Thailand PDPA Compliance: What the PDPC Is Actually Fining

Thailand's Personal Data Protection Act B.E. 2562 came fully into force on 1 June 2022 after two postponements, and for its first two years it was widely treated as a law that existed but did not bite. That reading is now out of date. In August 2024 the Personal Data Protection Committee issued its first administrative fine. In August 2025 it issued eight more. This guide sets out what the PDPC is actually penalising, and how a SIEM addresses it.

Legal note. This article provides general information about the PDPA and security tooling. It is not legal advice. Consult a qualified Thai legal practitioner for guidance specific to your organisation.

The Security Obligation

Section 37 of the PDPA requires a data controller to provide appropriate security measures to prevent loss, and unauthorised or unlawful access, use, alteration, correction or disclosure of personal data, and to review those measures when necessary or when the technology changes. Data processors carry their own obligations. The statutory phrasing is general, which means the practical content of the duty is set by what the regulator penalises rather than by the text.

The 72-Hour Clock, and When It Starts

A controller must notify the Office of the PDPC of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, under the Notification on Rules and Methods of Personal Data Breach Notification B.E. 2565 (2022). Where the breach is likely to result in a high risk to the rights and freedoms of individuals, affected data subjects must also be notified without undue delay, together with the remedial measures taken.

In early 2025 the PDPC clarified how that clock runs, and the clarification is more useful than the rule itself.

Awareness is a judgement, not a timestamp. The 72 hours begin when you reasonably believe, on a preliminary assessment, that a breach has occurred or is likely to have occurred. For an obvious incident such as a misdirected email, that is immediate. For a suspected intrusion it is once you have verified enough to form the belief. The PDPC accepts phased reporting, so a preliminary filing can be followed by detail. It will also accept a late notification of up to 15 days where you explain why the delay was unavoidable. What no concession helps with is an organisation that cannot say when it became aware, because nothing was watching.

That is the whole argument in one line. Every flexibility in the clarification depends on being able to evidence what you knew and when you knew it. Neighbouring regimes run on different clocks with different triggers, compared in our guide to breach notification deadlines across Southeast Asia.

What the PDPC Has Actually Fined

Thailand's enforcement record is short enough to read in full, which makes it unusually informative.

The first administrative fine came on 21 August 2024: THB 7 million against a technology products retailer holding data on more than 100,000 customers. It was penalised on three counts. It had not appointed a data protection officer. Its security measures were inadequate, and call centre criminal networks obtained customer data as a result. And it failed to report the breach to the regulator or act on the complaints it received.

On 1 August 2025 the PDPC issued eight orders across five cases, totalling more than THB 21.5 million. They covered a government agency and its service provider, a private hospital where a contractor disposed of health records improperly, a cosmetics company, and a collectible toy retailer whose processor was fined six times more than the retailer itself. In November 2025 the PDPC ordered the iris-scanning service operated by World to suspend collection and delete the biometric data of roughly 1.2 million users.

Three patterns run through the set. Inadequate security measures appear in every case. Failure to notify the regulator appears in three of them. And processors are being fined directly, sometimes more heavily than the controller that engaged them.

The Regulator May Find Your Breach First

Thailand differs from its neighbours in one respect that matters operationally. The PDPC runs a proactive monitoring unit, publicly known as Eagle Eye, which looks for Thai personal data that has been exposed or offered for sale. Its first published sweep, announced in August 2024, covered 31,561 state units and identified 6,086 instances of exposed data, with 139 cases of officials selling personal information referred to the Cyber Crime Investigation Bureau and 11 arrests following. The unit now scans dark web and social media sources.

The consequence is straightforward. An enforcement matter in Thailand does not require anyone to complain. If the regulator finds your data on a forum before you have noticed the breach, you arrive at that conversation having already missed the 72-hour deadline, and the failure to notify becomes a separate penalty sitting on top of the security failure. Detection speed stops being a refinement at that point.

How a SIEM Maps to PDPA Obligations

Obligation	How a SIEM helps
Section 37 security measures	Continuous monitoring and threat detection across the systems holding personal data
Establishing awareness	A timestamped record of when an indicator first appeared, which is where the 72 hours start
72-hour notification	Forensic scope of the records and accounts affected, so the filing is accurate rather than provisional
Processor oversight	Visibility of third-party and contractor access to your systems
Demonstrating diligence	Audit logs and reports evidencing that controls were operating before the incident

Penalties

Administrative fines run to a maximum of THB 5 million, assessed against factors including whether the conduct was intentional or grossly negligent, the size of the business, and the severity of the damage caused. Failure to notify a breach within 72 hours carries an administrative fine of up to THB 3 million in its own right. Courts may award punitive damages of up to twice the actual compensation. Directors and managers can attract personal criminal liability where the offence resulted from their order, action or omission. Separately, the Emergency Decree on Technology Crimes (No. 2) B.E. 2568, effective 13 April 2025, created offences for misusing personal data in technology crime, ranging from one year of imprisonment or a THB 100,000 fine up to five years or THB 500,000 where the exploitation is commercial.

Cross-Border Transfers and Where Your Logs Live

It is worth being accurate here rather than convenient. Thailand does not impose a general data localisation requirement on the private sector, so a self-hosted SIEM is not mandatory in the way it can be for an Indonesian organisation subject to GR 71/2019. What Thailand has is a cross-border transfer regime, and on 29 September 2025 the PDPC issued rules establishing binding corporate rules for affiliated business groups in both controller and processor forms, with the first two approvals granted the following day.

Security logs contain personal data. Names, usernames, IP addresses and device identifiers are all in scope. Sending them to an overseas cloud SIEM is a cross-border transfer and has to be justified under that regime like any other. A self-hosted SIEM deployed in Thailand does not clear a hurdle that Thai law has put in front of you. It removes the question from the assessment entirely, which is a smaller claim and a true one. The same logic applies to PDPA compliance in Malaysia, UU PDP compliance in Indonesia and PDPA compliance in Singapore.

Practical First Steps for Thai Enterprises

Appoint a DPO if you meet the trigger, because the PDPC has already fined an organisation for not having one. Prioritise log collection from the systems that actually hold customer data rather than from whatever is easiest to instrument. Write the awareness moment into your incident runbook explicitly: who decides, on what evidence, and where that decision is recorded, since the 72 hours run from that point and you will be asked to evidence it. Extend the same scrutiny to your processors, whose failures are being penalised alongside yours and occasionally more heavily. And set log retention long enough to reconstruct an incident you first hear about from someone else.

Meet PDPA Obligations With nPro

nPro is a self-hosted XDR, SIEM, EMS and DLP platform. It runs on your own infrastructure in Thailand, so your security telemetry never becomes a cross-border transfer question, and it gives you the timestamped evidence the PDPC's notification rules assume you already have. Talk to sales or read the nPro SIEM overview.