What Does HR Need to Know About PDPA? A Complete Checklist

HR needs to know what data must be collected, the applicable legal basis, who can access it, how long it should be retained, and what to do when employees exercise their rights or a data breach occurs. HR handles personal data almost every day, from resumes and national ID numbers to bank accounts, salaries, and performance reviews.

 

How Does PDPA Apply to HR?

Personal Data Protection Act B.E. 2562 (2019) or PDPA sets out principles for collecting, using, disclosing, and protecting personal data. As a data controller, an organization must clearly specify its purposes and legal bases, notify data subjects, and implement appropriate security measures.

 

In practice, HR often manages data from the point of collection. Before starting any new process, HR should ask these six questions:

1. Whose data is being collected, and what data is collected?

2. Is the data genuinely necessary for the intended work purpose?

3. Which legal basis applies?

4. Who will the data be shared with?

5. Who within the organization should have access?

6. How long will the data be retained, and how will it be deleted when no longer needed?

 

For an overview of the law, read more at What Is PDPA and How Should Organizations Prepare?

 

Which Types of Data Require Special Attention from HR?

Personal data is any information that can identify an individual, either directly or when combined with other information. HR data therefore extends beyond names and national ID numbers and covers several categories.

 

 

Fingerprint or facial data is not automatically sensitive personal data in every case. It qualifies as biometric data under the law when processed using technology that enables unique identification. Before implementing such a system, HR should assess the technology, purpose, and legal basis.

 

PDPA Checklist for HR Throughout the Employee Lifecycle

 

 

1. Recruitment

Start by reducing unnecessary information in application forms. Do not ask for personal data ‘just in case’ when it is unrelated to the position, and clearly distinguish between information that is “required” and information that is “optional.” HR should:

• Provide or display a Privacy Notice for applicants before or when collecting their data

• Specify how long unsuccessful applicants’ resumes will be retained

• Obtain permission before contacting references and inform the applicant

• Restrict access to application documents to people involved in recruitment

• Do not share resumes in large chat groups or use personal email accounts unless necessary

• Delete or destroy data after the defined retention period

 

2. Onboarding and Employment Contracts

Before requesting copies of any documents, HR should confirm which law, contract, or work requirement makes the data necessary. Stating the purpose on each copy and masking unnecessary information can further reduce risk.

 

3. During Employment

Employee data continues to grow throughout employment, including attendance, leave, overtime, salary, warning letters, and performance reviews. Data protection must therefore be part of everyday operations, not a one-time paperwork exercise. HR should:

• Allow managers to see only the team data necessary for their duties

• Separate access rights for salary, health, and disciplinary records

• Review user access periodically, especially when employees change positions

• Do not immediately use data for a new purpose before reviewing the legal basis and notice requirements

• Set secure procedures for delivering payslips and important documents to reduce the risk of sending them to the wrong person

• Log access to or changes made to important data for later review

 

4. When Employees Exercise Their Rights

As data subjects, employees have rights under the conditions prescribed by law, such as the rights to access, obtain copies, correct, erase or destroy, restrict processing, object, withdraw consent, and request data portability. Some rights are subject to conditions or exceptions, so HR should not promise immediate deletion of all data. Certain documents may still need to be retained to comply with the law or establish legal claims.

 

The request-handling process should define the responsible person, identity verification method, deadline, data search procedure, reasons for rejection, and proof of response. Employees should not be asked to send unredacted copies of their national ID cards through insecure channels when another identity verification method is available.

 

5. When an Employee Resigns or Leaves the Organization

An employee’s departure does not mean all data should be deleted on their last day. Instead, it is the point at which HR should review why each data item still needs to be retained. HR should immediately take these four actions:

1. Disable accounts and revoke system access on schedule

2. Recover equipment, documents, and work files containing other people’s personal data

3. Separate data that must be retained by law or for legal claims from data that is no longer necessary

4. Set deletion or destruction dates according to the data retention schedule

 

Do not apply an “indefinite retention” rule to every document. Retention schedules should distinguish between data types, legal grounds, limitation periods, and business needs.

 

What Should HR Do When Employee Data Is Breached?

Sending a payslip to the wrong person, losing a personnel file, allowing employees to view company-wide salary information, or unintentionally sending applicant files outside the organization may constitute a personal data breach. When an incident is discovered, HR should follow these steps:

1. Contain the incident and preserve evidence—for example, revoke access, recall emails, change passwords, and retain logs

2. Notify the incident response team immediately and coordinate with IT, legal, the DPO, or the person responsible under the organization’s response plan

3. Assess the scope and risk by identifying whose data was affected, what type and volume of data was involved, who received it, and the potential impact

4. Assess notification obligations. If the incident poses a risk to individuals’ rights and freedoms, notify the Personal Data Protection Committee without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk is high, promptly notify affected data subjects and provide remedial guidance

5. Document the incident and prevent recurrence by recording the facts, decisions, corrective actions, and any process or access-control improvements

 

Learn more about liabilities and penalties at What Are the Penalties and Risks of PDPA Violations?

 

Can HR Software Help Reduce PDPA Risks?

Yes, significantly. Centralizing employee data in a system with role-based permissions reduces scattered files and makes retrospective audits easier. HumanSoft provides role-based access control, change logs, 2FA, automatic backups, and data storage on Microsoft Azure, which is certified to ISO/IEC 27001.

 

Learn more at HumanSoft Security and Data Protection Standards

 

Summary: What Does HR Need to Know About PDPA?

HR must understand the entire employee data lifecycle: what is collected, why it is collected, which legal basis applies, who can access it, who it is shared with, and when it must be deleted. HR must also have processes for handling data subject rights and personal data breaches. If your organization is looking for an HR system that centralizes employee data, provides role-based access, and records changes for audit purposes, explore the HumanSoft HR System and request a trial to assess how well it fits your organization’s processes.

 

FAQ: Frequently Asked Questions About PDPA for HR

Question: Can HR retain copies of employees’ national ID cards?

Answer: Yes, when there is a valid purpose and legal basis. However, HR should collect only necessary information, mask unused details, restrict access, and delete the copies when they are no longer needed.

 

Question: If an employee does not consent to data use, can the employer still process payroll?

Answer: Yes. If processing is necessary for the employment contract or legal compliance, the employer does not need to rely on consent in every case. However, employees must be informed about how their data is used.

 

Question: Can HR send payslips by email?

Answer: Yes, if appropriate safeguards are in place, such as access restrictions, file protection, and procedures to reduce the risk of sending information to the wrong recipient. Avoid combining multiple employees’ payslips in one file.

 

Question: Can employee photos be used in company media without further action?

Answer: Do not assume that a photo may be used simply because the organization already possesses it. Review the original purpose, legal basis, and employees’ reasonable expectations. For external publicity, freely given consent that is separate from employment conditions is often more appropriate.

 

Question: Does PDPA apply to workplace CCTV?

Answer: Yes, if the footage can identify individuals. The organization should have a clear purpose, provide notice, limit camera coverage and access, and define a retention period for recordings.

 

Read More Related Articles

• Why Is PDPA Important for HR in an Organization?

• Prepare HR for PDPA with HR Software

• Rules for Collecting Employment Security Deposits from Employees Under Labor Law

• Who Owns Commissioned Work Under Copyright Law?

• Labor Protection Law: What New Business Owners Need to Know