Thailand’s Personal Data Protection Act (PDPA, พ.ร.บ. คุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562) came into full force in June 2022. For much of its early life, enforcement was cautious. That changed in 2025, when the Personal Data Protection Committee issued a wave of administrative penalties — including one case resulting in a fine exceeding THB 7 million tied to a customer data breach exploited in fraud. In March and April 2026, the PDPC held public hearings on draft guidelines specifically covering CCTV data collection, one of six priority areas regulators identified for sector-specific guidance.

For CCTV installation businesses in Thailand, this shift is practical and immediate: the camera system you commission is your customer’s data infrastructure, and whether they operate it compliantly depends increasingly on what you explain before you sign off the job.

The installer does not carry the data-controller liability — that sits with the business owner or property manager who has the cameras installed. But customers ask, and the installer who answers clearly builds a service relationship that lasts beyond commissioning day.

Is CCTV Footage Personal Data Under Thai Law?

Yes, without qualification in commercial contexts. Under PDPA, personal data is any information that can identify a natural person — directly or indirectly. CCTV footage records faces, body shapes, gait, vehicle plates, and movement patterns. Thai regulators have confirmed this position explicitly: CCTV recordings are personal data, and the businesses that collect them are data controllers subject to the Act.

The one carve-out is the household exemption — a homeowner who installs cameras to monitor their own private residence, with no business purpose and no footage shared outside the household. This covers a camera pointing at the owner’s driveway or back garden. It does not cover:

Shops, offices, and restaurants — any space where employees or customers move through
Condo common areas — corridors, lobbies, car parks managed by the juristic person
Domestic workers and regular visitors — once footage routinely captures non-household members, the exemption becomes thin

The PDPC’s 2026 draft CCTV guidelines specifically address housing estates and condominiums, treating the juristic person (นิติบุคคล) as the data controller for all common-area cameras. Condo committee installations are squarely in scope.

Who Is Responsible — the Installer or the Customer?

The data controller is the customer — the business owner, condo committee, or property manager who decides that cameras will be installed. The CCTV installer is not a data controller for the customer’s footage unless the installer also provides ongoing monitoring or NVR management services on the customer’s behalf (in which case a written data processing agreement is advisable).

This distinction is worth communicating clearly at commissioning:

You installed and configured the system — your records cover that
Compliance obligations for the footage belong to the customer as data controller
The installer’s job is to hand over a documented system and enough information to operate it correctly

Customers who understand this are reassured, not alarmed. What they want is a clean handoff: system documented, settings explained, and clarity on what they need to do next.

PDPA Obligations for a CCTV Operator

A business operating CCTV in Thailand under PDPA has five practical obligations:

1. Establish a legal basis. Most commercial CCTV runs on legitimate interest — the business has a proportionate, real reason to monitor the space (security, loss prevention, employee safety). No customer consent is required for this basis, but the business should be able to document the purpose and confirm it is proportionate to the intrusion.

2. Post a privacy notice. Individuals entering a monitored area must be informed before they are recorded. A sign visible at the entrance — naming the data controller, the purpose of recording, and a contact for data access requests — satisfies the core PDPA disclosure requirement. The PDPC draft CCTV guidelines explicitly require this for housing estates and condominiums.

3. Limit data retention. Footage should not be kept indefinitely. PDPA requires that personal data is kept only as long as necessary for its stated purpose. For security-focused commercial CCTV, the widely-adopted practice in Thailand is a 30–90 day rolling overwrite cycle. This gives enough window to review any incident that surfaces in that period while avoiding indefinite storage.

4. Control access to footage. Not all staff should have access to recordings. Limit it to named individuals with a documented reason.

5. Respond to access requests. PDPA gives individuals the right to request access to footage that contains them. A business should have a named person responsible for handling these requests and a basic process to respond within the Act’s timeframe.

What Footage Retention Should You Set at Commissioning?

This is the question customers most often ask when you are configuring the NVR. The practical answer: configure the system for a 30-day rolling overwrite as a sensible default for most commercial installations. This matches the general PDPA principle of minimum necessary retention, covers the realistic window for incident review, and keeps storage manageable without requiring the customer to manage it manually.

If the customer has a specific reason to retain longer — an insurance policy with a retention requirement, a licence condition, a sector regulation — that conversation belongs at the quoting stage, not during commissioning. Whatever you configure, note it in the service report: “NVR set to 30-day rolling retention, adjusted per customer instruction to [X days].” That one line in the job record protects both parties.

Does PDPA Apply to Home CCTV Installations?

For a single-family home where cameras monitor the owner’s own property and footage stays within the household, the PDPA household exemption generally applies. The obligations around privacy notices, formal legal basis, and retention limits do not apply in the same structured way.

In practice, the exemption is clear for interior cameras and cameras covering a driveway or garden. It becomes less clear when a camera captures a shared path, a neighbour’s gate, or a regular visitor such as a cleaner or delivery driver. For these edge cases, a brief word to the customer — “if footage regularly shows people outside your household, you may want to limit the camera angle” — is straightforward professional advice, not a legal opinion.

Documenting the Installation for Your Records

A complete CCTV commissioning record protects the installer and gives the customer a usable reference. Every job record should include:

Camera positions (labelled site sketch or photos showing field of view)
NVR model, firmware version, and IP/network configuration
Retention period configured
Storage capacity and estimated full-capacity date at the configured cycle
Access credentials handover (noted as given to named contact)
Customer sign-off confirming commissioning

Keeping this in a searchable per-customer asset record — not in a WhatsApp thread or a folder on a single laptop — means a technician going back for service a year later has the full installation picture in one place. It also means you can demonstrate, if a question arises, exactly what system was installed, when, and how it was configured.

OnSiteQ’s customer and asset records are designed for this: each customer site holds its installed equipment, photos, configuration notes, and full service history, all accessible from the field without calling the office.

FAQ

What fine does a business risk for a CCTV PDPA violation in Thailand?

Administrative penalties under PDPA can reach THB 5 million per violation. The PDPC demonstrated in 2025 that enforcement is active — one case resulted in a fine exceeding THB 7 million. Even an administrative corrective order requiring changes and a compliance report is a significant operational burden for a small business. The risk is no longer theoretical.

Do the 2026 draft CCTV guidelines create new legal obligations today?

The PDPC’s 2026 CCTV guidelines are still in draft form — not yet final regulations. However, they reflect the regulator’s current interpretation of the Act, and regulators typically assess compliance against their own published guidance. A business operating under the principles in the draft (visible privacy notices, limited retention, restricted access) is in a defensible position regardless of when the final version is issued. Final guidelines are expected before the end of 2026.

Should the installer sign a data processing agreement with the customer?

For a standard installation-only engagement — survey, install, commission, hand over — a DPA is generally not required, because the installer is not processing the customer’s footage on their behalf. If your business provides remote monitoring, NVR cloud storage, or footage management as an ongoing service, a data processing agreement becomes relevant and is worth having reviewed by a lawyer. For installations without these services, clean documentation of the handoff is the practical priority.

The CCTV installer who explains PDPA clearly at commissioning — in ten minutes, in plain terms — earns the trust of a customer who will call them for every future installation and service job. The camera system is operational; the customer knows what they are responsible for; the job is properly closed.

CCTV PDPA Compliance in Thailand: The Installer's Guide