Introduction: a small light that comes in at nine every night
Every night when the lights go off, a small dot of light shines through the curtains into the house. It is not a street lamp. It comes from a CCTV camera the neighbours just installed at their front door, angled straight across the fence. It sees the whole front of the house and, when the door is open, the inside too.
Imagine you own that house. You think twice before walking to the kitchen in whatever you are wearing. You stop opening the door for the evening breeze. In your own home.
The neighbours have their reasons. There have been thefts. Two cars went missing from the street. A camera costs a few thousand baht, and once it is up they sleep better. Nobody meant to watch anybody.
If you run a shop, an office or a condominium, how far does your camera see right now? When did you last open the app and look at your own camera angles on purpose?
That story is not made up. It is one of the real complaints that reached the Expert Committee under Thailand’s Office of the Personal Data Protection Committee (PDPC). This is episode 2 of our “PDPA Case Files” series. We take five CCTV stories, from decisions issued between August 2023 and February 2024, and tell them plainly. The point is not who won. The point is what each one teaches a business owner, and we finish with a checklist you can use tomorrow morning.
Is installing CCTV against the PDPA?
No, as long as there is a reason, the camera sees only what it needs to, and the people being filmed are told. The PDPA does not ban cameras, but footage in which people can be recognised is personal data, and the Act has applied in full since 1 June 2022. Whoever installs a camera has to answer three questions.
- Who installed it? A private person watching their own home benefits from Section 4(1), which says collecting data purely for personal or household purposes is outside the PDPA. A shop, company, condominium or organisation becomes a “data controller” under Section 6 straight away.
- Why? For a business the most common reason is the safety of people and property, which can usually rest on legitimate interest under Section 24(5), without asking consent from everyone who walks past.
- How far does it see? This is where most people slip. A camera installed for security that looks into someone else’s home, captures a door keypad, or watches every desk all day starts going beyond the purpose it claims.
In short: installing a camera is fine, the angle is what goes wrong. In none of the five stories below was the camera itself the problem. The problem was how far it saw and whether anyone knew it was there.
Before you read on: The stories are summarised from published complaint decisions of the Expert Committee, Panel 2. We tell only the facts stated in those documents, add nothing they do not say, and identify nobody. Lessons and recommendations are the author’s opinion.
Story 1: Your neighbour’s camera light shines into your home. What can you do?
Quite a lot, and the fastest route is usually a conversation that gets the camera turned. A camera that sees into someone else’s home, or lights it up at night, is a problem whoever owns it, and in the story from the introduction a simple adjustment by the owner was enough to settle the whole dispute.
A neighbour installed a CCTV camera at the front of their own house, but both the camera’s angle and its light reached the front and the inside of the complainant’s home. The complainant said they could no longer live normally and that the whole family was badly affected, so they filed a complaint.
The ending was simpler than you might expect. The camera owner adjusted the angle until it no longer disturbed the other house, the two households settled it, and the complainant withdrew the complaint (Decision 17/2566, issued 30 August 2023 (B.E. 2566), after the complainant withdrew on 19 July 2023).
What this teaches a business owner:
- Don’t forget the light. Many people check only the picture in the app and forget that night lights or the red glow of infrared LEDs disturb the people opposite, even if the recording shows little.
- Adjust the moment someone raises it. This story ended because the owner agreed to move the camera. Had they argued, it could have dragged on much longer.
- Shopfront cameras face the same issue. A camera that faces the street and looks straight into the house or shop opposite adds nothing to your security, but adds plenty to your complaint risk.
Story 2: A neighbour’s camera can see your home. Why might the PDPA not help?
Because a camera a private person installs to watch their own home, with no footage published, is treated as personal use. The second story looks almost the same as the first, with one detail that changes the whole picture for anyone who runs a business from home.
A resident found that a neighbour’s CCTV camera could see part of her home. She had never consented and felt her privacy was violated, so she complained against both the neighbour and the company that owned the land the neighbour’s house stood on.
On the facts, the committee found the neighbour installed the camera to keep their home and the surrounding area safe, and there was no evidence the footage had been published or used unlawfully. The case fell under Section 4(1): data collected for personal benefit only, which the PDPA does not cover (Decision 2/2567, issued 24 January 2024 (B.E. 2567)).
