One Unsealed Salary Envelope Earned a Company a Formal Warning and an Order to Look After the Employee. Yet an Email Telling All Staff Who Was Fired Was Lawful

Introduction: a brown envelope nobody meant to open

One salary envelope was handed along through someone who had nothing to do with it, and it was never sealed. The company ended up with a formal warning, an order to improve its security measures, and an instruction to consider making things right with the employee.

Picture a Monday morning. HR has just finished the annual salary restructuring letters. Everyone is busy, so a letter is handed to someone who has nothing to do with it to drop off. The envelope isn’t sealed, and one employee’s new pay ends up in front of her colleagues.

Nobody set out to hurt anyone. It still ended in a complaint.

Now take another story. A company emails every member of staff with the name, position and contractual misconduct of someone it has just dismissed. That sounds far harsher than a stray envelope. It was not a PDPA breach.

If you own a business or run HR, could you explain the difference between those two?

This is episode 3 of our “PDPA Case Files” series. We take five real complaints that started in HR, from a salary envelope and a noticeboard to a dismissal email, an erasure request from someone who did not pass probation, and a face-scan time clock. We tell them plainly and finish with a checklist HR can use tomorrow morning. If you missed the earlier episodes, episode 1 is about a company posting that an employee had “left” and episode 2 is 5 true stories about CCTV angles.

Which employee data does the PDPA protect?

Any data that tells you who someone is, directly or indirectly. Names, salaries, job titles, reasons for dismissal, photographs, even a build or hairstyle colleagues would recognise: all of it is personal data under Section 6 of the Act. HR handles this data every day, which is exactly why it is so easy to slip. Some of it also carries far more weight than the rest, as the table below shows.

For the whole cycle, from the day someone applies to the day they leave, AIPDPA has a step-by-step piece on employee data from hire to exit (Thai).

Before you read on: The stories are summarised from published complaint decisions of the Expert Committee, Panel 2, under Thailand’s Office of the Personal Data Protection Committee (PDPC). We tell only the facts stated in those documents, add nothing they do not say, and identify no person or organisation. Lessons and recommendations are the author’s opinion.

Story 1: An unsealed salary envelope, a curious colleague. Is the company at fault?

Yes, and the party answerable is the company, not the colleague who looked. This is the story from the introduction, and it shows how a small habit inside HR becomes a legal problem for the whole organisation. The decision makes clear that a staff member’s carelessness is treated as the controller’s failure, and that the remedy reaches beyond fixing procedures to the person whose data leaked.

The complainant, a former employee, said colleagues had opened her 2023 salary restructuring document. The cause was carelessness by an HR officer whose job was to protect staff confidential data: the officer sent the document through an unrelated person, without sealing the envelope, and the information reached other colleagues. She felt harmed and that her rights had been violated, and complained.

The committee looked straight at the company. As data controller it had to keep her name and salary restructuring details from reaching anyone other than her. Because carelessness by its own staff let the data leak without consent, this was a breach of Section 27, paragraph one, read with Section 83.

The order had three parts (Decision 30/2566, 20 December 2023):

1. A formal warning to the company.
2. An order to improve its security measures under Section 37(1), in line with the minimum measures in clause 4(7) of the PDPC Notification on Security Measures of Data Controllers B.E. 2565 (2022).
3. An instruction to consider appropriate, fair remedies for the complainant, including safety in her working environment, reporting back within 30 days.

Part three is the striking one. The order did not stop at “fix your process”. It reached the feeling of safety of the person whose data leaked. Think how uncomfortable it is to keep working in a department where everyone now knows your pay.

What this teaches HR:

• “Just pass it along” is the most common leak. Pay documents should go straight to the employee or through a locked channel, such as password-protected e-payslips or an HR system where each person sees only their own record.
• Seal the envelope and mark it “Confidential, addressee only”. It sounds basic, and this case happened over exactly that kind of basic step.
• One employee’s slip is the company’s liability. Section 37(1) puts the duty on the controller. If you are unsure what the minimum measures are, read AIPDPA’s guide to minimum security measures (Thai).
• Put confidentiality for payroll staff in writing. OK Contracts has a template confidentiality agreement for employee salary data (Thai) you can generate straight away.

