AI Meeting Notetakers & PDPA: 4 Legal Risks Every Thai SME Must Know Before Your Next Online Meeting

Hello, fellow business owners. In an era where online meetings via Zoom or Microsoft Teams have become the norm, I suspect many of you have encountered an “uninvited guest” — a bot with a curious name like Otter.ai, Fireflies, or Laxis — silently joining your meeting room with a glowing “Recording” status. As AI meeting notetakers become ubiquitous in Thai workplaces, understanding the legal exposure they create under Thailand’s Personal Data Protection Act (PDPA) is no longer optional — it is a baseline obligation for any responsible business operator.

We all recognise the extraordinary utility of these tools. They transcribe speech in real time, summarise key decisions, and deliver a clean action plan the moment a meeting concludes. But as someone who has worked at the intersection of law and technology for over 20 years, I must offer a frank professional warning: “There is no such thing as a free lunch — and convenience may cost you your most sensitive trade secrets.”

In 2025, a landmark class-action lawsuit in the United States was filed against Otter.ai, alleging that the platform intercepted and leveraged user data without adequate consent. This is a red-alert signal that SMEs, hospitals, and tech startups in Thailand cannot afford to ignore. The question is no longer whether to have an AI usage policy — it is whether you will act before an inadvertent PDPA (Personal Data Protection Act B.E. 2562) violation finds you first.

🤖 What Is an AI Meeting Notetaker — And Why Is It a Double-Edged Sword?

How AI Bots Operate Inside Your Online Meeting Room

An AI meeting notetaker is software powered by Generative AI that converts spoken audio into text (speech-to-text) and produces a structured summary of the meeting. Popular tools such as Otter.ai and Fireflies connect directly to your calendar and can “auto-join” any scheduled meeting — often without the host actively triggering them — because the integration was enabled once and subsequently forgotten.

The Convenience That Comes at a Data Privacy Cost

Every coin has two sides. While AI dramatically increases productivity, from a data security standpoint these tools function as intelligent listening devices that capture every word spoken — including personal disclosures, commercially sensitive strategies, and special category personal data (Sensitive Data) — and transmit all of it to Cloud servers, the majority of which are located outside Thailand. For Thai businesses subject to the PDPA, that cross-border data transfer triggers specific compliance obligations that most organisations are not yet meeting.

⚠️ 4 Legal Risks When Using AI Notetakers Without Proper Safeguards

If you allow employees to bring any AI bot into any meeting without governance controls, you are sitting on a ticking legal time-bomb. Here are the four detonators:

1. The PDPA Trap: Recording Without Explicit Consent

In Thailand, recording a conversation when any participant is unaware of — or has not consented to — the recording is a legally sensitive matter with significant consequences.

• The Law: Under PDPA Section 19, collecting personal data (including recorded voice data) requires the data subject’s consent prior to or at the point of collection. There is no grace period and no implied consent.
• The Risk: If an AI bot joins a meeting and begins recording immediately — without a visible notification or an explicit opt-in mechanism — this constitutes unlawful data collection. Beyond the administrative penalty of up to THB 7 million (citing enforcement precedent from 2024 in which a company was sanctioned for a data security breach), the conduct may also constitute a criminal offence under provisions governing unlawful interception of communications.

2. Data Leakage: When Your Trade Secrets Fund an AI Model’s Training

Have you ever read the Terms of Service of a free-tier AI application? The majority of such agreements state — often in fine print — that your conversation data may be used to “improve and train AI models.”

• The Risk: Imagine your team is in a meeting discussing a “proprietary drug formulation” or a “merger and acquisition (M&A) strategy.” That information is then transmitted to an AI training pipeline. One day, a competitor queries ChatGPT or a similar model and receives output that closely mirrors your confidential strategy. This is not a hypothetical: the Otter.ai class-action complaint filed in California explicitly alleged that non-user participants’ voice data was used for model training without their consent — a disclosure that shocked the enterprise tech community.

3. Court Discoverability: When an AI Summary Becomes Evidence Against You

As a matter of Thai evidence law, anything an AI notetaker records constitutes “electronic evidence” within the meaning of the Electronic Transactions Act B.E. 2544.

• The Problem: AI is not human. It lacks the contextual intelligence to distinguish sarcasm, irony, or office humour from a direct statement of intent.
• The Risk: In the event of litigation — for instance, a wrongful termination claim — the opposing party may invoke a discovery-equivalent mechanism to obtain those AI-generated records. If the AI hallucinated and incorrectly summarised a comment as an admission of liability when you were clearly joking, that fabricated summary could become exhibit evidence against your company before a court can properly assess its reliability.

4. Privilege Waiver: Forfeiting Your Attorney-Client Confidentiality

For hospital executives and legal counsel, this is arguably the most consequential risk of all.

• The Risk: Attorney-client privilege is predicated on secrecy. When an AI bot — a third party — is present in a meeting, recording the conversation and storing it on a foreign Cloud server, a court may well hold that you have voluntarily “waived” that privilege by permitting an outside party to access the protected communication. Once privilege is lost, it cannot be reinstated — and your legal strategy becomes discoverable by the opposing party.

📋 Case Study: The High Cost of AI Misuse in a Healthcare Deal

To illustrate the stakes in concrete terms, consider the following scenario drawn from real-world precedents — including a documented hospital privacy breach in Ontario involving an AI-powered notetaking tool:

The Scenario: “Siam HealthTech Co., Ltd.” (fictitious name), an early-stage startup developing a health application, is in an online meeting with a “prominent private hospital.”

1. The Actor: “Nong Ae,” a junior marketing associate, activates an AI Notetaker on the free tier to avoid taking manual notes — without disclosing this to the hospital participants.
   
   
2. The Incident: The AI bot joins the meeting automatically. During the session, participants discuss names of VIP patients and confidential budget figures.
   
   
3. The Consequences:
   
   PDPA Breach: The hospital commences legal proceedings against Siam HealthTech for collecting personal data of patients without consent, in violation of PDPA Section 19 and Section 27.
   
   Data Leak: The hospital’s financial data is processed on foreign servers, in direct breach of the hospital’s internal security policy and potentially in violation of PDPA Section 37, which mandates appropriate security measures for personal data under the controller’s custody.
   
   The Damage: The commercial deal collapses. Siam HealthTech faces regulatory fines and sustains severe reputational harm — damage that no startup can absorb in its early years.
   
   

4. 

✅ Conclusion: Building a Culture of Safe and Governed Online Meetings

“Technology is a force multiplier — but wielded without discipline, it becomes a liability multiplier.”

For business owners, saying “No” to AI in certain contexts is not technophobia. It is an exercise of Professionalism and Governance — two qualities that your clients, investors, and regulators increasingly expect as a baseline, not a differentiator.

Executive Action Checklist — Do This This Week:

1. Convene your IT and HR teams and ask directly: “Which AI tools are our employees currently using to record meetings — and do we have data processing agreements in place with any of them?”
2. Issue a formal company AI Meeting Assistant Policy that classifies meeting types and specifies approved tools, consent procedures, and data retention limits.
3. If you will use these tools, invest in an Enterprise licence that contractually protects your data — not a free-tier product that monetises it.

Do not wait for a court summons to arrive at your office before you take this seriously.

Ready to build a legally sound AI framework for your tech business? The Kooru team specialises in AI Governance Audits and technology contract drafting. [Contact us today for an initial consultation] — protect your business before the law catches up with you.