A CCTV footage leak is a personal data breach that must be notified to the PDPC without delay and, where feasible, within 72 hours of becoming aware under section 37 (4) of the Personal Data Protection Act. This article is for business owners, building managers and IT teams. It sets the NCSA guideline's recommended steps, which are not law, beside the legal deadlines.
- The 72-hour deadline in PDPA s.37 (4) runs from becoming aware of the breach, where feasible, not from when it happened.
- NCSA guideline clause 2.3.4 gives a seven-step order from detection to preventing a repeat, but it has no binding force.
- Preserve logs and evidence before you reset a camera or recorder, or you cannot assess the incident.
- Late notice needs a necessary cause, an explanation to the PDPC, and must come within 15 days (2022 notification, clause 7).
- None of the PDPC's 10 risk-assessment examples is about camera footage, so do not claim the PDPC has ruled on it.
Suppose a clip from the lift-lobby camera of a condominium turns up in a Facebook group for residents. The building manager hears about it on a Friday afternoon from a resident's message (a hypothetical case). Everyone asks the same two questions: who let the clip out, and who has to be told?
This article covers only what happens after footage leaks or a camera system is broken into. For signage, lawful basis and retention, read CCTV in the workplace under the PDPA. For the general steps of any data breach, see the first 72 hours of a data breach.
The starting point is the NCSA CCTV security guideline, version 1.0.0 of 29 September 2026. Its clause 2.3.4 and clause 3.6 set out an order for handling a breach. We lay that order next to the legal deadline in section 37 (4) of the Personal Data Protection Act and the PDPC's 2022 breach notification.
ทั้งนี้ แนวปฏิบัติทั้งสองฉบับนี้เป็นเพียงข้อเสนอแนะเบื้องต้นให้กับผู้ที่เกี่ยวข้อง ไม่มีสภาพบังคับใช้ ไม่สามารถใช้แทนกฎหมาย ประกาศ หลักเกณฑ์ สัญญา หรือข้อกำหนดอื่นที่มีผลใช้บังคับIs leaked CCTV footage a personal data breach?
If the footage shows a face or otherwise identifies a person, and it reaches someone with no right to see it, it usually is. Clause 4 of the PDPC's 2022 notification sorts breaches into three kinds: confidentiality, integrity and availability. Leaked footage is the first kind.
(1) a breach of the confidentiality of personal data (Confidentiality Breach), in which personal data is accessed or disclosed without authority or unlawfully, or as a result of an error, defect or accident;
The same notification says a breach can come from the controller, a processor, staff, contractors or agents. A guard who photographs a monitor and sends it to a chat group and an outsider who hacks the recorder both cause a breach. What differs is how you contain it.
Clause 2.3.4 of the NCSA guideline lists events worth assessing. The table puts each next to the breach kind it most likely falls under. The mapping is ours, not NCSA's and not the PDPC's.
| Event | Likely breach kind (our mapping) | Follow-up question |
|---|---|---|
| An unauthorised person can view or reach the data | Confidentiality | For how long, and did anyone actually look? |
| Images or video exported, disclosed or published without permission | Confidentiality | Who received it? Was it posted publicly? |
| A user or administrator account is compromised | Confidentiality, possibly integrity and availability too | What could the intruder do? Was anything changed or deleted? |
| A device or storage medium is lost | Confidentiality, possibly availability | Was the data encrypted? Is there another copy? |
| Data deleted, altered or made inaccessible without authority | Integrity or availability | Is there a usable backup? Which dates are missing? |
| An outside provider has an incident involving the organisation's CCTV data | Depends on the incident | Does the contract require the provider to tell us within a set number of hours? |
Footage that cannot identify anyone, such as an empty car park at night, is not personal data. A compromised camera is still a security incident, and you should confirm that the recorder does not also hold other footage showing faces.
When does the 72-hour deadline start, and who must be told?
It starts when the controller becomes aware of the breach, not when the breach happened. Section 37 (4) requires notice to the PDPC Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to put people's rights and freedoms at risk.
