Thailand interview recording laws: the PDPA, written or electronic consent and the Computer Crime Act

In Thailand, recording a job interview is governed mainly by the Personal Data Protection Act B.E. 2562 (2019), the PDPA. You must tell the candidate, before or at the time of collection, why you are recording, what you keep, for how long and what their rights are (section 23); consent, if you rely on it, must be requested explicitly in writing or electronically (section 19); and health, religion and other sensitive data need explicit consent (section 26). Separately, the Computer Crime Act punishes unlawfully intercepting other people's data in transmission. Tell the candidate, ask, and keep the recording briefly. This is the position as of November 2026.

This page adds Thailand to our country series alongside Singapore, Malaysia and Vietnam. It is for recruiters, agency consultants and hiring managers who interview candidates located in Thailand by video or phone, including from the US. The PDPA follows the GDPR's structure closely, but its consent formalities and its rules for foreign controllers have their own wording.

Thailand's rules at a glance

Is it legal to record a job interview in Thailand?

Yes, if you treat the recording as personal data and follow the PDPA. The law that most directly reaches a hidden or third-party recording is section 8 of the Computer Crime Act B.E. 2550, which punishes anyone who "unlawfully, by electronic means, intercepts computer data of another person that is being transmitted in a computer system," where that data is not for the public benefit or for general use (our translation), with up to three years in prison, a fine of up to 60,000 baht, or both. A recruiter who records their own interview with the candidate's agreement is not intercepting anything unlawfully; a colleague or a tool secretly capturing someone else's call is the risk.

Everything else runs through the PDPA. A voice recording or transcript identifies the candidate, so collecting, using and disclosing it are regulated activities, and the data controller (the employer, or the agency running the process) carries the duties below.

Should you rely on consent or another basis?

Section 19 sets consent as the default: a controller "shall not collect, use, or disclose Personal Data, unless the data subject has given consent prior to or at the time of such collection," except where the Act or another law allows it. "A request for consent shall be explicitly made in a written statement, or via electronic means, unless it cannot be done by its nature," it must state the purpose, be "clearly distinguishable from the other matters," and the controller must take "utmost" account that consent is freely given. Withdrawal must be "as easy as to giving consent." A request that does not meet these rules "shall have no binding effect."

Section 24 lists the cases where collection without consent is allowed, including where it is "in order to take steps at the request of the data subject prior to entering into a contract" and where it is "necessary for legitimate interests" of the controller, unless overridden by the person's fundamental rights. An employer can argue that a recording made to assess an applicant fits one of those. Two reasons still favor asking. First, section 26 requires explicit consent for sensitive data, which interviews capture by accident. Second, a written or electronic yes is easy to prove. A practical route: send the notice and a consent request by email or form before the call, and confirm it out loud at the start.

What must you tell the candidate?

Section 23 requires the controller, "prior to or at the time of such collection," to inform the person of the purpose (including any section 24 basis relied on), whether the data must be provided and what happens if it is not, "the Personal Data to be collected and the period for which the Personal Data will be retained," the categories of people it may be disclosed to, the controller's contact details and those of any representative or data protection officer, and the person's rights. Section 21 adds that you may use the data only for the purpose notified, unless you inform the person of a new purpose and obtain consent first. If you want to share the recording with a client, or keep it for future roles, say so up front.

What about health, religion and other sensitive data?

Section 26 prohibits collecting data "pertaining to racial, ethnic origin, political opinions, cult, religious or philosophical beliefs, sexual behavior, criminal records, health data, disability, trade union information, genetic data, biometric data" without explicit consent, apart from listed exceptions such as legal claims and certain employment-protection and social security obligations. Candidates often mention a health condition or religious practice when talking about schedules. Do not ask, do not record it in notes or scorecards, and if your recording captures it, treat the file as sensitive and keep it short-lived.

Does the PDPA reach a recruiter in the US?

