A Data Leak at 2 a.m.: The First 72 Hours, Hour by Hour, Under Three Thai Laws

Picture this: it is 2:15 on a Tuesday morning. The on-call engineer sees outbound traffic from the customer database spike for no reason. Five minutes later someone drops a link in the team chat: a forum post offering a file that looks a lot like your membership table. Everyone asks the same first question, "Are we sure it's ours?" The law cares about a different one: what time is it? Because the 72-hour clock may have just started.

This piece lays the duties from three Thai statutes on a single timeline: the Personal Data Protection Act B.E. 2562 (with the Committee's 2022 breach notification and the Office's 2025 notification on the electronic channel), the Computer-Related Crime Act B.E. 2550, and the Cybersecurity Act B.E. 2562. Every deadline and every "must" below is quoted from the text in our knowledge base. The hour-by-hour split is our practical recommendation; the law does not slice the 72 hours for you.

When does the PDPA's 72-hour clock start?

The clock under Section 37(4) of the Personal Data Protection Act starts when the data controller becomes aware of the breach. Clause 5 of the PDPC's 2022 Notification on breach notification spells out that this includes receiving preliminary information from anyone that there "is or is likely to be" a breach. The core provision reads:

Clause 5 of the Notification of the Personal Data Protection Committee on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) is sharper about the trigger. You do not need certainty. A tip given orally, in a chat or by email counts.

The clearest proof that investigation time sits inside the 72 hours is Clause 7 of the 2022 Notification. It treats "the preliminary examination of information" as one of the reasons a controller might notify late, and requires an exemption request in that case. If investigation time were outside the clock, there would be nothing to excuse. Starting the clock when the team finishes its findings is therefore starting it wrong.

What should you do in each hour of the first 72?

In short: contain the leak and preserve evidence in the first hours, assess risk against the factors in Clause 12 of the 2022 Notification in the middle, and get the notification to the PDPC Office before hour 72. The timeline below treats the 2:15 a.m. alert as hour 0. The right-hand label shows which provision drives each step.

1. Hour 0 (02:15)
   Record when you became aware, who told you and how, and open an incident record. Every deadline runs from this timestamp, even if you are not yet sure it is a breach.PDPA s.37(4) · 2022 Notification cl. 5
2. Hours 0–2
   Close the leak: disable compromised accounts, rotate credentials, isolate machines from the network. Do not wipe or rebuild yet. Take snapshots and export logs to storage outside the compromised system first.2022 Notification cl. 5(2) · Computer Crime Act s.26
3. Hours 2–6
   Bring in the DPO, IT and an executive who can make decisions. If the system sits with a processor (cloud, hosting, outsourcer), instruct them to contain it and report facts back. Check organisational, technical and physical measures.2022 Notification cl. 5(1)(2) · cl. 8
4. Hours 2–12 (CII only)
   If you are a critical information infrastructure organisation and the cyber threat is significant, report to the Office of the National Cyber Security Committee and your regulatory or supervisory organisation. The Act sets no hour count; Section 58 says "promptly".Cybersecurity Act s.57 · s.58
5. Hours 12–24
   Classify it as a confidentiality, integrity or availability breach, then assess risk against the eight factors (type of data, volume, vulnerable people, severity and so on). Compare it with the PDPC guide's ten worked examples.2022 Notification cl. 4 · cl. 12
6. Hours 24–48
   Decide and write down why: no notification (keep evidence that there is no risk), notify the Office, or notify the Office and data subjects. Start drafting the notification around the four required particulars.2022 Notification cl. 5(3)(4) · cl. 6 · cl. 9
7. Hours 48–72
   Email saraban@pdpc.or.th using the Office's subject-line format. Where facts are incomplete, state what you can. A partial notice on time beats silence past the deadline.2025 Office Notification cl. 2 · cl. 3
8. As soon as risk is high
   Tell affected data subjects, with remedial measures, without delay. You do not have to finish the Office notification first. If you cannot reach people individually, a group or public notice is allowed, provided it causes them no further harm.2022 Notification cl. 5(4) · cl. 10 · cl. 11
9. After hour 72
   If you still have not notified, do it now with an explanation of the unavoidable cause and ask for an exemption. The hard ceiling is 15 days from awareness. Then review your security measures so it does not happen again.2022 Notification cl. 7 · cl. 5(5)

Notice that telling data subjects is not the last item. Clause 10 of the 2022 Notification applies where the controller "has notified the breach to the Office, or is in the course of preparing to notify the Office". If customer passwords leaked, telling customers to change them at hour 10 is worth far more than bundling that message with your letter to the Office at hour 70.

Who must notify whom, and by when, under each law?

The PDPA requires the controller to notify the PDPC Office within 72 hours and to tell data subjects without delay when the risk is high. The Cybersecurity Act gives critical information infrastructure a separate reporting line. The Computer-Related Crime Act imposes no notification duty at all; it requires service providers to keep traffic data. Here is every duty on one page.