(4) notify the Office of any Personal Data breach without delay and, where feasible, within 72 hours after having become aware of it, unless such Personal Data breach is unlikely to result in a risk to the rights and freedoms of the Persons. If the Personal Data breach is likely to result in a high risk to the rights and freedoms of the Persons, the Data Controller shall also notify the Personal Data breach and the remedial measures to the data subject without delay. The notification and the exemption to the notification shall be made in accordance with the rules and procedures set forth by the Committee;
Clause 5 of the 2022 notification sets the order. On receiving word, or finding out yourself, that a breach has or probably has occurred, you check how credible it is. If there are reasonable grounds to believe it, you notify within 72 hours of becoming aware.
(3) where, upon consideration of the facts under (1), it appears that there are reasonable grounds to believe that a personal data breach has in fact occurred, the data controller shall notify the breach to the Office without delay and within seventy-two hours from becoming aware of it, so far as it is able to do so, except where such breach is unlikely to result in a risk to the rights and freedoms of persons;
The text says "from becoming aware". It does not spell out whether that is the first report or the moment you conclude a breach is real. The safe habit is to log the time of the first report. Clause 3.6.3 of the NCSA guideline also recommends recording the source of the report and the time you learned of it.
เมื่อมีการตรวจพบและยืนยันเหตุการณ์ ควรมีการบันทึกแหล่งที่มาของการแจ้งเหตุและบันทึกเวลาที่ทราบเหตุ จากนั้นเริ่มกระบวนการตอบสนอง โดยควรสอดคล้องกับกระบวนการจัดการเหตุการณ์ด้านความมั่นคงปลอดภัยขององค์กร และครอบคลุมอย่างน้อย 6 ขั้นตอนดังต่อไปนี้Who gets told, and when
| Recipient | When | Condition | Source |
|---|---|---|---|
| Office of the Personal Data Protection Committee (PDPC) | Without delay, within 72 hours of becoming aware where feasible | Unless the breach is unlikely to put rights and freedoms at risk | PDPA s.37 (4); 2022 notification cl. 5 (3) |
| Affected data subjects | Without delay, with remedial measures | When the risk to rights and freedoms is high | PDPA s.37 (4); 2022 notification cl. 5 (4) |
| PDPC Office, for a late notification | As soon as possible and no later than 15 days from becoming aware | Must explain the unavoidable cause and ask for exemption from liability for the delay | 2022 notification cl. 7 |
| The controller (if you are the processor) | Within 72 hours of the processor becoming aware, where feasible, as set in the contract | The controller must write this duty into the contract | 2022 notification cl. 8 |
Where there is a necessary cause which results in the notification of a personal data breach being delayed beyond seventy-two hours from becoming aware of it, whether arising from the preliminary examination of information, the taking of necessary action to prevent, suppress or rectify the personal data breach, or any other unavoidable necessary cause, the data controller may request the Office to consider granting an exemption from liability for the late notification of the personal data breach. In doing so, the data controller shall explain the necessary reasons and relevant details in order to demonstrate that there was an unavoidable necessary cause which resulted in the late notification of the personal data breach, and must notify the Office as soon as possible and in any event not later than fifteen days from becoming aware of it.
Business owners often ask whether a Friday-evening discovery gives them until Tuesday because of the weekend. Section 37 (4) and the 2022 notification count in hours from becoming aware and contain no weekend exception, so treat the clock as running continuously.
Under the PDPC Office's 2025 notification on electronic channels, clause 2, the notice goes by e-mail to saraban@pdpc.or.th, stating the essentials in clause 6 of the 2022 notification as far as possible: the nature and type of the breach, a contact person or DPO, the likely impact, and the measures used or planned.
What to do first in the 72 hours after a CCTV incident
Clause 2.3.4 of the NCSA guideline gives seven steps for a CCTV breach, from detection to preventing a repeat. They are not binding, but they line up well with the order in clause 5 of the PDPC notification.
กระบวนการควรครอบคลุมขั้นตอนดังนี้ ตรวจพบ → จำกัดขอบเขตของเหตุ → ประเมินข้อมูลและผลกระทบ → เก็บรักษาหลักฐาน → แจ้งผู้รับผิดชอบ → ดำเนินการตามข้อกำหนดที่มีผลใช้บังคับ → แก้ไขและป้องกันการเกิดซ้ำClause 3.6.3 splits the technical work into six steps: contain, assess, remediate, recover, report and improve. The timeline below puts both lists against real time.
