A half-day data breach drill is a tabletop exercise in which every team that would act in a real incident works through a staged, simulated breach to test whether the company could notify the PDPC Office within 72 hours of becoming aware. This guide gives DPOs, IT leads and executives a four-hour script, scenarios drawn from the PDPC guide, and measurable outcomes.
- PDPA section 37(4) and clause 5 of the 2022 Notification require notice to the PDPC Office within 72 hours of awareness.
- Ordinary private companies are not legally required to drill; state agencies, regulators and CII organisations must, under the 2023 NCSC standard.
- TDPG 4.0 (guidance, not law) warns that having no internal reporting procedure may count as inadequate security measures.
- The best scenarios come from the PDPC guide's 10 examples, because the regulator's own answers serve as the marking key.
- A drill should produce three things: the awareness time with reasons, the person who ordered notice, and a complete practice notice.
Most Thai companies already have a breach response plan in a folder somewhere. The trouble is that nobody has ever used it. When something does go wrong, the first argument in the room is about when the company actually knew, and the second is about who has the authority to report it.
Neither question is trivial. Section 37(4) of the Personal Data Protection Act B.E. 2562 (2019) counts the 72-hour deadline from the moment of awareness, not from the end of the management meeting. Every hour spent finding a signatory is an hour the company does not get back.
A tabletop exercise is the cheapest way to find those weak points before a real incident. All it takes is one meeting room, one person from each function and a set of prepared scenarios. This article lays out a four-hour drill that fits into a single morning.
Does Thai law require companies to run breach drills?
For ordinary private companies, nothing in the PDPA orders a drill. What the law does require is an outcome that is very hard to achieve without practice: establish the facts, assess the risk and notify the PDPC Office, all inside one fixed window.
where, upon consideration of the facts under (1), it appears that there are reasonable grounds to believe that a personal data breach has in fact occurred, the data controller shall notify the breach to the Office without delay and within seventy-two hours from becoming aware of it, so far as it is able to do so
The organisations with an explicit duty to exercise are those covered by the National Cyber Security Committee's 2023 Notification on Minimum Standards for Information or Information Systems. Its definition of "agency" is narrow and does not reach private companies that are not critical information infrastructure.
"agency" means a State agency, a regulatory or supervisory agency, and a critical information infrastructure organisation.
(j) Cybersecurity Exercise.
If your company is a critical information infrastructure organisation, a drill is part of the minimum controls you must have. For everyone else, it is the way to prove to yourself that the security measures required by PDPA section 37(1) work in practice, not only on paper. To check your status, see Is your company critical infrastructure?
What does a company risk if it never rehearses?
The obvious risk is missing the deadline. The quieter one comes from Chapter J of the TDPG 4.0 guidelines, which treats the absence of an internal procedure for staff to report incidents as a sign that security measures are inadequate, even before the 72-hour period has started.
However, if the data controller fails to establish, in its policies and operating procedures, a requirement for personnel to report incidents to the responsible unit, the data controller runs the risk of being deemed to have failed to provide appropriate security measures [47]
TDPG 4.0 also flags a mistake that drills expose again and again: companies with a ticketing system count the 72 hours from when a ticket was opened. That is not always right, because awareness depends on the facts, not on when someone filled in a form.
For an organization using an Issue Tracking System, the commencement of the 72-hour count cannot in every case be counted from the time a ticket is opened, because the 72-hour period must be considered based on the actual circumstances that occurred.
Who needs to be in the drill room?
Invite everyone who would make a decision or supply information in a real incident, not just IT. A room full of engineers can rehearse system recovery, but it cannot tell you who signs the letter to the regulator or who speaks to customers.
| Role | Who | Job during the drill |
|---|---|---|
| Facilitator | An external DPO, an adviser, or someone outside the decision chain | Releases scenario cards one at a time, runs the simulated clock, never helps answer |
| Timekeeper | One staff member who is not a decision-maker | Logs real and simulated time for every decision, with the name of who made it |
| DPO or coordinator | The data protection officer, or the person the company has designated | Says whether the incident is notifiable and is the contact named in the notice (2022 Notification, clause 6(2)) |
| IT and security | Head of IT, system administrators | States what is known, what is not, and how the damage is being stopped |
| Decision-maker | Managing director or a delegate with written authority | Orders notice to the PDPC Office and to data subjects within the deadline |
| Legal and communications | Legal, corporate communications, call centre | Drafts customer messages, answers the press, handles incoming calls |
| Vendor representative | Your cloud, CRM or web provider, if they will join | Tests whether the contractual breach reporting channel actually works |
What does a half-day drill schedule look like?