That may feel unfair, but flip it around. If the PDPA covered every camera in every home, every household in the country would need signs, paperwork and a process for data subject requests the day they put up a doorbell camera. So the law draws a line: purely private matters are handled under other laws, such as a civil claim in tort if real damage is done.
Two things change the picture immediately, and business owners should remember both:
- The day the clip gets posted. The line in this story is “not published”. If the owner shares a clip of the neighbours in the village Facebook group, that use is no longer a private household matter.
- The day it stops being a “home camera”. Section 4(1) applies to individuals acting for themselves or their family. If the house is also a shop, a home office or rented rooms and the camera watches the business, the person who installed it is a data controller and the exemption no longer applies.
Story 3: A condo corridor camera sees residents typing their door codes. Is that allowed?
Yes, if there is a security reason and it is done systematically, but it should not capture more than security needs. Every condominium juristic person and building manager should read this one, because the building in this story did almost everything right and still received a pointed reminder.
A resident noticed that a CCTV camera the building management company had installed in the corridor was pointed right at the front of his unit. The footage showed the digital door lock where the entry code is typed and, when the door was open, part of the inside of the unit. He felt his privacy was violated and asked for the camera to be angled away from his door.
Think about it as a resident: if someone replays the footage and zooms in on the fingers on the keypad, they know your door code. That is a very reasonable worry.
The building manager was able to show five things, and this is the most valuable part of the story.
| What the building manager had in place | Why it matters |
|---|---|
| Cameras in the same position and style on every floor | Shows no unit was targeted |
| Installed under the building regulations and a resolution of the co-owners | A traceable decision, not one person’s idea |
| No discrimination against any unit or resident | Removes suspicion that the camera was used to harass someone |
| Signs telling co-owners and residents in advance | Meets the duty to inform |
| Recording and viewing follow the building’s rules | Clear rules on who may view footage and when |
On that basis the committee found that the building manager, as data controller, was acting under Section 24(5), legitimate interest (Decision 24/2566, issued 13 November 2023 (B.E. 2566)).
But one sentence in the decision deserves underlining by every building owner. The committee advised the manager to take care not to record images that may infringe personal data unrelated to building security. In plain terms: the system as a whole was fine, but footage of a door keypad or the inside of a unit does nothing for corridor security. If you can turn the camera or use a privacy mask, do it.
Author’s view: This is a good example that “legitimate interest” is not a magic phrase. It needs real support behind it: a resolution, rules, the same setup everywhere, and signs. To see how to document that reasoning, try AIPDPA’s guide to the legitimate interest assessment (LIA), which walks through the balancing test step by step.
Story 4: A staff member installs a camera in the office without telling anyone. Is the employer responsible?
Yes. The organisation is the data controller and “ought to know” that there is a camera in its own office. Many business owners never imagine this could happen to them, yet a cheap camera bought by one staff member can put the whole organisation on the hook.
An officer at an organisation found that another staff member had installed a CCTV camera inside the office, a camera that could rotate in every direction and clearly see the whole office. Nobody had asked her or the other staff for consent or told anyone what it was for. She felt harmed and complained.
The interesting part: management never ordered the camera. Even so, the committee found that the organisation, as data controller under Section 6, “ought to know”, and since neither the security purpose nor the camera location had been clearly communicated, this infringed the rights of others. Once the organisation learned of it, it had the camera removed (Decision 35/2566, issued 20 December 2023 (B.E. 2566)).
Picture a small office where a team lead buys a cheap Wi-Fi camera and puts it on a cabinet “to see whether people are working”. The owner knows nothing about it. But the day an employee complains, the company is the one that has to answer, not the team lead.
What this teaches:
- “We didn’t know” is not a defence. On company premises the company has to know how many cameras there are, where, and who can see the footage. The simplest rule is no camera goes up without approval, plus a register of every camera.
- A 360° camera needs the strongest reason of all. A camera that pans, zooms and watches every desk all day usually goes beyond security and edges towards monitoring staff.
