Thailand's AI Passport Program Stores All User Data Locally Under Privacy Law

Local Storage and Compliance Framework

Thailand's TH-AI Passport initiative processes and stores all user-generated data domestically, addressing public concerns about cross-border data flows and foreign AI model training, according to the Digital Economy and Society Ministry. The program operates under the Personal Data Protection Act with cybersecurity safeguards integrated throughout the platform.

Patchara Anuntasilpa, permanent secretary at DES, confirmed Friday that personal data, online learning records, user behavior data, registration processes, online activity, and dashboard information collected through the project remain stored and processed entirely within Thailand. The architecture prevents AI service providers from retaining data once processing completes.

The system deploys masking and screening mechanisms that detect and obscure personal or sensitive information before user prompts reach artificial intelligence providers, whether domestic or overseas. Under the project's safeguards, AI providers cannot use the processed information for other purposes or to train their own models.

Processing and Model Training Restrictions

Prompt computing occurs on foreign servers where the AI models reside, but strict agreements prevent these companies from using Thai data for further model training, Patchara said. The ministry collects only anonymized Q&A datasets to build a future "Thai National AI" while keeping user identity detached from queries within the system.

The Digital Economy Promotion Agency used a standard government procurement contract based on a model prescribed by the Public Procurement and Supplies Policy Commission. Payment terms under the revised contract follow a pay-per-active-user model, consistent with the original agreement, with payments made according to actual orders and usage rather than a fixed contract value.

The winning bidder, TH Consortium, must submit an implementation plan showing 5 million user entitlements logged before the government can formally accept deliverables and make payment. If the 5 million actual logins target is not achieved, the contractor remains subject to penalties under Clause 11 of the original contract, based on the actual number of users who logged in.

Registration and Tier Structure

The DES Ministry opened advance registration for AI model access via the project on August 19, ahead of the program's August 31 launch. Registration is available through de.aipas.net using Google, Microsoft, or Apple accounts and completing identity verification through the government's Tang Rat app or ThaiID app.

Under the TH-AI Passport access scheme, newly registered users receive "innovator" status during the first three months, meaning creators or advanced users. They are initially entitled to use a pro-level AI model for 30 days. After that period, users must complete available training and earn 100 points while maintaining a minimum accumulation of 100 points each month to retain innovator status and continue receiving corresponding benefits the following month.

Users registering after November 30, 2026, are initially classified as beginners. They must complete the required training and earn 100 points to advance to innovator status. The ministry said the PAPU mechanism is primarily intended to provide greater clarity and transparency over the payment process rather than change the fundamental intent of the original contract.

Security Limitations and Domain Transition

Patchara acknowledged the inherent risks in any data system. "Nobody can guarantee zero data leakage in the future, even global tech giants," he said. "Once you are in the system, your identity is detached from your queries. We only collect anonymized Q&A datasets to build our own 'Thai National AI' for the future."

People already registered through de.aipas.net do not need to register again. Once TH-AI Passport is launched, its domain name can change from a .net address to a .go.th address. The revised contract was submitted to the Office of the Attorney-General for review.

The ministry said the project's revised contract was designed to ensure the government gets the best value for money while maintaining the underlying principles of the original agreement. The approach reflects broader regional efforts to balance AI adoption with data sovereignty concerns as Southeast Asian governments navigate relationships with global technology providers.

Thailand's model of requiring local data processing and restricting downstream use by AI vendors offers one template for emerging markets seeking to participate in generative AI capabilities without ceding control over citizen information. The 5 million user threshold will test whether the tiered incentive structure can drive adoption at scale while maintaining the domestic processing architecture.