Story 2: She left for a competitor, and her old employer pinned her photo to the noticeboard. Is a blurred face enough?

No, because people who had worked beside her for years knew at once who it was. This is the heaviest story in the episode and it is worth reading slowly. It is also the clearest illustration that blurring a face or covering a name does not, on its own, turn personal data into anonymous data when the audience already knows the person, and that a lawful aim does not justify any method of pursuing it.

The complainant had worked for a public company. She resigned and joined another firm. Her former employer saw the new firm as being in the same business and sued her in the labour court for breaching a non-compete clause.

It did not stay in court. She later learned the company had put up a notice on its staff noticeboard showing a photo of her at her new workplace, a screenshot of the new firm’s Facebook page and a copy of the labour court complaint. The notice blurred her face and covered her first name, surname and other details.

But colleagues who had worked with her for a long time recognised her immediately, and a large number of staff saw the notice and signed to acknowledge it. She said she felt humiliated, was shunned by people in her profession and lost work opportunities.

The committee reasoned in steps:

• A blurred photo is still personal data. Her build and appearance let viewers recognise her, so it identified her indirectly under Section 6.
• The noticeboard post amounted to public shaming. The company used the photo and complaint to illustrate its non-compete rules and competition law, so staff understood the person was her.
• The company had already gone to court. Having sued in the labour court, posting the notice as well went beyond what was necessary, and the company’s interest weighed less than her basic rights in her data. Section 24(5) did not apply.
• Without a lawful basis or consent, it breached Section 27.

The committee warned the company to comply strictly with Section 27 and ordered it to delete and destroy her data under Section 33, reporting within 30 days (Decision 31/2568, 22 August 2025).

Author’s view: There are two lessons here. First, blurring is not a magic shield. In an office where everyone knows each other, hair, build, the new employer or even the timing of a notice tells people who it is. Second, once a dispute is in court, let the court decide it. Wanting to remind staff about non-compete rules is understandable, and it can be done without pointing at a real person.

If you worry about staff leaving with company data, set the terms on day one, for example with an employee undertaking on intellectual property and trade secrets (Thai), and read what a company can do when a leaver takes the client list and source code (Thai). The issue is global: TechLawNow covered OpenAI’s court filing alleging a former employee moved confidential files to Apple (Thai), with lessons for Thai companies on stopping leaks at exit.

Story 3: An email told every employee who had been dismissed and why. Why was that lawful?

Because it stayed inside the company, served a clear business purpose and contained nothing false or defamatory. This story is the best counterpoint to Story 2. On the surface it looks more intrusive, since it named the person, gave the reason and went to every member of staff, yet the committee accepted it. Reading the two side by side is the quickest way to understand how legitimate interest is weighed.

A company emailed all its employees a memo explaining why the complainant had been dismissed. It included his first name, surname, position and the conduct that breached his employment contract. He felt harmed and complained.

The committee accepted that the memo was personal data, then asked why the company sent it and who received it.

So it fell under Section 24(5), legitimate interest. The company could use and disclose the data without consent, and the complaint was closed (Decision 55/2567, 14 November 2024).

Story 2 and Story 3 side by side

Author’s view: Don’t read Story 3 as “you can always email the whole company about a dismissal”. What saved it was a clear purpose, a limited audience and accurate content. Move the same text to a public page, or add words that go beyond the facts, and the case starts to look like Story 2 and episode 1. Before you press send, make sure you can answer the three questions behind any legitimate interest claim (Thai). Whether disciplinary records count as sensitive data is covered in this AIPDPA article (Thai).

Story 4: Someone who failed probation asked for her data to be erased and heard nothing. What happens next?

The matter reaches the regulator, and the data ends up deleted anyway. Story 4 is the shortest, but it could happen at any company this week. It is about the simplest duty in the Act, answering the person who asks, and about how silence turns a routine request into a formal complaint that someone outside the company now has to look at.

The complainant had been taken on by a company but did not pass probation. She felt the company no longer needed the data she had given when applying and wanted to prevent any harm, so on 26 June 2023 she asked HR to delete and destroy it. She received no reply, and complained.

When the committee looked into it, it found the company had deleted and destroyed her data on 18 July 2023, and held that this complied fully and correctly with her request and closed the matter (Decision 21/2566, 30 August 2023).

