A breach letter to data subjects is the notice a data controller must send without delay when a breach is likely to result in a high risk to people, under PDPA section 37(4). It must cover at least the four items in clause 10 of the 2022 Notification. This guide gives DPOs, legal and communications teams a letter structure, sample wording and a way to choose the channel.
- Affected people must be told without delay, with remedial measures, when a breach is likely to result in a high risk (PDPA s.37(4)).
- Clause 10 of the 2022 Notification requires four items: what happened, whom to contact, the impact on them, and what you and they can do.
- There is no hour limit for data subjects and no need to wait for the PDPC notice; clause 10 applies before or after it.
- If individual notice is impossible, clause 11 allows group or general notice, provided it causes no damage to data subjects.
- TDPG 4.0 (guidance) asks for plain language without jargon and advises against relying only on a press release or blog.
When data leaks, most companies pour their energy into the notice to the PDPC Office, because it has a hard 72-hour deadline. The letter to customers is written last, by whoever is most exhausted, and comes out in bureaucratic prose that leaves readers no idea what they should do.
Yet this letter is the only thing customers actually see. They never read the regulatory notice or the IT report. How far they trust you after an incident depends on this one page more than most companies realise.
This article covers three things: when you must send it, what the law requires it to contain, and how to write it so ordinary people understand. It ends with a hypothetical sample letter you can adapt.
When must you write to affected data subjects?
You must write when the breach is likely to result in a high risk to people's rights and freedoms. That bar is higher than the one for notifying the PDPC Office, which is simply "a risk". Some incidents must therefore go to the Office but not to customers.
If the Personal Data breach is likely to result in a high risk to the rights and freedoms of the Persons, the Data Controller shall also notify the Personal Data breach and the remedial measures to the data subject without delay.
The Act gives no number of hours for data subjects, only "without delay". Clause 10 of the PDPC's 2022 Notification on Criteria and Methods for Notification of Personal Data Breaches applies whether the controller has already notified the Office or is still preparing to. You do not have to wait for the regulatory notice to go out first.
To judge whether the risk is high, work through the eight factors in clause 12, such as the type of data, the number of people, and whether those affected include minors or vulnerable persons. The PDPC guide's examples help: in example 6, an online shop whose user names, passwords and purchase histories were posted online, the guide says customers must be told because of the high risk of the data being used for illegal transactions. Other cases are in 10 breaches the PDPC has already assessed.
What must the letter contain by law?
Clause 10 of the 2022 Notification lists four essential items, all governed by "so far as it is able to do so" in the opening words. You do not need every fact before you send.
the data controller shall notify the personal data breach, together with the following essential particulars, to the affected data subjects, so far as it is able to do so, without delay:
| Clause 10 | Required content | What the customer wants to know |
|---|---|---|
| (1) | Summary of the nature of the breach | What happened, when, and which of my data is out there? |
| (2) | Name, address and contact details of the DPO or designated coordinator | Whom can I call or email? |
| (3) | The impact that may arise for the data subject | How could this hurt me? |
| (4) | Means of remedy, the controller's measures, and recommendations on what the data subject can do | What are you doing, and what should I do now? |
(4) the means of remedying the damage to the data subject, and summary information concerning the measures which the data controller has used or will use to prevent, suppress or rectify the personal data breach, which may involve personnel, process or technology measures, or any other necessary and appropriate measures, including recommendations concerning measures which the data subject may take additionally in order to prevent, suppress or rectify the personal data breach, or to remedy the damage.
Item (4) is the longest and the one most often left half done. Companies describe what they did, such as shutting systems, resetting passwords and hiring experts, but forget the second half: advice on what the person should do themselves, which is the part customers can actually use.
How the customer letter differs from the notice to the Office
The content of the notice to the Office is set by clause 6 of the 2022 Notification, and the Office's 2025 Notification also fixes the channel and the email subject line. The letter to data subjects has no form or channel prescribed by the Office; there is only the content in clause 10 and the channel rules in clause 11.
A notification of a personal data breach to the Office of the Personal Data Protection Committee shall state the essential particulars, so far as it is possible to do so, in accordance with Clause 6 of the Notification of the Personal Data Protection Committee on Criteria and Methods for Notification of Personal Data Breaches, B.E. 2565 (2022).
| Notice to the PDPC Office | Letter to data subjects | |
|---|---|---|
| When | Any risk · within 72 hours of awareness | High risk · without delay |
| Content | Clause 6: nature and number of people or records · contact · impact · measures | Clause 10: what happened · contact · impact on them · remedy and what they should do |
| Channel | Email to saraban@pdpc.or.th under the 2025 Office Notification | Individually in writing or electronically, or group/general notice under clause 11 |
| Reader | Officials who know the technical terms | Ordinary people who are worried |
How do you write it so ordinary people understand?
The law says what must be in the letter, not how to write it. Chapter J of the TDPG 4.0 guidelines helps here. It is guidance, not law, but it matches the purpose of clause 10, which is to let affected people protect themselves.
In such a case, the data controller must notify the data subject in language that is easy to understand and clear.
The important thing is to make the data subject understand the nature of the breach and the measures they can take to protect themselves [194].