- Cheap Wi-Fi cameras are a double risk. Beyond the PDPA, a camera still on its factory password lets outsiders watch too. Read AIPDPA’s piece on fixing factory passwords and P2P before viewing CCTV on your phone alongside this one.
Story 5: A phone is a camera too. A stranger films pupils at a school. What can be done?
Several things, and the most useful tool in this story turned out to be the school’s own CCTV. The last story starts not with a CCTV camera but with a mobile phone, which almost every visitor to your premises carries in their pocket.
On Tuesday 23 June 2022 (B.E. 2565) at about 10:12, a man came onto the school grounds, pointed his phone camera towards the pupils and took photos and video. A father of one pupil complained as the person exercising parental authority, because neither he nor his child had consented.
The committee did not rely on one side’s word. It reviewed the school’s CCTV footage, statements from school staff and from municipal officers who were present, and then asked the man himself. He said he had been filming the municipal officers while they inspected an encroachment on a public waterway, a dispute he had with the school, that he had not meant to film anyone else, and that he had not shared the footage anywhere. With no clear evidence that he had done what was alleged, the case fell under Section 4(1), as in Story 2 (Decision 10/2567, issued 23 February 2024 (B.E. 2567)).
What schools, nurseries, tutoring centres and any business looking after children should take from this:
- A well-configured CCTV system is your best witness. Without the school’s footage this would have been one person’s word against another’s. Know how long you keep footage, who can export it, and how to export it without it leaking.
- Have a photography policy for your premises. For example: visitors sign in, no photos of pupils without permission, and clear signs. Children’s data gets special attention under the PDPA. See AIPDPA’s guide to children’s data under Section 20 (Thai).
- Don’t post someone’s photo to “get justice”. If the school or parents had posted the man’s photo to shame him, the situation would flip, because a school is not an individual acting for personal purposes. Keep the evidence and give it to the authorities.
Where is the line between a “home camera” and a “business camera”?
The line is who installs it, for whom, and what happens to the footage. The brand or price of the camera has nothing to do with it. Put the five stories side by side in the table below and the difference becomes much clearer.
| Question | Home camera (for yourself and your family) | Business / building / organisation camera |
|---|---|---|
| Does the PDPA apply? | Mostly not, under Section 4(1), as long as footage is not published | Yes, fully. Whoever installs it is a data controller |
| Lawful basis needed? | No | Yes, usually Section 24(5) legitimate interest |
| Sign needed? | Not required by the PDPA, but it helps avoid disputes | Notice required under Section 23. A sign is the easiest way |
| Who is responsible? | The homeowner | The organisation, even if a staff member installed it (Story 4) |
| If a clip is posted | May fall outside the exemption and risks other laws | A disclosure that needs a lawful basis, with Section 27 risk |
| If someone asks for footage of themselves | No PDPA duty | Data subjects have a right of access under Section 30 |
| Same for both | A camera angled into someone else’s home still causes harm and can lead to a civil claim in tort |
Author’s view: What trips many business owners up is thinking the shop camera is just like the home camera because they came from the same store and the same installer. In the eyes of the law they live in different worlds. This is growing abroad too: a US federal court recently held that searching a licence-plate camera database without a warrant was unconstitutional, which TechLawNow summarises with lessons for Thai housing estates and factories (Thai).
Which camera angles are most likely to draw a complaint?
Angles that look beyond your own space, capture things that have nothing to do with security, or watch one person all day are the riskiest. Walk round every camera you own with this table, look at each one by day and by night, and note which level it falls into.
| Level | Example angle | What to do |
|---|---|---|
| 🟢 Low | Shop entrance, cash counter, your own car park, with clear signs | Complete signs and documents, review yearly |
| 🟡 Medium | Shared corridors passing other people’s doors or homes, a street view wider than needed | Adjust the angle, use a privacy mask, tell those affected |
| 🟠 High | Door keypads, computer screens, or a view into other people’s homes or rooms | Adjust immediately. If you can’t, move the camera |
| 🔴 Very high | Toilets, changing rooms, staff rest rooms, or a camera nobody knows about | Remove it. No security reason is worth this risk |
For a finer grading, AIPDPA sorts cameras into risk levels B, E and H (Thai), which works for a small shop and a large building alike.
