- Keep the originals. Do not delete messages from the original device or account after exporting, and do not change phones without a backup.
- Log the export. Who exported, when, from which device, stored where. A one-page form is enough.
- Do not leave key matters in employees' personal accounts. When the employee leaves, the account and the evidence go with them. Use company accounts (a LINE Official Account, email on the company domain) and a usage policy.
- Respect others' privacy. A group chat export contains other people's data. Use only what is needed and share it only with those who need it.
For using LINE to order work and prove extra work, see Extra work ordered on LINE, customer refuses to pay.
7. Litigation hold: stop deletion when a dispute is foreseeable
A litigation hold is an internal instruction that stops deletion of documents and data connected with a dispute that has arisen or can be foreseen. The name comes from foreign practice. In Thailand, the third paragraph of section 115 of the Labour Protection Act writes the same principle for payroll documents and the employee register. For other documents no general section requires it directly, but deleting evidence once a case is foreseeable can weaken your position in proving your case and, depending on the facts, may carry other liability.
When to issue a hold
- A demand letter or notice of termination arrives, or a threat to sue.
- An employee files a petition with a labour inspector, or a dismissal is likely to be challenged.
- Fraud, a serious accident or a data breach occurs.
- A summons, an official letter or a data access request relating to the matter arrives.
What a hold should contain
- The matter, the period covered and the people or departments involved.
- The data types to preserve: email, chat, shared files, CCTV, backups, employees' devices.
- An instruction to switch off auto-delete and to not wipe devices or accounts when involved employees leave.
- The responsible person (normally legal or the owner), the date issued and who was told.
- How it ends, which is when the matter concludes, with the release date recorded.
When the matter is finally resolved, the normal schedule applies again. A hold does not allow personal data to be kept forever; it needs an end date and a reason, under the PDPA principles.
8. Who owns the schedule (RACI)
Retention schedules usually fail because each department thinks another owns them. Allocate clearly.
| Task | Legal | Accounting | HR | IT |
|---|---|---|---|---|
| Draft and approve the schedule | A | C | C | C |
| Periods for accounting and tax records | C | R | I | I |
| Periods for employee and payroll records | C | C | R | I |
| Configure deletion, backups and CCTV | I | I | I | R |
| Issue a litigation hold | A/R | I | R (HR records) | R (does it in the systems) |
| Annual review of the schedule | A | R | R | R |
| Destruction log | C | R (accounting) | R (HR) | R (digital) |
R is who does the work, A is finally accountable, C is consulted, I is informed. A small company with no legal department can make the owner or a director "A" and use an adviser as "C".
9. Secure destruction and the destruction log
Section 37(3) calls for an audit "system", not occasional clean-outs. A system you can show has these parts.
- Scheduled review. At least yearly, pull the items that have reached their date and screen out anything under a litigation hold.
- Approval before destruction. The document owner checks and signs.
- Destruction that cannot be reversed. Shred paper or use a destruction service that gives a certificate. For digital data delete copies, backups, recycle bins and cloud storage, handled by IT.
- A destruction log. Record the document type and date range, approximate quantity, date, method, approver, who did it and the schedule reason. You do not need to keep the content destroyed.
- Keep the log itself. It shows that deletion followed a routine system and was not done to hide evidence.
10. Common mistakes
- One number for the whole company, such as "keep everything five years". Contracts that should last ten years get deleted and unneeded documents linger.
- Counting from the date of the document instead of the end of the event.
- Auto-delete with no hold switch. The system wipes email or chat every six months even while a dispute is running.
- Letting employees keep key evidence on personal devices. It disappears or becomes inaccessible when they leave.
- Keeping everything forever "just in case". This conflicts with the PDPA and enlarges what is exposed in a cyberattack.
- A screenshot as the only evidence, with no export and no original.
- Forgetting backups. The main system is cleared while copies in backups or the cloud remain, so the schedule does not match reality.
- No owner. The schedule is written once and never reviewed, and drifts from systems and rules.
- Destroying accounting records early when changing bookkeepers or moving offices. See also Changing accountants after missed filings.
11. Checklist to start a schedule within fourteen days
- List the document types the company holds (at least those in section 5) and where each lives (cabinet, server, email, LINE, cloud, personal devices).
- Have accounting confirm the period for accounting and tax records that applies to the business, including any notice extending it.
- Have HR confirm that payroll documents and the employee register are kept as sections 114 and 115 require, and how they overlap with accounting records.
- Have legal or an adviser set the contract periods and identify matters needing the ten-year period.
- Have IT check auto-delete on email, chat, CCTV and backups, and add a hold switch.
- Name the schedule owner (per the RACI) and the annual review date.
- Prepare a one-page litigation hold template and decide who may issue it.
- Prepare a destruction log form and the review cycle.
- Align the privacy notice with the periods in the schedule (section 23).
- Adopt a policy against keeping key work in personal accounts, and a method for exporting chats.
Further reading
- PDPA for HR in Thailand — employee data, CCTV and applicants under the PDPA
- PDPA Compliance Checklist for Thai Businesses — overview of controller duties
- Extra Work Ordered on LINE, Customer Refuses to Pay — chat as evidence of variations
- Changing Accountants After Missed Filings — accounting records and the company's duties when the bookkeeper changes
- Contract Review Before Signing With No Legal Department — who should keep and check contracts
Every document runs on three clocks, the statutory minimum, limitation and the PDPA: keep it longer than the minimum only as far as needed, delete with a record, and suspend deletion the moment a dispute is foreseeable.
We help draft retention schedules that fit your business, align contracts and privacy notices with them, prepare litigation hold and destruction log templates, and gather evidence when a dispute arises. For an initial consultation, call +66 92 254 2045 or send us the details. See also accounting and tax services and PDPA compliance.
This guide is published by Suwanvara Law Firm — a Khon Kaen law firm established in 1986. General information only, not legal advice on a specific matter.