- As soon as you become awareWrite down who reported it, how, and the time you learned of it. Open one incident record. This time starts every deadline. You do not yet need to know who is at fault or how the footage got out.2022 notification cl. 5; NCSA guideline cl. 3.6.3
- The first hours (our suggestion)Contain: take the suspect recorder or camera off the internet, suspend related accounts and access rights, and take down the posted clip wherever you control the place. Do not reset the device yet.2022 notification cl. 5 (2); NCSA guideline cl. 3.6.3
- Before any reset or repairExport the event logs, note current settings and keep a copy of the leaked clip as evidence. The NCSA guideline recommends preserving logs and evidence before a reset.NCSA guideline cl. 3.6.3
- Day one (our suggestion)Assess which system, which cameras, which time window, whether personal data is involved, how many people, and whether the risk to them is high, using the factors in clause 12 of the 2022 notification.2022 notification cl. 5 (1); cl. 12
- Before 72 hours run outIf there are reasonable grounds to believe a breach occurred and it is not a no-risk case, notify the PDPC with the clause 6 particulars as far as you can. If facts are still missing, notify with what you have and add later.PDPA s.37 (4); 2022 notification cl. 5 (3), cl. 6
- When the risk is highNotify data subjects with remedial measures, without delay. A template is in the letter to data subjects.PDPA s.37 (4); 2022 notification cl. 5 (4)
- If you cannot make the deadlineExplain the necessary cause to the PDPC as soon as possible and in any event within 15 days of becoming aware, asking it to exempt the late notice.2022 notification cl. 7
- Once the incident is under controlFix the weakness, change credentials and rights, recover from a trusted source, watch closely afterwards, then review how it could recur.2022 notification cl. 5 (5); NCSA guideline cl. 3.6.3
Why preserve evidence before resetting a camera?
A reset of a recorder or camera can wipe the event log that shows who came in, when, and what they did. Without it you cannot say how many clips were viewed or pulled out, and your notice to the PDPC can only say that you do not know.
Clause 3.6.3 of the NCSA guideline says, in the assessment step, to preserve event logs and evidence before resetting or changing a device. In its table of measures, levels E and H mark this as "should be done" and level B as "should be considered". The B, E and H levels are the guideline's own importance levels for a system. The guideline says they are not a classification of critical information infrastructure.
Clause 3.6.2 lists example warning signs worth checking, such as a camera restarting for no reason or system settings changed without permission.
กล้องหรืออุปกรณ์เริ่มต้นใหม่โดยไม่มีเหตุผล - ค่าตั้งระบบถูกเปลี่ยนโดยไม่ได้รับอนุญาตThese signs do not mean a breach every time, but each is a reason to check. The table is the AIPDPA team's suggestion of what to capture before you change anything.
| Warning sign | Capture first | Ask yourself |
|---|---|---|
| Many failed log-ins | Log-in records, times and source addresses | Who logged in successfully last, and when? |
| New accounts or unexplained permission changes | The full list of accounts and rights today | Who may create accounts? Does a contractor still hold one? |
| Camera sending data to an unknown destination | Network connection logs of the camera or recorder | Is the destination a service we hired? |
| Footage missing or deleted unusually | The missing date range and the deletion records | Is there a usable backup? |
| Firmware changed from an unknown source | Current firmware version and update history | Who ordered it? Did the maker warn about it? |
| Administrator locked out of own account | Records of password and recovery-address changes | Did someone change the recovery details? |
If the sign comes from a camera exposed to the internet with its factory password, read default passwords and remote viewing for prevention.
How does an insider leak differ from a break-in?
It differs in how you contain it and find evidence. The legal duty to notify is the same, because clause 4 of the PDPC notification counts events caused by staff or contractors as breaches. With an insider, check who had the right to view footage and who opened or exported the clip.
The footage was disclosed without authority. Collect evidence of who sent it and to whom, then assess the risk to the people shown before deciding on notice.
Cut the connection, keep the logs, then check whether any attempt succeeded. If one did and footage could be viewed, access was without authority.