A tidy ending, but count the days. It was 22 days from request to deletion, and when she complained she still had no reply from the company. A one-line reply, “We have received your request and will act by…”, might have kept this from going anywhere.

What this teaches:

• Erasure is a right under Section 33. When data is no longer needed for its purpose, the data subject can ask for it to be deleted, unless the company has a legal reason to keep it, in which case it must say so.
• Silence is the worst answer. Set an internal rule to acknowledge every request within a few working days and close it within 30 days. (Author’s view: the Act sets 30 days expressly for access requests under Section 30, and using the same window for all requests is easy for the team to remember and safe.) How to organise this is set out in answering data subject requests on time (Thai).
• Unsuccessful applicants’ data should expire by design. State in the applicant privacy notice how many months you keep it, then delete on schedule without waiting to be asked. For former staff, see how long you may keep ex-employee records (Thai).
• Watch what HR asks for in the first place, such as criminal records, which have their own rules: criminal record checks for applicants under the 2023 notification (Thai).

Story 5: Can a company make staff clock in with a face scan?

Yes, if it meets the conditions for sensitive data, and it should offer another option to anyone who does not consent. The complaint itself was never examined on its merits, because of how it was filed. But the facts recorded in the decision, in particular the employer’s own explanation of how it had set up the system, are a useful model for any company thinking about biometric time attendance.

Someone complained that a university had changed its time-recording method to collect staff facial data for clocking in, and asked for face scanning to be scrapped.

The university said it had obtained consent from staff, and that anyone who did not consent could use another method, such as entering a PIN. It was not blocking anyone’s rights.

The complaint stopped at the first door. It was anonymous, with no name, address, phone number or email for the complainant, so it was unclear and incomplete under clause 8(1) of the PDPC Regulation on the Filing, Rejection, Termination, Consideration and Time Frame for Complaints B.E. 2565 (2022). The committee declined to accept it (Decision 38/2566, 20 December 2023).

Author’s view: Even without a ruling, the university’s explanation is a good template. Facial data used to identify someone is biometric data, which is sensitive under Section 26, and generally needs explicit consent. Between employer and employee, consent only carries weight if people can say no without losing anything. A real alternative, such as a PIN, is what makes that consent genuinely free. A company that forces face scanning with no alternative faces a much harder question.

There is a lesson for employees too. If you want a complaint examined, you need to identify yourself and give a way to reach you. If you fear repercussions, ask about protective channels first, but an anonymous letter with no contact details rarely reaches the substance.

Read more in when facial recognition of staff can be justified (Thai) and AIPDPA’s guide to sensitive data under Section 26 (Thai). Abroad, a US court recently refused to dismiss most of the BIPA claims against Apple over face scanning in Photos (Thai), a reminder of how seriously the law treats faces.

Where is the line between “managing staff” and “public shaming”?

It comes down to four questions: why you are telling people, who you are telling, whether you are telling only what is needed, and whether the words are accurate. Put Stories 2 and 3 side by side and it is clear the law does not look at the channel. It looks at the weight of the reasons behind each disclosure and at whether a lighter route was available.

If you want the weighing on paper, ready for the day someone asks, use AIPDPA’s legitimate interest assessment (LIA) guide (Thai).

What should HR check? A 10-point checklist

Answer all ten and the five stories in this article are very unlikely to happen at your company. Most of them cost nothing except a decision and a short written rule, and every item maps back to at least one of the real complaints above, so you can explain to management why each one matters.

1. Have separate privacy notices for employees and for applicants, stating what you collect, why and for how long.
2. Pay documents go only to the employee. No passing them along. Seal envelopes, or use password-protected e-payslips (Story 1).
3. Limit access to pay and disciplinary data by role, rather than letting all of HR see everything.
4. Before announcing a dismissal or sanction, be able to say why, to whom and in how much detail (Stories 2 and 3).
5. Never use a real employee’s photo or story as a teaching example, blurred or not.
6. If a dispute is in court, keep it in court, not on a noticeboard or in a group chat.
7. Have a clear channel for data subject requests and acknowledge every one within a few working days (Story 4).
8. Set a retention period for unsuccessful applicants’ data and delete on schedule without waiting to be asked.
9. If you use face or fingerprint scanning, get explicit consent and offer another method to anyone who declines (Story 5).
10. Train HR and line managers every year, because four of these five stories began with a person’s decision, not a system.