What should you check before installing a new camera? A 10-point checklist
Answer all ten before you drill the wall, and that camera is very unlikely to become a complaint. Every point below comes from one of the five stories or from the PDPA itself, and none of them needs expensive equipment, only ten minutes and a clear look at the screen.
- Write the purpose in one sentence, for example “for the safety of customers, staff and property at the shop entrance”. If you can’t, don’t install it yet.
- Define the area the camera needs to see, then check on the actual screen that it sees no more than that.
- Make sure the angle doesn’t cross the fence into anyone else’s home, shop or room (Stories 1 and 2).
- Check the camera’s lights at night so they don’t shine into anyone’s home.
- Make sure it captures nothing unrelated to security, such as keypads, computer screens or papers on desks (Story 3).
- Never install in private areas such as toilets, changing rooms or staff rest rooms.
- Put up a sign before people enter the recorded area, saying who installed the camera, why, and who to contact.
- Set a retention period. The TDPG 4.0 guidelines give an example of about 15–30 days, but that is an example from guidelines, not a legal figure. Choose what your business actually needs. More in how long to keep CCTV footage and how much storage you need.
- Decide who may view footage, change every factory password, and don’t share one viewing account across the whole office.
- Keep a camera register: how many, where, who installed them, who looks after them. Nobody installs a camera without approval (Story 4).
If you are hiring an installer for your shop or office, make sure the contract covers the footage too. See what a CCTV installation contract should include on OK Contracts, which drafts one instantly (Thai).
What should a CCTV sign say?
A good sign tells people in a few seconds who installed the camera, why, and who to contact. The rest of what Section 23 requires, such as how long footage is kept, who may receive it, and data subject rights, belongs in a full notice that is easy to reach.
The TDPG 4.0 guidelines recommend a two-layer approach: a sign at the area, plus a full notice reached by QR code. Sample wording for the first layer:
This area is monitored by CCTV 24 hours a day Operated by: [shop / company name] Purpose: safety of customers, staff and property Questions or requests about your images: [phone / email / LINE] Full privacy notice: [QR code]
Watch out for:
- Place the sign before the recorded area, not under the camera. If people see it only once they are already in the shot, it is not advance notice.
- Use languages people in the area can read. If you have many foreign customers or migrant workers, add a second language.
- Don’t write an over-broad purpose such as “for all business purposes”. The broader it is, the harder it is to show why it is necessary.
If you’d rather not start from scratch, Kooru has a ready-made CCTV privacy notice you can use as the full notice, and AIPDPA covers signs in detail in CCTV signs and the rights of people on camera.
Someone says your camera looks into their home. What should you do within 48 hours?
Listen, check, adjust, and report back. Story 1 ended quickly because the owner agreed to move the camera. The aim is to fix the angle before the other side feels the need to file anything, and to keep a record showing you acted in good faith. Try this sequence.
| When | What to do |
|---|---|
| First hour | Thank them for telling you. Ask which camera, what it sees and when it bothers them. Don’t argue that your camera “doesn’t see anything”. |
| Within 24 hours | Review that camera’s footage by day and by night. Does it see beyond your space? Where does its light go? |
| Within 24 hours | Adjust the angle, zoom out or turn on a privacy mask. If it still sees too much, move it. |
| Within 48 hours | Show them a screenshot of the new view, and delete old footage of their space if you have no need to keep it. |
| Afterwards | Note in your camera register when and why you changed it, in case questions come up later. |
If footage has already leaked, for example a clip is circulating in a LINE group, it is far more serious than an angle problem. AIPDPA sets out the steps in CCTV footage leaked: what to do in the first 72 hours (Thai).
If you are the one being filmed, what can you do?
Talk first. If that fails, choose the route that matches who owns the camera. A business camera opens your rights under the PDPA, while a neighbour’s private camera usually points you towards mediation or a civil claim instead, so working out who owns it first saves a lot of wasted effort.
- Talk to the owner politely. Often they genuinely don’t know the camera sees your home. Story 1 ended this way.
- Collect evidence. Photograph the camera’s position, its angle and its light at night. Note dates and times.