The table below sets common sentences from breach letters against rewrites that a reader understands at once. Every row is a made-up example.
| Confusing | Clear |
|---|---|
| The company has identified certain information security events. | On 3 October, someone without permission got into our member system and copied part of the data. |
| Some data may have been affected. | The data of yours that was taken is your name, phone number and delivery address. Card numbers are not stored in this system. |
| There was a disclosure to a third party. | The file was sent by mistake to the courier company we use, which has confirmed in writing that it deleted it. |
| Appropriate measures have been taken. | We closed the gap on 4 October, forced a password reset on every account and have notified the PDPC Office. |
| Please contact the company with any questions. | Call 02-xxx-xxxx, 8 a.m. to 8 p.m. daily, or email dpo@example.co.th and ask for our data protection officer, Mr Somchai. |
A sample breach letter in plain language
Subject: Your member data has been exposed, and what to do now
Dear [Name], Example Shop Co., Ltd. is writing to tell you that your member details were among the data taken from our system. We are very sorry, and below is everything we have been able to confirm as of the date of this letter.
What happened. Between 1 and 3 October, an unauthorised person used a weakness in our member system to copy data. We found it on 3 October during a system check. The data of yours involved is your name, phone number, email and delivery address. Passwords were stored in encrypted form, and this system holds no card details.
How this could affect you. Whoever has the data may call or text you pretending to be us, to trick you into transferring money, clicking a link or giving an OTP code.
What we have done. We have closed the weakness, forced a password reset on every account, notified the Office of the Personal Data Protection Committee, and brought in outside experts to check all our systems. If we find more information about you, we will write again.
- What you should do now: we will never call or message you to ask for a password, an OTP code or a transfer. If anyone does, hang up or delete it.
- If you use the same password on other services, change it there too.
- Be wary of links in texts or emails that use our name. Reach our website only by typing the address yourself.
Contact us. [Name], Data Protection Officer, phone [number] daily [hours], email [address], office [company address]. If you feel we have not handled this properly, you have the right to complain to the PDPC Office.
The sample covers all four items in clause 10 without quoting clause numbers in the letter itself. Customers do not need to know which regulation applies; they need to know what happened and what to do. TDPG 4.0 also includes a more detailed model letter for anyone who wants a second structure.
Which channel should you use if you lack everyone's email?
The default is individual notice, in writing or electronically. If that is impossible for lack of contact details or another necessity, clause 11 of the 2022 Notification allows group or general notice, with a condition in its second paragraph.
the data controller may notify the breach to data subjects as a group, or notify generally through public media, social media, or by electronic means or any other means through which the affected data subjects or the general public are able to access such notification. The notification of a breach to data subjects as a group, or a general notification, must not cause damage or an impact to the data subjects.
The "must not cause damage" condition shapes how a public notice is written. Never list names or anything that reveals who was affected, and avoid links asking people to verify their identity, because scammers can copy the notice and reuse it.
However, an example of a method of communication that is not recommended is a notice limited only to a press release or the organization's blog, because this is not an effective way to communicate the breach to the general public.
TDPG 4.0 item J48 recommends channels that reach people directly, such as email, SMS, direct messages, a prominent website banner and post, and suggests several channels at once. Item J49 suggests using the language you normally use with that customer, so foreign customers should get a letter they can read.
Mistakes that make a breach letter fail
Clause 10(1) requires the nature of the breach. People need at least to know which types of their data are out. If you are unsure, say what you know and when you will update them.
Clause 10(2) requires the name, address and contact details of the DPO or coordinator.
Clause 10(4) includes recommendations on what data subjects can do. TDPG 4.0 item J47 gives the example of advising people to freeze a card if card data leaked.
Clause 11 allows general notice when individual notice is impossible. If you can reach people individually, do so.
Clause 10 applies whether the Office has been notified or notice is being prepared. If customers are about to be scammed, waiting adds damage.
Example 5 in the PDPC guide has the bank keep checking for other affected people and notify them too if found.
If the leak came from an outside vendor, the letter is still your duty as controller; see When a vendor leaks your data. To practise writing this letter under time pressure, add it as a scenario card in a half-day breach drill.
Frequently asked questions
How many days do we have to send the letter?
PDPA section 37(4) and clause 10 of the 2022 Notification say "without delay" and give no hours or days. The higher the risk of customers being scammed, the faster you should send, and you need not wait for the PDPC notice to be filed first.
Should the letter say we have notified the PDPC Office?
Clause 10 does not require it, but it fits naturally among the measures you describe under clause 10(4) and reassures readers. If you have not notified yet, do not say you have.
Should the letter name the attacker?
No need, and do not guess. Clause 10(1) asks for the nature of the breach, not the findings of a criminal investigation. If data went to a business partner by mistake, TDPG 4.0 suggests naming or describing that recipient instead of saying "a third party".
Can we send it through our LINE Official Account?
For individual notice clause 11 refers to writing or electronic means, so a direct message that reaches each customer can work. Add a second channel, because some people never open those messages, and avoid links that scammers can imitate.
Our assessment says the risk is not high, but we want to tell customers anyway. Is that allowed?
Nothing in the knowledge base forbids it, and TDPG 4.0 item J49 notes that a controller may provide more than the law requires. Record your clause 12 assessment and why you chose to notify.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (4)
- PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) — Clause 5 (4) · Clause 6 · Clause 10 · Clause 11 · Clause 12
- PDPC Office Notification on Electronic Channels for Personal Data Breach Notification B.E. 2568 (2025) — Clause 3
- TDPG 4.0 Thailand Data Protection Guidelines, Chapter J on breach management — guidance, not law — TDPG 4.0 Clause J46–J49
- PDPC Office Guide on Breach Risk Assessment and Notification, version 1.0 (15 December 2022) — guidance, not law — Example 5 · 6
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)