Clause 2.3.4 of the NCSA guideline lists incidents at outside providers as events to assess, and clause 8 of the 2022 notification expects the contract to oblige the processor to tell you within 72 hours. See who must notify when a processor is breached.
It is a warning sign under clause 3.6.2. If the log shows no access or changes, do not jump to a conclusion. Record what you checked.
When must data subjects be told, and what should the letter say?
When the breach carries a high risk to their rights and freedoms, under section 37 (4) and clause 5 (4) of the 2022 notification. Clause 12 lists eight factors for judging risk, including the type and volume of data, the status of the people affected, how serious the impact is, and the measures already in place.
For camera footage the factors we usually weigh are how clearly faces show, whether the camera covers somewhere people expect privacy (such as the corridor outside rooms), whether children or older people appear, and whether published footage can be pulled back. These are the AIPDPA team's observations built on clause 12, not PDPC criteria written for cameras.
The letter should say what happened, how the person's data is involved, the possible impact, what you have done and how to reach you. See the outline in the letter to data subjects. Footage often involves residents or customers you hold no contact details for, so plan a channel in advance, such as a notice board and a registered e-mail address (our suggestion).
What should be ready before an incident happens?
Three things, as clause 2.3.4 of the NCSA guideline closes: roles, a reporting channel and someone with authority to decide. Write down who takes the report, who may order the system cut off, and who signs the notice to the PDPC.
องค์กรควรกำหนดบทบาท ช่องทางการรายงาน การยกระดับเหตุ การประเมินผลกระทบ และผู้มีอำนาจตัดสินใจให้ชัดเจน เพื่อให้สามารถดำเนินการภายในระยะเวลาที่กฎหมายหรือข้อกำหนดที่เกี่ยวข้องกำหนดClause 3.6.3 has a table of measures by level B, E and H. Naming who is responsible and a reporting channel, being able to isolate a suspect device, and reporting as the law requires are all marked "should be done" at every level. Rehearsing the process is "should be done" only at level H and "should be considered" at level E.
For a light rehearsal, run a short scenario of about half an hour, in the style of a breach tabletop drill, with the prompt "a clip from our camera has reached a chat group".
AIPDPA keeps a breach register with a 72-hour countdown from the time the organisation became aware, and a helper that shows who must be told by when. A person confirms every decision and it is logged. You can look at it in the demo account.
If your incident is a data leak with no camera involved, start with the short guide to the 72 hours.
Frequently asked questions
Do I have to notify the PDPC if the leaked footage shows no faces?
If nobody can be identified from the footage and it links to no other data, it is not personal data and the section 37 (4) duty does not apply. Still check whether the recorder holds other footage that shows faces, and keep a note of the check.
Is the NCSA CCTV guideline binding?
No. Its own preface calls it only a preliminary recommendation with no binding force. The duty to notify within 72 hours comes from section 37 (4) of the Personal Data Protection Act.
What if I cannot notify the PDPC within 72 hours?
Clause 7 of the 2022 PDPC notification lets you ask the PDPC Office to exempt you from liability for late notice where there is an unavoidable necessary cause. You must explain it, notify as soon as possible, and in any event within 15 days of becoming aware.
A contractor who installed the cameras caused the leak. Who notifies?
First work out who is the controller. If you are, the duty to notify the PDPC is yours. A processor must tell the controller as the contract provides, and clause 8 of the 2022 notification says the contract should set 72 hours from the processor becoming aware.
A staff member posted camera footage online. Is the organisation responsible?
Clause 4 of the 2022 notification counts events caused by staff as breaches, so you must assess the incident and consider notice. The staff member's own liability is a separate question that depends on the contract and workplace rules.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (4)
- PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) — Clause 4 · Clause 5 · Clause 6 · Clause 7 · Clause 8 · Clause 12
- PDPC examples of breach risk assessment (guidance, not law) — Examples 1–10
- PDPC Office notification on electronic channels for breach notification B.E. 2568 (2025) — Clause 2
- NCSA Thailand CCTV Security Guidelines (TCSG) v1.0.0 (guidance, not law) — Clause 2.3.4 · Clause 3.6.2 · Clause 3.6.3
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)