Item 10 is the one small companies tend to skip. If you want your team to build this skill properly, look at the workplace upskilling courses on SkiLLNo. For what to check for each type of employee data, see AIPDPA’s guide to employee data from salary to fingerprints (Thai).

Employee data has leaked. What must you do within 72 hours?

Stop the leak, assess the risk, notify if the threshold is met, and look after the people affected. Story 1 shows that orders look beyond systems to remedies for the person whose data leaked. Planning that care into your response from the first hour, rather than adding it later, protects both the employee and the company’s position if the matter is ever reviewed.

For emails or files sent to the wrong person, read whether a misdirected email must be reported (Thai). The full steps are in AIPDPA’s 72-hour breach notification guide (Thai). For ready-made forms, Kooru offers a data breach response kit with 12 templates.

If you are the employee whose data leaked, what can you do?

Use your rights with the company first, complain if that fails, and always identify yourself. Most of these matters can be settled directly if the request is clear and in writing, and a written request also creates the record you will need if you later have to show the regulator or a court what you asked for and when.

1. Keep evidence, such as photos of the notice, emails, chats or the names of witnesses, with dates and times.
2. Exercise your rights in writing. Ask to see your data under Section 30, ask for erasure under Section 33, or object to its use under Section 32.
3. If the company stays silent or refuses without reason, file a complaint, with your name, address and contact details (Story 5 ended because these were missing).
4. If you suffered real harm, you can claim compensation under Section 77. Take advice from a lawyer.

If you are the company handling these requests, Kooru’s data subject rights form set helps you log requests, verify identity and respond in an orderly way.

What do you risk by leaving HR practices as they are? 4 layers business owners should know

It is not only fines. It includes good people who would rather not work where data leaks easily. Each of the four layers can arrive on its own, and in practice the last one, trust, is usually the hardest and slowest to repair once employees have seen a colleague’s data mishandled.

For an overview of all PDPA penalties, see AIPDPA’s guide to PDPA penalties (Thai).

Let Kooru organise your employee data before someone complains

Kooru puts the rules, documents and people in place to look after employee data across its whole cycle. The five stories share one thing: each began with a small human decision. Passing an envelope to a colleague, pinning a notice to warn others, leaving one email unanswered. Kooru’s legal team helps put rules behind those decisions.

1. A full map of employee data

We trace applications, pay, time records, discipline and exit: where the data sits, who can see it and where it leaks most easily.

2. Documents HR can use today

From the employee privacy notice and employee consent form package to the job applicant consent form.

3. Rules for announcing dismissals and discipline

We write guidance on what to say, to whom and in what words, with a legitimate interest assessment behind it, like the reasons the company in Story 3 could point to.

4. Monthly DPO service

If you want someone answering data subject requests and looking after this continuously, see Kooru’s DPO as a Service.

Contact us

Message us on LINE @kooru and tell us briefly how many staff you have and how they clock in. Kooru’s legal team replies during business hours, and the initial consultation is free.

Things to think about

An unsealed envelope is no different from a file without a password.

Blurring a face does nothing if the viewer already knows whose face it is.

The same dismissal email can be lawful or unlawful depending on why it was written.

An erasure request nobody answers is a complaint waiting to happen.

And the question HR should ask before disclosing anything about an employee is not “who should know?” but “if this person isn’t told, does the work actually suffer?”

Frequently asked questions (FAQ) about employee data and the Thai PDPA

1. Is an employee’s salary personal data?

Yes. A salary linked to an identifiable person is personal data under Section 6. It is not sensitive data under Section 26, but the employer must protect it under Section 37(1). In Decision 30/2566 an unsealed salary envelope led to a formal warning and an order to improve security measures.

2. Can we post an employee’s photo on a notice if the face is blurred and the name hidden?

It is not safe. If viewers can still tell who it is, the photo is personal data that identifies the person indirectly. In Decision 31/2568 a company that posted a former employee’s photo with a copy of a court complaint was warned and ordered to delete the data, because it went beyond what was necessary and amounted to shaming.

