Journal · PDPA
Thailand’s PDPA and in-app telemetry
Socket Nodehub is not a law firm. This note is teaching practice from a Bangkok studio that keeps seeing the same telemetry mistakes under Thailand’s Personal Data Protection Act. If you need a legal opinion, hire counsel. If you need the event layer to stop collecting things it cannot justify, read on.
Telemetry is still personal data
An event stream that can single out a person — user ID, device ID, precise location, search strings that include names — is personal data processing, even if you call it “product analytics.” In-App Event Tracking Analytics does not get a free pass because the destination is a warehouse instead of a marketing tool.
Purpose limitation is the question we repeat in identity week: why is this property on this event? “We might build a lookalike audience” is a different purpose from “we need to know whether checkout completed.” If both are true, they may need different notices, different retention, and different access lists — not one fat client payload.
Minimisation on the SDK
The phone can see a great deal. The SDK should not send a great deal. City instead of coordinates when city answers the product question. User ID instead of email on every screen view. Server-side enrichment for fields that should never sit in a mobile binary log.
Students sometimes argue that hashing is enough. Hashing a national ID and putting it on Screen.viewed is still an identifier with a purpose problem. Fraud systems can run on the server with tighter access. The client event does not need a copy “for convenience.”
Retention is a schema decision
If you cannot say when an event property will be deleted, you will keep it forever. Warehouse-first teams should declare retention per table: raw client events for a short window, aggregated funnels for longer. Tool-first teams should not assume the vendor’s default retention matches what you told users in the privacy notice. Our own privacy notice states how long Socket Nodehub keeps enrolment data; your product notice should be equally specific about telemetry.
What we do in class
We do not role-play as regulators. We strike properties that have no written purpose, we refuse guest-to-user joins that require extra PII, and we practice redacting dictionaries before critique. Remote students outside Thailand still do the exercise; the discipline travels. Bangkok examples show up because that is where the office is: Street: 297-299 Charoennakorn 10 Klongtonsai; City: Bangkok; State/province/area: Bangkok; Zip code: 10600; Country: Thailand.
If your legal team wants to sit in on identity week, write the desk. They usually leave less anxious, not more, once the payload is smaller.