Pathology labs handle some of the most sensitive information a hospital holds, and much of it travels on paper, glass and chat apps as well as in the lab system. Thailand's Personal Data Protection Act (PDPA) sets clear expectations for how that data is collected, used, shared and protected. This guide is for lab managers, pathologists and hospital IT teams who need to turn the law into practical habits; it is not legal advice, and your organization's data protection officer or legal counsel should confirm how it applies to you.
The PDPA in brief for laboratories
The PDPA is Thailand's general data protection law. It applies to organizations that collect, use or disclose personal data of individuals in Thailand, and it is overseen by the Personal Data Protection Committee and its office. The law distinguishes between a data controller, who decides why and how personal data is processed, and a data processor, who processes data on the controller's behalf.
For laboratories, the most important point is that the PDPA treats health data as sensitive personal data. Sensitive data attracts stricter rules on legal basis and calls for stronger protection than ordinary personal data. Diagnoses, histology and cytology reports, specimen descriptions, clinical history on requisitions and genetic results all fall into this category.
The law also gives individuals rights over their data, including the right to be informed, to access their data, to request correction, and in some circumstances to object to processing or request deletion. A lab needs a way to handle those requests, usually coordinated through the hospital.
Legal bases for processing health data
Under the PDPA, processing sensitive data generally requires explicit consent unless a specific exception applies. The law includes exceptions relevant to healthcare, such as processing needed for medical diagnosis and treatment by professionals bound by confidentiality, and processing required to comply with law.
In practice, routine diagnostic work requested by a treating clinician usually relies on those healthcare-related grounds rather than on fresh consent for every specimen. Uses beyond direct patient care are different. Research on archived blocks, building teaching sets, training or validating AI models, and sharing data with commercial partners each need their own legal basis, and often ethics committee approval as well. Do not assume that clinical consent covers secondary use.
Map where patient data lives in your lab
You cannot protect data you have not found. Walk a case through the lab and list every place personal data appears:
- Requisition forms and specimen container labels
- Accessioning screens, worksheets and printed case lists
- Cassettes, blocks and slides, including handwritten labels
- Gross photographs and whole slide images, including the scanned slide label
- Draft and final reports, printouts and PDFs sent by email
- Dictation audio files and transcripts
- Messaging apps used to share images or ask quick questions
- Spreadsheets kept for audits, research or teaching
- Archived blocks and slides, and records of who borrowed them
The last few items are where labs most often find gaps. A spreadsheet of interesting cases on a personal laptop or a photo of a slide in a group chat is personal data processing too. Good specimen tracking helps here, because it replaces handwritten lists with controlled records.
Practical safeguards that matter most
The PDPA requires appropriate security measures without prescribing a specific technical list. For a pathology lab, these are the safeguards that make the biggest difference:
Access control
Give each person their own account and only the access their role needs. Shared logins at grossing stations or sign-out desks make it impossible to show who did what. Remove access promptly when staff leave or change roles.
Strong authentication and logging
Use multi-factor authentication for remote access and for accounts with broad permissions. Keep audit logs of who viewed, changed, printed or exported patient records, and review them periodically.
Secure sharing
Agree on approved channels for sending reports and images to clinicians and referral labs. Consumer messaging apps are convenient but hard to control, retain and audit. If clinicians expect fast image sharing, provide a secure alternative rather than simply banning what they use now.
Minimization and de-identification
Collect what you need and no more. For teaching, conferences and research, remove direct identifiers from images and reports, including the slide label in whole slide images and any names visible in gross photographs.
Working with vendors, referral labs and the cloud
When another organization processes patient data for you, such as a software vendor, a cloud provider, a courier with tracking data or a reference laboratory, the relationship should be covered by a written agreement. It should define what data is processed, for what purpose, the security measures required, breach notification obligations, use of subcontractors, and what happens to the data when the contract ends.
The PDPA also sets conditions for transferring personal data outside Thailand, generally requiring that the destination offers adequate protection or that another lawful mechanism applies. Ask vendors where data is stored and backed up, and get the answer in writing. Your quality and contract review processes under ISO 15189 are a natural home for this vendor assessment.
Retention, disposal and breach response
Define how long each type of record is kept, aligning PDPA principles with medical record rules, accreditation requirements and professional guidance. Retention periods differ between reports, images, requisitions and audio files, so write them down per record type. When the period ends, dispose of data securely, including paper, and record that you did.
Plan for breaches before they happen. The PDPA requires controllers to notify the regulator of a personal data breach without delay, within 72 hours of becoming aware of it where feasible, unless the breach is unlikely to pose a risk to individuals; where the risk is high, affected individuals must also be informed. That timeline is short, so the lab should know:
- Who to tell internally the moment a breach is suspected, such as a misdirected report or a lost laptop
- Who assesses the risk and decides on notification
- How the incident and actions are recorded
- How the cause will be corrected and prevented, through your normal corrective action process
Key takeaways
- The PDPA treats health data as sensitive personal data, so pathology records need strong protection and a clear legal basis.
- Routine diagnosis relies on healthcare grounds, but research, teaching and AI development need their own basis.
- Map every place patient data appears, including chat apps, spreadsheets and slide labels.
- Individual accounts, least-privilege access, MFA and audit logs are the core safeguards.
- Have written agreements with processors and a rehearsed breach response plan.
Compliance is easier when the lab system itself enforces good habits. PATHOLOGY+ uses role-based access control, multi-factor authentication and audit logging, with security practices aligned with ISO 27001, 27701 and 27799, and you can book a demo to review how it handles patient data.