It can. Section 5 applies the Act to a controller "in the Kingdom of Thailand" wherever the processing happens, and to a controller outside Thailand processing data of people in Thailand where its activities are "the offering of goods or services to the data subjects who are in the Kingdom of Thailand" or "the monitoring of the data subject's behavior" in Thailand. A staffing agency offering placement services to candidates in Thailand is closer to that test than an employer hiring for itself. A foreign controller covered by section 5 must designate in writing a representative in Thailand (section 37(5)). Your own state's law also governs your side of the call; see two-party consent states.

Can you send recordings to a US vendor?

Only on the PDPA's transfer rules. Section 28 says the destination country "shall have adequate data protection standard" under the Committee's rules, except, among other cases, "where the consent of the data subject has been obtained, provided that the data subject has been informed of the inadequate Personal Data protection standards of the destination country," or where the transfer is necessary "to take steps at the request of the data subject prior to entering into a contract." For a US-hosted recording, transcription or tracking tool, tell the candidate where the data goes, get their consent to the transfer, and keep the vendor's contract terms. Section 37(2) also requires you to prevent recipients from using or disclosing the data unlawfully.

Can candidates get the recording, and how long can you keep it?

Section 30 lets a data subject "request access to and obtain copy of the Personal Data related to him or her," and requires the controller to fulfill the request "without delay, but shall not exceed thirty days from the date of receiving such request," unless refusal is permitted by law or a court order and disclosure would harm others. Our candidate data access requests guide has a workflow. On retention, section 37(3) requires "the examination system for erasure or destruction of the Personal Data when the retention period ends, or when the Personal Data is irrelevant or beyond the purpose," or when consent is withdrawn. State your period in the notice, delete audio first, and see our retention policy template.

Can you use AI note takers or transcription?

Yes, on the same footing: notice under section 23, a basis under section 19 or 24, explicit consent for any sensitive data, a transfer route under section 28, and erasure on schedule. The administrative fines are set by the provision breached: up to one million baht for failing to give the section 23 notice or meet the section 30 deadline (section 82), up to three million baht for unlawful collection, transfers or security failures (section 83), and up to five million baht for sensitive data violations (section 84). Interview Signal, for example, captures audio on the interviewer's own computer with no bot joining the call, shows a read-aloud consent line with a one-click pause, and does not retain audio after transcription; the transcript is still personal data under the rules above.

A consent line for interviews with candidates in Thailand

ก่อนเริ่มสัมภาษณ์: ดิฉัน/ผม ขออนุญาต [บันทึกเสียงการสนทนา /
ใช้โปรแกรมถอดข้อความการสนทนา] เพื่อบันทึกคำตอบของคุณได้อย่างถูกต้อง
[ไฟล์บันทึกเสียง / ข้อความที่ถอดได้] จะใช้เฉพาะสำหรับการสรรหาครั้งนี้
เปิดให้เฉพาะ [ลูกค้า / ผู้จัดการที่รับผิดชอบการจ้าง] เข้าถึง จัดเก็บโดย
[ผู้ให้บริการ ประเทศ] และจะลบภายใน [ระยะเวลา] หลังการตัดสินใจ
คุณยินยอมหรือไม่คะ/ครับ คุณสามารถปฏิเสธหรือขอให้หยุดบันทึกได้ทุกเมื่อ
และจะไม่มีผลต่อการพิจารณาใบสมัครของคุณ

(Before we start the interview: I'd like to [record our conversation /
use software to transcribe it] so I capture your answers accurately.
The [recording / transcript] is used only for this recruitment, open
only to [the client / the hiring manager], stored by [vendor, country]
and deleted within [period] after the decision. Do you agree? You can
refuse or ask me to stop recording at any time, and it will not affect
how your application is considered.)

Send the same text by email or form before the call so the consent is in writing or electronic. More wording is in the interview recording consent script.

Checklist before you record interviews in Thailand

• Section 23 notice before the call, including the retention period and any client who will see the recording.
• Consent requested explicitly in writing or electronically, separate from other terms, and confirmed on the call.
• No questions on health, religion, ethnicity, politics or criminal records; sensitive asides left out of notes.
• Informed consent to transfers to countries without adequate standards; vendor terms on file.
• Access requests answered within thirty days with a copy of the recording or transcript.
• Erasure on schedule, and on withdrawal of consent.
• Only calls you take part in are recorded; nothing covert.