PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research

on
an artist s illustration of artificial intelligence ai this image visualises the input and output of neural networks and how ai systems perceive data it was created by rose pilkington

PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research

The use of personal data in scientific and academic research presents legal challenges, particularly where research ethics requirements intersect with obligations under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). On October 9, 2026, the National Research Council of Thailand (NRCT) and the Personal Data Protection Committee Office (PDPC Office) jointly presented guidance on personal data protection in research activities, highlighting the distinction between research ethics consent and consent under the PDPA, the identification of appropriate lawful bases for processing personal data, and measures to reduce the risk of identifying individuals from research datasets. Although the initiative does not introduce new legislation or amend existing PDPA requirements, it signals increasing regulatory attention to the handling of personal data throughout the research lifecycle.

Research Ethics Consent and Consent Under the PDPA:

One of the principal issues addressed is the distinction between consent obtained for research ethics purposes and consent required under the PDPA. Research ethics consent generally concerns a participant’s voluntary agreement to participate in a study after receiving sufficient information about its objectives, methodology, potential risks, and expected benefits. Consent under the PDPA, however, serves a different legal function and must satisfy statutory requirements where consent is relied upon as the lawful basis for processing personal data. Accordingly, obtaining informed consent through an institutional review board or research ethics committee does not automatically establish valid consent under the PDPA. Research institutions must independently assess whether the processing activities require PDPA consent or may be justified under another applicable lawful basis.

Lawful Bases for Processing Research Data:

The PDPA recognizes circumstances in which personal data may be processed for scientific, historical, or statistical research without relying exclusively on consent, subject to applicable statutory conditions and appropriate safeguards. In particular, Section 24(1) addresses certain research-related processing activities, while Section 26 establishes separate requirements for sensitive personal data, including health information, genetic data, and biometric data. These provisions should not be interpreted as providing a blanket exemption for research activities. Research institutions must assess the nature of the data, the purposes of processing, the applicable statutory conditions, and the safeguards necessary to protect data subjects. This assessment becomes particularly important in medical research, clinical trials, pharmaceutical development, and projects involving large-scale datasets or secondary uses of information originally collected for other purposes.

Anonymization, Pseudonymization and Research Publication:

Another important consideration is the risk of identifying individuals through research data, particularly when datasets are shared, combined, or published. Effective anonymization may place information outside the scope of the PDPA where individuals can no longer be identified, directly or indirectly, taking account of reasonably available means of identification. Pseudonymization, by contrast, generally reduces identification risks but does not necessarily remove information from the scope of personal data protection requirements. Research organizations should therefore adopt appropriate technical and organizational measures, including data minimization, access restrictions, separation of identifying information, and assessments of re-identification risks before disclosing research findings or making datasets available to third parties. Similar considerations arise when research data is used to train, test, or develop artificial intelligence systems.

Future Research Funding Requirements and Compliance Expectations:

The NRCT has also outlined plans to strengthen personal data protection requirements within its research funding framework. Preparatory measures are expected during fiscal year 2027, with a proposed requirement for principal investigators to complete personal data protection training as a condition for research funding applications beginning in fiscal year 2028. The NRCT has additionally indicated an intention to encourage the use of artificial intelligence tools to review research information before publication. These initiatives suggest that data protection compliance may increasingly become part of research governance and funding eligibility, rather than remaining solely a matter of institutional policy. However, the proposed training requirement should not yet be treated as an existing legal obligation or a finalized funding condition.

Implications for Research Institutions and Businesses:

Universities, hospitals, research institutes, pharmaceutical companies, and businesses engaged in research and development should review their existing procedures for collecting, using, sharing, retaining, and publishing personal data. Particular attention should be given to the relationship between research participation documents and PDPA privacy notices, the identification and documentation of lawful bases, the processing of sensitive personal data, and arrangements governing data sharing with research collaborators and technology providers. Where personal data is subsequently used for AI development or other secondary research purposes, organizations should assess whether the proposed processing is compatible with the original purposes and whether additional legal conditions or safeguards apply.

The guidance presented by the NRCT and the PDPC Office represents a practical compliance development rather than a change to the statutory framework. As the publicly reported initiative does not yet constitute a complete, formally issued regulatory guidance document, its contents should be distinguished from binding requirements under the PDPA and applicable subordinate legislation.

Key Takeaways:

  • Research ethics consent is not equivalent to PDPA consent: Research organizations must separately establish an appropriate lawful basis for processing personal data.
  • Research activities are not automatically exempt from the PDPA: Applicable statutory conditions and safeguards must be assessed, particularly when sensitive personal data is involved.
  • Anonymization and pseudonymization have different legal consequences: Organizations should evaluate re-identification risks before sharing or publishing research datasets.
  • Research funding requirements may become more closely linked to data protection compliance: The NRCT’s proposed training requirements warrant monitoring but should not be treated as finalized obligations.
  • Secondary research and AI development require careful legal assessment: Reusing research data for new purposes may raise additional questions concerning lawful bases, transparency, data minimization, and data subject rights.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

Posted in

Tagged as