## 7 Conclusions and Future Work  
This paper presented a novel AI-driven system combining OCR and LLM technologies for automated personal data redaction on drug labels to facilitate Thai PDPA compliance. The system achieved a promising balance between redaction accuracy, efficiency, and label utility preservation, demonstrating potential for practical application. This research contributes to the field of AI for legal compliance [22, 23] by showcasing LLM application for data privacy regulation interpretation and highlighting the value of integrating multiple AI techniques. Despite the promising results, significant avenues for future work are essential to enhance robustness, reliability, and compliance assurance:  
1. Dataset Expansion for Robustness and Generalizability: Acknowledging the current dataset limitations (Section 6), a crucial next step is creating a significantly larger, more diverse benchmark dataset. This dataset should encompass varied label types, languages, layouts, and image qualities. This is essential for rigorous evaluation, improving generalizability, and enabling meaningful model fine-tuning. 2. Improving OCR Robustness: Further research should focus on enhancing OCR accuracy, particularly for Thai script and challenging label conditions. Exploring advanced OCR architectures, incorporating image pre-processing techniques (de-noising, de-warping), and fine-tuning OCR models on label-specific datasets could significantly improve performance [12]. 3. Enhancing LLM Interpretation: Refining the LLM's understanding of the PDPA and its ability to distinguish PII from non-PII is crucial. This could involve experimenting with different prompting strategies, fine-tuning the LLM on a larger dataset of PDPA-relevant text, and incorporating legal domain knowledge [23]. Exploring different LLMs, including those specifically designed for legal tasks, could also be beneficial. 4. Validation with Legal Experts: Engaging legal and privacy professionals to rigorously validate the system's interpretation of PDPA requirements is essential. They should review its redaction decisions (especially in ambiguous situations) and its overall alignment with legal standards before any real-world deployment. This step is critical for ensuring genuine compliance and building trust. Adaptive Redaction: Developing methods for adaptive redaction could further improve the balance between privacy and utility. Here, the level of redaction is adjusted based on the context and sensitivity of the information. This could involve incorporating confidence scores from both the OCR and LLM stages. * Human-in-the-Loop System: Integrating a human-in-the-loop component for review and validation of the system's redactions would enhance reliability. This is especially important for ambiguous cases or high-risk data and addresses the limitations of fully automated AI systems in legal compliance [3]. This could involve a user interface for reviewing and correcting the system's outputs. * Addressing API Security and Deployment Models: A critical consideration for practical deployment, particularly under strict regulations like the PDPA, involves the security implications of transmitting text data (even segments) to external LLM APIs, as employed in our prototype (Section 3.2). Future work should include rigorous security assessments of third-party API providers, potentially involving data processing agreements (DPAs). Furthermore, exploring and evaluating alternative deployment strategies, such as utilizing on-premise LLMs or models hosted within a secure private cloud infrastructure, is essential. This ensures greater control over the data environment and minimizes potential risks associated with external data processing, thereby reinforcing end-to-end PDPA compliance. * Ethical Considerations: A thorough ethical assessment of the broader implications of deploying such a system is necessary. This includes addressing potential biases in the AI models, ensuring transparency and accountability, and considering the impact on individual privacy rights.