Compress 72 hours into roughly three, and release the scenario in stages, the way news trickles in during a real incident. The facilitator announces the simulated time at every stage, for example "we are now at hour 20", so the team feels how much time is left.
The scenario below is an online retailer whose customer data leaks through an outsourced CRM platform. It is chosen because one exercise forces the team through the controller's duties, the processor's duties and notice to data subjects.
- 09:00 · simulated hour 0Card 1: the call centre reports that three customers have received text messages quoting their names and order numbers, with a suspicious link. Where should this report go, through which channel, and who receives it?2022 Notification clause 5 · TDPG J16
- 09:30 · simulated hour 6Card 2: IT finds logs showing an unusual export of the customer table from the CRM provider's account. The timekeeper records the moment the team treats as awareness and the reason. That moment starts the 72 hours.s.37(4) · TDPG J12
- 10:00 · simulated hour 12Card 3: the CRM provider emails to confirm a vulnerability on its side. The team opens the contract: does it oblige the provider to report within 72 hours, and what should the company now instruct it to do?2022 Notification clauses 5(2) and 8
- 10:30 · simulated hour 24Card 4: the leaked data covers names, phone numbers, addresses and purchase history for about 8,000 customers (a made-up figure). The team assesses risk against the eight factors and decides whether data subjects must also be told.2022 Notification clauses 12 and 10
- 11:15 · simulated hour 40Card 5: screenshots of the scam texts are circulating on social media and a journalist calls. Communications must draft a public statement that reveals nothing further about customers.2022 Notification clause 11
- 11:45 · simulated hour 66Card 6: the exact record count is still unknown. Send the notice now with what is known, or wait? The team completes a practice notice covering all four required items, with the email subject line in the Office's format.2022 Notification clauses 6 and 7 · 2025 Office Notification clause 2
- 12:15 · debriefA 45-minute review: compare the logged times with the deadline, trace who waited for whom, and assign each fix an owner and a due date.2022 Notification clause 5(5)
Card 6 deliberately leaves the facts incomplete, because in real incidents they almost never are complete before the deadline. Clause 6 of the 2022 Notification asks for the essential particulars "so far as it is able to do so". Teams should practise sending what they have on time and following up later.
The method for notifying a personal data breach to the Office of the Personal Data Protection Committee through electronic channels shall be by submission via electronic mail to: saraban@pdpc.or.th
If the team misses the deadline in the drill
That is the most valuable result you can get. Have the facilitator record why it happened, then read clause 7 of the 2022 Notification aloud. It allows a request for exemption from liability for late notice, but only for a necessary cause that can be explained, and with an outer limit that cannot be stretched.
must notify the Office as soon as possible and in any event not later than fifteen days from becoming aware of it.
Where should the drill scenarios come from?
The best source is the PDPC Office's guide on breach risk assessment and notification, which sets out 10 examples with the Office's view on who must be told. The guide is guidance, not law, and has no official English version, but it gives the facilitator an answer key the regulator itself published.
| Guide example | What it tests | The guide's answer |
|---|---|---|
| Example 1: a USB drive encrypted with reliable technology is lost | Can the team decide "no notice needed" and record why? | No notice to the Office or to data subjects |
| Example 4: ransomware encrypts all data and there is no backup | Does the team see that unusable data is a breach even if no one saw it? | Notify both the Office and data subjects |
| Example 7: a web hosting provider's access-check bug locks users out | Does the vendor know to tell the company, and the company to tell the Office? | Vendor tells the controller, controller tells the Office; data subjects not yet |
| Example 10: a marketing email with 100 recipients in To or Cc | Will the team dismiss a small human error? | Notify both, unless the data was encrypted with reliable technology |
One drill a year is enough, but rotate the type of incident. Clause 4 of the 2022 Notification splits breaches into confidentiality, integrity and availability breaches, and each makes a team think differently. All 10 cases are covered in 10 breaches the PDPC has already assessed.
