The Courier Lost the Envelope: Who Must Notify the PDPC?

Most corporate breach plans are written about hackers, ransomware and emails sent to the wrong person. Almost none mention a paper envelope. Yet every month companies hand statements, cards, contracts, payslips, health check results and parcels to the post, to couriers and to messengers by the hundred or the thousand.

Those envelopes leave the company's control at the drop-off point. A delivery worker leaves one at the wrong house or loses it on the way, and the company has done nothing wrong at any step. Many companies therefore treat it as the courier's problem. One bank thought so too, and asked the Office of the Personal Data Protection Committee (the PDPC Office) about it twice.

This article draws on two published PDPC advisory opinions: the one on Bank W's question about notifying a personal data breach caused by a document delivery company, and the one on Company X's question about how to interpret the breach notification rules. We retell both in our own words and set them beside the PDPA and the 2022 notifications. Text inside the quotation boxes is copied from the law itself.

What did Bank W ask the PDPC, and what answer did it get?

Bank W explained that documents containing customer data go into an envelope with the full name and address, are firmly sealed, and are handed to a document delivery company such as Thailand Post. On this occasion the delivery company took an envelope to someone who was not the addressee. That person assumed it was theirs and opened it.

The bank asked two things. First, since it had done its own part correctly and had been neither intentional nor negligent, was it right that the bank was not the wrongdoer in relation to the personal data? Second, if it was not the wrongdoer, did it still have anything to do under the PDPA or other laws?

Round one, by email: the delivery company notifies

The opinion records that the bank had asked the same question by email earlier. The working group that answers email queries replied, in summary, that the test is whose security measures the breach happened to. Where the delivery company misdelivers, the delivery company, as the controller with which the breach occurred, has the duty to notify. The bank does not, unless the bank itself wrote the wrong address.

Had it ended there, every sender in the country could relax. But Bank W asked again, formally. This time the question went to the sub-committee that answers queries on behalf of the Personal Data Protection Committee, and the answer came out differently.

The formal round: the sender notifies

The sub-committee took the view that an outside delivery provider does not, in general, collect, use or disclose the personal data inside an envelope. It holds the envelope physically but cannot know what is in it and may not open it. The opinion cites the Postal Act of 1934 and the 2023 postal regulations in support, and concludes that Thailand Post is neither a data controller nor a data processor for the contents of a sealed envelope or parcel.

The consequence follows directly. A delivery provider that loses or misdelivers the envelope has no duty under personal data protection law in respect of that loss or error. The duty falls on the sender. The PDPC's reasoning is plain: the sender knows what data is in the envelope and can therefore judge how the incident affects the people concerned. The delivery provider does not know, so it cannot.

We were not careless at all. Why must we still notify?

Because the duty to notify and liability for a wrongful act are two separate things. The PDPC told Bank W that liability as a wrongdoer under section 420 of the Civil and Commercial Code, for an intentional or negligent act, is a different matter from the controller's notification duty under PDPA section 37(4). The second arises whenever there is a breach that poses a risk to people's rights and freedoms, whether or not the controller caused it.

Section 37(4) does not ask who did it. It has one condition: is the breach likely to result in a risk to the rights and freedoms of persons? Clause 4 of the PDPC's 2022 Notification on Criteria and Methods for Notification of Personal Data Breaches spells out whose acts can give rise to a notifiable breach.

The PDPC also classified the incidents. An envelope that reaches an unrelated person is a confidentiality breach. Documents lost in transit are an availability breach. Both types are in clause 4, and both can result from an error, defect or accident. Nobody has to have meant it.

Paper falls under the same rule as files

Many companies still think of security measures as an IT matter. The PDPC's 2022 Notification on Security Measures of the Data Controller is wider than that, and the Bank W opinion relies on it.

Is the delivery company our data processor?

The PDPC split the data into two layers. The first is the contents of the envelope. The second is the names, addresses and contact details of recipient and sender that the delivery provider uses to deliver and track the item. The two layers get different answers.

The dividing line the PDPC used is who decides the purposes and means of collecting, using or disclosing the data for the delivery service. A company therefore has to look at the contract and the real working method of each provider. The name of the service does not settle its status. Where a provider is a processor, the PDPC reminded Bank W that an agreement under this provision is required.

A caution on applying this. The part of the answer about Thailand Post rests on postal legislation, and the opinion does not analyse private couriers one by one. The general principle it states is that a delivery provider acting in good faith does not know whether a sealed envelope holds personal data. In our view, if a provider opens envelopes, inserts documents or can see the contents as part of its job, the facts differ from Bank W's and its status has to be analysed afresh.

For a processor's own duties when a breach happens, and the relay of notices from vendor to client, see When a Vendor Leaks Your Data: Who Must Notify Whom, and How Fast.

Which lost envelope means notifying the PDPC or the customer?

The table below contains only situations addressed by the Bank W opinion or by the PDPC Office's guide on breach risk assessment and notification. The guide is guidance, not law, and the opinion itself says a controller must decide on the facts of each case.