3. Is it a PDPA breach to email all staff about who was dismissed and why?

Not necessarily. In Decision 55/2567 the company told only its own staff, to stop the former employee contacting them, disclosed nothing to outsiders, and wrote nothing false or defamatory, so legitimate interest under Section 24(5) applied. Wider disclosure or exaggerated wording could change the result.

4. An applicant, or someone who failed probation, asks us to delete their data. Must we?

As a rule, yes, once the data is no longer needed, under Section 33, unless the law gives you a reason to keep it, which you must explain. Above all, don’t stay silent: acknowledge the request at once and confirm when it is done.

5. Do we need consent to make staff clock in with a face scan?

Facial data used for identification is biometric data, which is sensitive under Section 26 and generally requires explicit consent. You should also offer another method, such as a PIN or card, to anyone who declines, without any disadvantage, so that consent is genuinely free.

6. Can a PDPA complaint be filed anonymously?

In Decision 38/2566 an anonymous letter with no name, address, phone number or email was treated as unclear and incomplete under the complaint regulation, and was not accepted. If you want a complaint examined, identify yourself and give contact details.

7. Can HR send pay documents through a colleague?

It shouldn’t. Pay documents should reach the employee directly in a sealed envelope, or through a system where each person sees only their own record. Sending them through an unrelated person without sealing them is the fact that led to the warning in Story 1.

8. An employee left to join a competitor. What can the old employer do?

It can enforce its contract and legal rights through the courts, for example a labour claim on a non-compete clause. It should not also publicise the matter internally with the person’s photo: Decision 31/2568 found that once the court route had been used, an additional notice was excessive.

9. How long may we keep data on applicants we did not hire?

The PDPA sets no fixed number of months, only that data is not kept longer than necessary. Set a period based on your genuine needs, state it in the applicant privacy notice, and delete on schedule without waiting to be asked.

10. Employee data has leaked. Who must we notify?

If the incident poses a risk to employees’ rights and freedoms, notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware under Section 37(4). If the risk is high, also notify the affected employees and tell them how you will remedy it.

References

1. Expert Committee, Panel 2, Office of the Personal Data Protection Committee (Thailand). (20 Dec 2023). Decision 30/2566 (unsealed salary restructuring document, Sections 27, 37(1), 90)
2. Expert Committee, Panel 2. (22 Aug 2025). Decision 31/2568 (noticeboard post with a former employee’s photo and court complaint, Sections 6, 24(5), 27, 33)
3. Expert Committee, Panel 2. (14 Nov 2024). Decision 55/2567 (internal email on reasons for dismissal, Section 24(5))
4. Expert Committee, Panel 2. (30 Aug 2023). Decision 21/2566 (erasure request from someone who did not pass probation)
5. Expert Committee, Panel 2. (20 Dec 2023). Decision 38/2566 (anonymous complaint about face-scan time recording)
6. Personal Data Protection Act B.E. 2562 (2019), Sections 6, 24(5), 26, 27, 30, 32, 33, 37(1), 37(4), 74, 77, 78, 79, 83, 84 and 90
7. PDPC Notification on Security Measures of Data Controllers B.E. 2565 (2022)
8. PDPC Regulation on the Filing, Rejection, Termination, Consideration and Time Frame for Complaints B.E. 2565 (2022)
9. AIPDPA. Articles and guides on employee data and the PDPA, https://aipdpa.com

This article is general information for business decisions, not legal advice on a specific case. The stories are summarised from published complaint decisions. Anything marked as the author’s view or a lesson is additional analysis and not part of those decisions. We do not name the people or organisations involved so that the focus stays on the principles. Thai Buddhist-era years (B.E.) in decision numbers are 543 years ahead of the Gregorian calendar.

By: Khun Phuwara, Senior Advisor in Business Strategy and Legal-Tech at The Kooru

About the author: Phuwara Krobtaku

Licensed lawyer no. 477/2558 · Thai Barrister-at-Law · LL.M. IP & IT Law (gold medal) · DPO

More than 20 years in IT and digital marketing before law. Founder of Kooru, a tech-law advisory handling PDPA, AI governance and intellectual property for SMEs.

Ask the author on LINEFull profile