- Work out who owns the camera. If it belongs to a shop, company, condominium or organisation, the PDPA route is fully open. You can ask to see footage of yourself under Section 30, ask for erasure under Section 33, or object to the processing under Section 32, and complain to the regulator if nothing is done.
- If it is a neighbour’s private camera, the PDPA may not apply (Stories 2 and 5), but other routes exist: ask the village head, the housing estate’s juristic person or the district office to mediate, or talk to a lawyer about a civil claim.
- If footage of you has been posted to shame you, screenshot it with the link, date and time immediately. The situation has changed and may involve the PDPA, defamation law and other laws.
If you are the business receiving footage requests from customers or staff, Kooru’s CCTV footage request form helps you verify identity and log requests properly.
What do you risk by leaving cameras as they are? 4 layers business owners should know
It is not only fines. The risk runs from relations with neighbours to the trust of customers and staff. Each of the four layers below can arrive on its own, and in practice the last one, trust, is usually the hardest and slowest to repair.
| Layer | Risk | Detail |
|---|---|---|
| 1 | Administrative | Failing to give notice under Section 23 can bring a fine of up to ฿1,000,000 under Section 82. Collecting or disclosing data without a lawful basis can bring up to ฿3,000,000 under Section 83, and the Expert Committee can order corrective action under Section 90 |
| 2 | Civil | Those harmed can claim compensation under Section 77, and the court may add punitive damages of up to twice that amount under Section 78 |
| 3 | System security | Weak passwords or poor settings may let outsiders view footage, and data controllers must have security measures under Section 37(1) |
| 4 | Trust | Customers who learn your camera looks into the fitting room, or staff who feel a camera following them all day, don’t easily trust you again. And these stories spread fast |
For an overview of all PDPA penalties, see AIPDPA’s guide to PDPA penalties (Thai).
Let Kooru check your cameras before someone else points them out
The five stories have one thing in common: nobody meant to do anything wrong. Everyone installed a camera to be safer, and nobody went back to check how far it saw. Kooru’s legal team can help with exactly that.
1. A walk-through of every camera
We help you build a camera register, review angles by day and by night, grade each camera’s risk, and tell you which to fix first.
2. Reasons you can show
We write the purpose and legitimate interest assessment (LIA) for your cameras, like the one the building manager in Story 3 had, so you can answer the day someone asks.
3. Signs, notices and forms that work
From sign wording to the CCTV privacy notice, the footage request form and internal rules on who may view footage.
4. Monthly DPO service
If you want someone to look after this continuously, cameras, staff data and data subject requests included, see Kooru’s DPO as a Service.
Contact us
Message us on LINE @kooru and tell us briefly how many cameras you have and where. Kooru’s legal team replies during business hours, and the initial consultation is free.
Things to think about
A camera always sees further than the person who installed it intended.
The “personal use” exemption protects your home. It does not protect your shop.
“We didn’t know that camera was there” is not an answer a business owner can give.
A sign costs a few hundred baht, far less than explaining yourself later.
And the best question before installing any camera is not “what does it need to see?” but “what does it not need to see?”
Frequently asked questions (FAQ) about CCTV and the Thai PDPA
1. Do I have to comply with the PDPA for a camera at my front door?
If you are a private person watching your own home and family and you don’t publish the footage, you are usually covered by the Section 4(1) exemption and the PDPA does not apply. If the house is used for business and the camera watches the business, you are a data controller and must comply.
2. Does a shop need consent from every customer to use CCTV?
No. Most shops can rely on legitimate interest under Section 24(5) for the safety of people and property. They still have to give notice under Section 23, and a sign placed before the recorded area is the simplest way.
3. My neighbour’s camera looks into my home. Can I complain under the PDPA?
You can, but if the neighbour installed it for the security of their own home and hasn’t published footage, it usually falls under the personal-use exemption. Asking them to adjust the angle, or asking a community leader or the housing estate’s juristic person to mediate, is usually faster.
4. My condo’s corridor camera sees my front door. Is that allowed?
Yes, if it serves the security of common areas, follows the building regulations and a co-owners’ resolution, is installed the same way on every floor without targeting anyone, and is signposted. Building managers should still avoid recording things unrelated to security, such as door keypads or the inside of units.