Rows 5 and 6 mark the edge of the sender's responsibility. The PDPC drew the line at handover. Once the provider has delivered to the recipient at the correctly stated name and address, what happens afterwards in the mailbox, in the parcel room or in the hands of the recipient or their stand-in is not a breach of the sender's security measures. In our view this makes proof of delivery a document you must be able to obtain from the provider, because it shows on which side of that line the incident fell.

Loss in transit is the hardest row. With a misdelivered envelope you can still ask the recipient whether it was opened. With a lost one there is nobody to ask, so the company has no evidence that nobody read it. That observation is ours. The opinion says only that loss is an availability breach whose risk the sender must assess.

Example 5 is the closest the guide comes to a paper envelope. A single customer reports receiving a stranger's invoice, the bank checks within 24 hours and finds 10 people affected. The guide says to notify both the Office and the affected data subjects, then keep checking whether anyone else is involved and notify further if so. The envelope one customer reports may be only the first from the whole mailing run.

The contents set the level of risk

The PDPC added an observation for Bank W. Where the incident is a confidentiality or integrity breach and the data is health data or other data under section 26, or relates to debt collection under the Debt Collection Act of 2015, or to a demand for payment of a debt or of compensation, the risk to people's rights and freedoms may be considerable.

In our view, envelopes of health check results, letters from a debt recovery team and demands for compensation should therefore be classed as high risk before they are ever sent. The PDPC also pointed to whether the affected data subjects include minors, persons with disabilities or other vulnerable persons, one of the factors in clause 12 of the 2022 Notification.

When do the 72 hours start after the courier calls to say an item is lost?

They start when the company has made its preliminary check and sees reasonable grounds to believe a personal data breach actually occurred. If that cannot be judged at once when the call comes in, time does not run from the call. The PDPC gave the same answer in both the Company X opinion and the Bank W opinion.

Company X asked whether the 72 hours begin once reasonable grounds are confirmed, leaving out the further detailed investigation and the containment work. The PDPC answered that "from becoming aware" in the legal text begins when the controller has assessed the credibility of the information, examined the facts and concluded there are reasonable grounds to believe a breach really happened. The starting point has to be judged case by case.

The PDPC gave two contrasting examples. Some incidents can be confirmed from the outset, such as emailing personal data to the wrong recipient. Others take time to verify, such as a news report claiming that a company's data was exposed through a cyber threat. In our view an envelope incident can be either. A customer sends a photo of an opened envelope and it is confirmed almost at once. A tracking status that has stopped moving needs a query to the provider before you know whether the item is lost or merely late.

The preliminary check cannot be slow

The period before the 72 hours has its own time limit. Clause 5(1) requires the controller to assess credibility and examine the facts preliminarily without delay, so far as it is able. A company that takes the courier's report and sits on it for a week without checking, so that the 72 hours never begin, is out of line with the Notification at the very first step.

Company X's other point was containment. The PDPC said that prevention, suppression and rectification under clause 5(2) must run alongside the notification duty. A company cannot say it is still chasing the envelope and will notify later. If the details are incomplete, the PDPC allows notification in phases: an initial notice first, then further information until the essential particulars in clause 6 are complete.

1. First report
   The provider, a customer or the person who got the wrong envelope makes contact. Record the date and time, who reported it and the tracking number. If you cannot yet tell whether a breach occurred, the 72 hours have not started.2022 Notification, cl. 5
2. Immediately after
   Preliminary check without delay: which envelope, whose, what documents were inside, misdelivered or lost, opened or not.cl. 5(1)
3. Reasonable grounds to believe a breach occurred
   The 72 hours start. Record this time and the reasons, then assess the risk against the eight factors.cl. 5(3) · cl. 12
4. In parallel
   If the risk is high, prevent, suppress or rectify at once. Our examples: collect the envelope from the wrong recipient, or block a card that was inside.cl. 5(2)
5. Within 72 hours
   If there is a risk to people's rights and freedoms, notify the PDPC Office with the four essential particulars. Notification in phases is possible if information is incomplete.s.37(4) · cl. 6
6. Without delay
   If the risk is high, notify the affected data subjects together with the remedial measures.cl. 5(4) · cl. 10
7. No later than 15 days from awareness
   If 72 hours is missed for a necessary cause, notify as soon as possible and explain the reasons, asking the Office to consider an exemption from liability for late notification.cl. 7
8. After the incident is closed
   Review the measures, from the name-and-address check before dispatch to the choice of delivery provider.cl. 5(5)

The full sequence for every type of breach is in The First 72 Hours. Misdirected email has its own article: Sent an Email or File to the Wrong Person?.

We assessed it and need not notify. What must we keep?

Keep the record of the credibility assessment, the fact check and the risk assessment. Company X asked whether details need only be supplied when the PDPC Office asks for them. The PDPC answered that where there is no risk there is no duty to notify, nor to send information or documents to the Office directly, but the controller should keep the evidence for reference in case of a related complaint, or a request from the expert committee or a competent officer for information, documents or evidence.

The reason the PDPC gave to both Company X and Bank W is that the burden of showing compliance with the law lies on the controller. Clause 9, paragraph two, of the 2022 Notification frames it as a duty.

