## 1 Introduction  
The transformative influence of artificial intelligence (AI) is rapidly reshaping industries and societies globally. It drives innovation and efficiency across diverse sectors, including healthcare, finance, manufacturing, logistics, and customer service [1]. As AI systems become more sophisticated and integrated into data-driven processes, the volume and velocity of processed data have reached unprecedented levels. This data-centric paradigm fuels significant advancements. However, it also concurrently amplifies legitimate concerns surrounding personal data privacy and security [2]. These concerns are particularly relevant in contexts where seemingly innocuous data sources, like labels on products and packages, can contain sensitive information. Inthis era of ubiquitous data collection and processing, safeguarding personal information has evolved from an ethical consideration to a core principle of responsible technological development and deployment. This is mandated by increasingly stringent legal frameworks worldwide [3]. Reflecting this global trend, Thailand enacted the Personal Data Protection Act (PDPA) in 2019, with full enforcement beginning in 2022. This landmark legislation aims to protect the personal data of individuals within Thailand, aligning with international best practices for data privacy [2; 4]. The PDPA mandates that all organizations operating in Thailand, regardless of sector, size, or business nature, must implement effective measures to ensure the privacy, security, and lawful processing of personal data. This obligation extends to all data processing activities, encompassing the collection, storage, use, and dissemination of personal information. Crucially, this mandate includes data derived from various sources, explicitly including personal data embedded within or extracted from sources such as labels. These labels often contain personally identifiable information (PII) like names, addresses, and contact details. Compliance with the PDPA is therefore not merely a legal obligation; it has become a critical factor for organizations operating in Thailand. It is linked to maintaining public trust, fostering ethical data stewardship, ensuring the sustainability of AI-driven business models, and safeguarding brand reputation. Failure to adhere to the PDPA's stipulations and principles can expose organizations to significant financial penalties, legal repercussions, and irreparable damage to their brand image and customer trust [5]. This highlights the critical need for robust, automated solutions to ensure PDPA compliance, especially in data-intensive areas like AI-driven label processing [6]. To address this need, this paper introduces a novel AI-driven system for automated personal data redaction on labels, specifically designed for PDPA compliance. Manual redaction, while a traditional approach, is labor-intensive, time-consuming, and error-prone, making it unsuitable for high-volume label processing [7]. Our system, in contrast, leverages the combined power of Optical Character Recognition (OCR) and large language models (LLMs) to achieve efficient, accurate, and scalable data redaction [8; 9; 10]. The key contributions of this work are as follows:  
1. An Integrated OCR and LLM Approach: We present a system that combines OCR [9; 10] and LLMs [8] for effective data extraction and redaction. This combined approach leverages the strengths of both technologies: OCR for text extraction from images and LLMs for nuanced understanding and identification of PDPA-violating information. 2. PDPA-Specific Violation Detection: We utilize a pre-trained LLM (Qwen/Qwen2.5-72B-Instruct-AWQ) [8] specifically prompted to identify potential violations of the Thai PDPA within the extracted text. This goes beyond simple keyword matching, enabling the detection of context-dependent PII [11]. 3. Automated Redaction: The system automatically redacts identified violations directly on the original image, providing a practical solution for data anonymization.