5. A staff member installed an office camera without the company knowing. Is the company liable?
Yes. In Decision 35/2566 (20 December 2023) the committee found that an organisation, as data controller, ought to know about cameras in its own office, and that failing to state the purpose and location infringed others’ rights. Companies should ban cameras installed without approval.
6. Can we put cameras in staff rest rooms or changing rooms?
You really shouldn’t. In places where people expect a high level of privacy, such as toilets, changing rooms or rest rooms, it is very hard to argue a camera is necessary for security, and it carries both PDPA and other legal risk.
7. How long should CCTV footage be kept?
The PDPA sets no fixed number of days, only that data is not kept longer than the purpose requires. The TDPG 4.0 guidelines give an example of about 15–30 days, which is guidance, not law. Choose what you genuinely need and state it in your notice.
8. A customer asks for footage showing them. Do we have to provide it?
Data subjects have a right to access and obtain a copy of their data under Section 30. Verify the requester’s identity first and make sure other people in the same clip are not exposed, for example by blurring their faces before you hand it over.
9. A stranger photographs customers or pupils on our premises. What should we do?
Keep the evidence from your CCTV, note the date, time and witnesses, and report it to the relevant authorities. Don’t post the person’s photo yourself to shame them. A business that discloses someone’s image needs a lawful basis and could end up in the wrong itself.
10. What should a CCTV sign say?
The sign at the area should say who operates the camera, why, and who to contact. The rest of what Section 23 requires, such as retention, who may receive footage and data subject rights, should be in a full notice that is easy to reach, for example via a QR code on the sign.
References
- Expert Committee, Panel 2, Office of the Personal Data Protection Committee (Thailand). (30 Aug 2023). Decision 17/2566 (CCTV and camera light reaching a neighbouring home)
- Expert Committee, Panel 2. (24 Jan 2024). Decision 2/2567 (a neighbour’s CCTV, Section 4(1))
- Expert Committee, Panel 2. (13 Nov 2023). Decision 24/2566 (condominium corridor CCTV, Section 24(5))
- Expert Committee, Panel 2. (20 Dec 2023). Decision 35/2566 (a 360° CCTV camera inside an office)
- Expert Committee, Panel 2. (23 Feb 2024). Decision 10/2567 (photos and video taken on school grounds)
- Personal Data Protection Act B.E. 2562 (2019), Sections 4(1), 6, 20, 23, 24(5), 27, 30, 32, 33, 37(1), 74, 77, 78, 82, 83 and 90
- Thailand Data Protection Guidelines (TDPG) 4.0, guidance on notice by signage and sample CCTV retention periods (guidelines, not law)
- AIPDPA. Articles on CCTV and the PDPA, https://aipdpa.com
This article is general information for business decisions, not legal advice on a specific case. The stories are summarised from published complaint decisions. Anything marked as the author’s view or a lesson is additional analysis and not part of those decisions. We do not name the people or organisations involved so that the focus stays on the principles. Thai Buddhist-era years (B.E.) in decision numbers are 543 years ahead of the Gregorian calendar.
By: Khun Phuwara, Senior Advisor in Business Strategy and Legal-Tech at The Kooru
Frequently asked questions
Does a shop need consent from every customer to use CCTV?
No. Most shops can rely on legitimate interest under Section 24(5) for the safety of people and property, but they must still give notice under Section 23, most simply with a sign placed before the recorded area.
My neighbour's camera looks into my home. Can I complain under the Thai PDPA?
You can, but if the neighbour installed it to secure their own home and has not published footage, it usually falls under the Section 4(1) personal-use exemption. Asking them to adjust the angle or seeking mediation is usually faster.
A staff member installed an office camera without the company knowing. Is the company liable?
Yes. As data controller the organisation ought to know about cameras in its office, and failing to state their purpose and location infringes others' rights. Companies should ban cameras installed without approval.
About the author: Phuwara Krobtaku
Licensed lawyer no. 477/2558 · Thai Barrister-at-Law · LL.M. IP & IT Law (gold medal) · DPOMore than 20 years in IT and digital marketing before law. Founder of Kooru, a tech-law advisory handling PDPA, AI governance and intellectual property for SMEs.