For an envelope this evidence is harder to find than for an IT incident, because there is no log to pull. What you can usually get is a statement from the wrong recipient that the envelope was not opened, a photo of the intact seal, a record of the envelope's return and the provider's report. That list is our suggestion. The opinion says only that the assessment and fact-check records should be kept as evidence.

What does a company risk by doing nothing?

The exposure runs two ways: an administrative fine ordered by the expert committee, and compensation claimed by data subjects in court. Neither opinion discusses penalty amounts. Company X did ask about the penalty for late notification, but the PDPC saw no need to answer once it had said that a no-risk breach need not be notified. The figures in the table therefore come straight from the PDPA text.

Under section 90 the expert committee may first order rectification or issue a warning, and must consider the severity of the conduct and the size of the business. A fine at the cap is not the outcome of every incident. Civil liability is another matter, and it is where Bank W's argument helps least.

Bank W's question rested on the absence of intent and negligence. Section 77 does not accept that argument. If a company violates or fails to comply with the PDPA and a data subject suffers damage, the company must compensate, intentional or negligent or neither. The only exceptions in the text are proof of force majeure, of the data subject's own act or omission, or of compliance with an official's order.

To be clear, the PDPC gave no view on section 77 in this opinion. Whether a delivery provider's error falls within any of those exceptions is not answered by the opinion and would depend on the facts of each case.

Compensation under section 77 includes the necessary expenses a data subject incurs to prevent or suppress the damage. Section 78, paragraph two, sets the limitation period at three years from the day the injured person knows of the damage and of the party liable, or ten years from the day the breach took place. A single envelope incident today can still be claimed on years from now.

What do companies most often get wrong?

These five beliefs are common in administration and operations teams. The two opinions answer every one of them.

What should be fixed before the next envelope goes missing?

The PDPC advised Bank W that errors in addressing and delivery are a foreseeable risk. A controller should therefore have appropriate security measures under section 37(1) covering all three kinds named in clause 4(2) of the Security Measures Notification.

The last row bears directly on envelope design. Suppose an envelope carries the name of a debt recovery team or of a hospital department on the outside: the delivery worker and the neighbours learn something about the recipient before anyone opens it. That example is ours. The PDPC's advice is framed as the broad principle summarised in the table.

Contract terms to ask a delivery provider for

With a provider that is a data processor, two things are mandatory: an agreement under section 40, paragraph three, and a term requiring the processor to report a breach to the company without delay and within 72 hours of the processor becoming aware, under clause 8 of the 2022 Notification. The list below is AIPDPA's good-practice suggestion, not a legal duty. We suggest asking every provider for these terms, because whatever the provider's status, the company is the one that has to assess and notify.

1. A report every time an item is lost, misdelivered, torn open or undeliverable, within a set number of hours, with tracking numbers and the recipients concerned.
2. Incident contacts on both sides, reachable outside office hours.
3. Proof of delivery, such as the recipient's signature, date, time and place, supplied on request, to show whether the incident fell before or after handover.
4. No opening of envelopes, and no use of recipients' names and addresses for anything other than delivery.
5. Help retrieving the envelope from the wrong recipient, with a report on whether it was opened.
6. Subcontractors bound by the same terms.
7. A delivery method for high-risk documents, such as signed-for delivery for health documents and debt collection letters.

A five-question self-test

Try to answer these without opening a file. Each one you cannot answer is work to do first.

• Does our breach response plan have steps for paper documents and parcels?
• If a delivery provider reports a lost item, does the person taking the call know whom to pass it to and what to write down?
• Do we know what data each type of envelope contains, and which types hold health data or debt collection documents?
• What is each delivery provider's status for recipients' names and addresses, and do those that are processors have an agreement?
• For past incidents we decided not to notify, is there an assessment record the PDPC Office could inspect?

A seven-day plan

1. Day 1. List the documents and parcels containing personal data that the company sends out, with the provider used for each.
2. Day 2. Grade each document type by risk: section 26 data, debt collection documents, vulnerable recipients.
3. Day 3. Work out each provider's status by asking who decides purposes and means, and sign agreements with those that are processors.
4. Day 4. Write the pre-dispatch check of names, addresses and documents, and review envelope design.
5. Day 5. Add paper incidents to the breach response plan: who receives the report, who decides, and the assessment form.
6. Day 6. Agree the reporting channel and time limit with each provider.
7. Day 7. Run one drill on the hypothetical that a customer reports receiving someone else's envelope.

If the assessment says customers must be told, see What the Breach Letter to Affected People Must Say. For the content of an agreement with a processor, see the processor agreement guide.

How far can these two opinions be relied on?

Both are views of the sub-committee on the facts each enquirer described. They are not legislation and not penalty orders. The Bank W opinion itself says the controller has to decide on the facts case by case. Use the opinions as a reading of the legal text, and write down your own reasons each time you decide.

Three things the opinions do not answer, and this article does not answer for them. First, what the delivery provider owes the sender, which is a matter of contract and other laws. Second, liability under postal legislation, which the opinion cites only to explain why the provider cannot open an envelope. Third, whether a given loss of documents must be notified, which the PDPC leaves to the controller's own assessment.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)