Where do drills usually go wrong?
What slows a team down is usually not legal knowledge but the gaps between people. The facilitator should prepare a prompt for each of the points below.
The team waits for IT to be 100% sure, yet TDPG 4.0 item J12 describes awareness as a reasonable degree of certainty. Decide in advance who makes the call.
Clause 5(2) of the 2022 Notification lets the controller instruct the processor to contain the breach. You cannot instruct someone you cannot reach. Attach an emergency contact list to the contract.
The deadline keeps running for everyone. Name a second-in-line with written authority in the plan.
Clause 11 allows a general notice where individual notice is impossible, and it must not cause damage to data subjects. A statement with too much detail can help scammers.
Clause 9 allows the exemption to be raised if the controller can prove there is no risk, with evidence for the Office. A drill that ends with written reasons is a good drill.
How do you score a drill so you know you are improving?
Do not score "everyone understood", because you cannot measure it. Score what the timekeeper logged, and keep the same measures every year so you can compare.
- Time from the first card to declaring awareness, with written reasons.
- Time from awareness to the order to notify the Office, given by the person with real authority.
- The practice notice: does it cover all four items in clause 6 of the 2022 Notification, especially the DPO's name and contact details?
- The risk assessment: how many of the clause 12 factors were cited, and was the decision about data subjects reasoned?
- Vendor contact: how long until someone who could answer technical questions was on the line?
- Follow-up: does every fix have an owner and a due date?
What should you keep as evidence after the drill?
Keep three things: the timekeeper's log, the practice notice to the PDPC Office, and the list of fixes with named owners. Together they show that the company actually tested its own security measures.
Once a real breach happens, clause 5(5) of the 2022 Notification already requires a review of measures to prevent the same kind of incident. A company that drills regularly has its fix list ready instead of starting from nothing on the day everyone is most exhausted.
take such necessary and appropriate measures to suppress, respond to, rectify or recover from the personal data breach, as well as to prevent and mitigate the impact of the occurrence of a personal data breach of the same nature in the future
For the full sequence in a real incident, read The first 72 hours of a data leak. For the message to affected customers, see What the breach letter to data subjects must say.
Frequently asked questions
Can a small company without a DPO run this drill?
Yes. The person the company designates as coordinator takes the DPO's seat, which clause 6(2) of the 2022 Notification also allows in the notice itself. Two hours and three cards are enough.
Do we have to tell the PDPC Office that we are running a drill?
Nothing in the knowledge base requires it, and you must never send a practice email to saraban@pdpc.or.th. Write it until it is ready to send, then keep it as internal evidence.
How often should we drill?
The law sets no frequency for ordinary private companies. We suggest once a year, plus an extra drill when you change a key system vendor, change leadership, or after a real incident.
Should we invite our outsourced vendors?
If they will come, yes. Clause 8 of the 2022 Notification requires your contract to oblige processors to report breaches within 72 hours of becoming aware. A drill is the chance to test that the channel really works.
Can a CII organisation use this schedule as its NCSC exercise?
As part of it. The 2023 NCSC Notification ties exercises to the Code of Practice and Standards Framework, which has its own detail, so check against that document as well.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (4)
- PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) — Clause 5 · Clause 6 · Clause 7 · Clause 8 · Clause 11 · Clause 12
- PDPC Office Notification on Electronic Channels for Personal Data Breach Notification B.E. 2568 (2025) — Clause 2
- PDPC Office Guide on Breach Risk Assessment and Notification, version 1.0 (15 December 2022) — guidance, not law — Example 1 · 4 · 7 · 10
- TDPG 4.0 Thailand Data Protection Guidelines, Chapter J on breach management — guidance, not law — TDPG 4.0 Clause J12–J16
- National Cyber Security Committee Notification on Minimum Standards for Information or Information Systems B.E. 2566 (2023) — Clause 3 · Clause 4 (1)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)