The row people skip is the processor's. Clause 8 of the 2022 Notification does not give the controller extra time because a vendor was slow. It requires the controller to write into the contract that the processor must notify within 72 hours of the processor becoming aware. If your cloud or agency contract lacks that clause, close the gap before an incident, not during one. See our guide to processor agreements.

How do you notify the PDPC Office, and what goes in the notice?

The electronic channel is email, under the PDPC Office's 2025 Notification on electronic channels for breach notification, which repealed the 2023 version. If your playbook still cites the 2023 notification, re-check the channel.

The body follows Clause 6 of the 2022 Notification, which lists four particulars: (1) the nature and type of the breach, with the number of data subjects or records; (2) the name and contact details of the DPO or a designated coordinator; (3) the likely impact; and (4) the measures taken or planned to prevent, contain, fix or remedy it. Both Clause 6 and Clause 3 of the 2025 Office Notification say "so far as it is able to do so", so there is no reason to wait for an exact record count. Give a range and say you are still checking. For follow-up questions, Clause 4 of the 2025 Office Notification lists telephone numbers for official working hours.

Why must you preserve logs before you wipe anything?

Because logs are the only evidence that can answer what the PDPC notice asks: what leaked, how many people, and whether it has stopped. For organisations that are "service providers" under the Computer-Related Crime Act, Section 26 already requires traffic data to be kept.

Read the scope of Computer-Related Crime Act Section 26 carefully. Section 3 defines a "service provider" as one who provides others with internet access or the means to communicate through a computer system, or who stores computer data for the benefit of others, and the Minister prescribes which types must comply and how. Not every company falls under it. Our guide to computer traffic data has the detail.

Even if Section 26 does not bind you, re-imaging a server at 3 a.m. to "get back online fast" leaves you unable to complete the Clause 6 particulars and unable to assess under Clause 12 whether data actually left. A sensible order of operations is: isolate the machine, image disk and memory, export logs to separate storage, then restore. That sequence gives both IT and the DPO what they need.

Critical information infrastructure has a second reporting line

Section 57 of the Cybersecurity Act sets no hour count in the Act itself; it allows the Cybersecurity Regulating Committee to prescribe reporting rules and procedures. Section 58 says "promptly", and Section 73 sets a fine of up to 200,000 baht for a CII organisation that fails to report under Section 57 without reasonable cause. Your PDPC notice does not replace this report: paragraph three of Clause 7 of the 2022 Notification says notifying the PDPC Office does not exempt the controller from duties under sector-specific or other laws. Unsure whether you are CII? Read our Cybersecurity Act guide for CII.

Which mistakes start the clock wrong?

The costliest mistake is rarely a badly written notice. It is misreading one word of the law and then having the whole team follow the wrong clock. Each of the six mistakes below is tied to the words that make it wrong.

1. Starting the clock when the investigation ends. Clause 5 of the 2022 Notification starts from preliminary information that there "is or is likely to be" a breach, and Clause 7 lists "the preliminary examination of information" as a cause of delay that needs an exemption.
2. Starting the clock when management hears about it. Section 37(4) runs from the controller "having become aware". A customer message to your support chat at 2 a.m. is already preliminary information. A sensible fix is to route every intake channel to the DPO automatically.
3. Treating 15 days as a second deadline. Clause 7 grants no automatic extension. It is a route to "request the Office to consider granting an exemption from liability"; you must show an unavoidable necessary cause, and the Office may refuse.
4. Waiting for the vendor's report. Clause 8 gives processors 72 hours from their own awareness to tell you, but your clock runs from your awareness. If you read about it in the news before your vendor calls, your clock is already running.
5. Wiping machines before preserving evidence. It leaves you unable to complete the Clause 6 particulars and may conflict with the traffic-data duty under Section 26 of the Computer-Related Crime Act if you are a service provider.
6. Emailing affected people with everyone in the To field. Clause 11 allows group notice, but its second paragraph says it "must not cause damage or an impact to the data subjects". Exposing victims to each other is a second breach.

What can you still do after 72 hours have passed?

You can still notify, and you should do it now. Clause 7 of the 2022 Notification allows a controller to ask for an exemption from liability for late notification if it can show an unavoidable cause, with a firm ceiling:

A persuasive explanation is one with timestamps: when you became aware, when the leak was contained, and what prevented you from confirming the facts sooner. If your incident record has captured times since hour 0, this explanation almost writes itself. If not, the team must reconstruct events from memory, which is the weakest evidence there is. As for the stakes, Section 83 of the PDPA sets an administrative fine of up to 3 million baht for failing to comply with Section 37. See the full picture in our PDPA penalties guide.

If your real question is "do we have to notify at all?" rather than "by when?", continue with 10 breaches the PDPC has already ruled on, which walks through every example in the Office's guide and explains why encryption only helps with some kinds of breach. A short checklist for your team is in our 72-hour breach notification guide.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)