Short Answer
Only if the legal role, purpose and contract support that use.
A provider may receive client data to perform a service. That does not automatically give the provider the right to reuse the data for cross-client benchmarking, product development, model training, marketing or another independent commercial purpose.
Where personal data is involved, Thailand’s Personal Data Protection Act distinguishes a data controller, which decides why and how personal data is processed, from a data processor, which processes data on the controller’s instructions.
A provider that uses personal data for a separate purpose of its own may take on a different legal role for that additional processing.
Why This Matters
Data-use clauses are often drafted broadly.
A contract may say that the provider can use client information:
“to improve services, develop insights and create anonymised benchmarks.”
That sentence can hide several different uses.
The client should understand whether the provider is using the information only to provide the contracted service or is also building a wider commercial asset from the data.
This is increasingly important where outsourced providers use analytics platforms, cloud systems or artificial-intelligence tools.
Typical Scenario
A company hires an analytics, software or consulting provider.
The provider needs access to operational, customer or transaction data and also asks for the right to use that information for benchmarking and product improvement.
Management asks:
“If they say the data will be anonymised, is that enough?”
Not necessarily.
Practical Analysis
01Separate the data categories.
Personal data, confidential business information, provider-generated analytics and the provider’s own software or methodology should not be treated as one category.
02Separate service delivery from the provider’s own purpose.
Using data to prepare the client’s report is different from combining it with other customers’ data to improve the provider’s commercial product.
Under section 40 of the Personal Data Protection Act, a processor should act on the controller’s instructions. If it uses personal data outside those instructions for its own purpose, the legal role for that processing must be reassessed.
03Test the claimed anonymisation.
Removing names may not be enough if individuals can still be identified from transaction history, location, device information or other combinations of data.
04Remember commercial confidentiality.
Even data with no personal information—pricing, margins, sales, occupancy, yield or forecasts—may still be highly sensitive.
“Not personal data” does not mean “free to reuse.”
05Define benchmarking rights precisely.
If benchmarking is acceptable, specify what data can be used, whether it must be aggregated, whether competitors can be identified, whether model training is allowed, how long data can be retained and whether use continues after termination.
06Check sub-processors and external platforms.
The provider may use cloud hosting, analytics tools or third-party artificial-intelligence services. The client should know whether its information is entering another provider’s broader ecosystem.
The client should also decide whether the commercial benefit justifies the reuse right. A provider may offer better benchmarking or lower fees in exchange for broader data rights. That can be a legitimate bargain, but it should be explicit. The business should know what value it receives, what information leaves the client-specific environment and whether the right can be withdrawn or limited later.
What We Usually Look At
We review data categories, controller/processor roles, processing purposes, legal basis, confidentiality, anonymisation, aggregation, benchmarking, model-training rights, sub-processors, cross-border transfers, retention and post-termination use.
Common Traps
Typical mistakes are assuming the word “processor” fixes the legal role, allowing “service improvement” without defining it, treating pseudonymised data as truly anonymous and focusing only on personal data while ignoring commercially sensitive business information.
Practical Next Step
Build a data-use purpose matrix:
data → service purpose → provider’s own purpose → legal role → anonymisation → retention → cross-client use → post-termination right
The key question is:
“What can the provider do with our data that is not necessary to provide our service?”
Legal Sources
- Personal Data Protection Act B.E. 2562 (2019), including sections 21, 24, 26, 37 and 40 on purpose, lawful processing, controller duties and processor duties.
- Personal Data Protection Committee (PDPC) Notification on Security Measures of the Data Controller B.E. 2565 (2022), published in the Royal Gazette on 20 June 2022.
- PDPC / GPPC official guidance on controller–processor arrangements, processing on documented instructions and data-processing agreements.
General legal information only. Please seek advice on your specific facts. Laws and regulatory practice may change.