A misdirected email or file is a personal data breach under clause 4(1) of Thailand's 2022 PDPC breach notification rules, even when it is an honest mistake. This guide helps DPOs and team leads decide whether to notify the PDPC Office and the people affected, using the three wrong-recipient cases the PDPC Office has assessed and the eight risk factors in clause 12.
- An honest mistake still counts: clauses 3 and 4(1) of the 2022 notification expressly cover errors, defects and accidents.
- The PDPC guide has three wrong-recipient cases (examples 5, 9 and 10); in all three the Office says to notify it.
- 100 recipients exposed in To/Cc: notify both the Office and the individuals, unless the data was reliably encrypted.
- To skip notification you must prove there is no risk under clause 9 and be ready to show the Office your security measures.
- Notify the Office within 72 hours of becoming aware (PDPA s.37(4)); if the risk is high, tell the individuals too, with remedies.
Picture an ordinary Monday. Someone in accounts emails the department's payroll file to the external auditor, but the mail client auto-completes the address and the file lands with a customer whose name starts the same way. Nobody notices until lunchtime.
No one broke in, no malware ran, no system went down. Many companies file this under "small mistake, apologise and move on". Thailand's breach notification rules see it differently: under the Personal Data Protection Committee's 2022 Notification on breach notification, this is a personal data breach in the full sense.
This article does not walk through all ten of the PDPC Office's worked examples; we did that in our piece on encryption and the ten cases. It focuses on the wrong-recipient breach that can happen on any working day, and on who must be told, by when, and when you can lawfully stay silent.
Is an email sent to the wrong person a data breach?
Yes. Clause 3 of the 2022 Notification defines a breach broadly enough to include disclosure caused by negligence or accident. There does not need to be an attacker or any bad intent.
a breach of security measures resulting in the loss of, access to, use of, alteration of, correction of, or disclosure of personal data without authority or unlawfully, whether arising from intent, wilfulness, negligence, an act without authority or unlawful act, a computer-related offence, a cyber threat, an error, defect or accident, or any other cause.
Clause 4 then sorts breaches into three types. A misdirected email is the first type, a confidentiality breach: the data reaches someone with no right to see it, while the data itself stays complete and usable.
(1) a breach of the confidentiality of personal data (Confidentiality Breach), in which personal data is accessed or disclosed without authority or unlawfully, or as a result of an error, defect or accident;
That classification matters. Once confidentiality is lost, you cannot truly take it back. The recipient may delete the file, but the company cannot prove it was not forwarded or saved. A sound risk assessment starts from the assumption that the data has left the building.
How has the PDPC Office judged wrong-recipient cases?
The Office of the Personal Data Protection Committee published a Breach Risk Assessment and Notification Guide, version 1.0, dated 15 December 2022, with ten worked examples. Three of them involve personal data going to the wrong recipient, and in all three the Office concluded that it must be notified.
A bank customer received a stranger's invoice. Within 24 hours the bank found data on 10 people had leaked. The Office treated it as a real leak and told the bank to keep checking for others.
A school emailed data on many students to its goods-delivery contractor instead of parents. It was unencrypted and may have included sensitive data.
A direct-marketing email meant to go out one by one exposed every recipient's address to the others. The Office pointed to the number of people involved.
Example 10 is stricter than most people expect
The only thing exposed in example 10 is the recipients' email addresses, shown to one another. No ID numbers, no financial data. Many marketers would shrug it off. The PDPC Office did not: it said to notify both the Office and the individuals. The guide has no English version, so the Thai original is quoted here.
บริษัทแห่งหนึ่งทำการตลาดแบบตรง โดยการส่งข้อมูลส่วนบุคคลไปยังผู้รับข้อมูลแต่ละราย แต่ด้วยความผิดพลาด จึงมีการใส่ที่อยู่ของบุคคลที่รับอีเมลทั้ง 100 คน เข้าไปในช่อง To หรือ Cc ทำให้ผู้รับอีเมลเห็นอีเมลที่มีข้อมูลส่วนบุคคลของบุคคลอื่นต้องแจ้ง เนื่องจากเป็นการส่งข้อมูลของเจ้าของข้อมูลส่วนบุคคลจำนวนมาก จึงจำเป็นต้องแจ้งเหตุ แต่หากข้อมูลดังกล่าวมีการเข้ารหัสโดยเทคโนโลยีที่น่าเชื่อถือ อาจได้รับยกเว้นไม่ต้องแจ้งเหตุIn plain English: notification is required because the data of a large number of people was sent; if the data had been encrypted with reliable technology, an exemption might apply. The deciding factor was headcount, not sensitivity. For marketing teams, a few hundred customer addresses leaking at once should never be dismissed without an assessment.
Example 9: a known business partner is not a safe recipient
It is tempting to think a misdirected file is harmless if it went to a supplier you already have a contract with. Example 9 answers that directly. The recipient was the school's own contractor, yet the Office still saw enough risk to require notice to both the Office and the families.
เนื่องจากการส่งข้อมูลดังกล่าวไม่มีการเข้ารหัส และเป็นข้อมูลส่วนบุคคลของบุคคลจำนวนมาก ซึ่งอาจมีทั้งข้อมูลส่วนบุคคลทั่วไป และข้อมูลส่วนบุคคลที่มีความอ่อนไหว ซึ่งผู้รับเหมาอาจจะนำข้อมูลดังกล่าวไปใช้โดยมิชอบและก่อให้เกิดความเสียหายได้The Office gives three reasons: the transfer was not encrypted, it covered many people, and it may have mixed general and sensitive data that the contractor could misuse. Those three questions make a good first test for any misdirected file. If the answers are "unencrypted, many people, some sensitive data", there is little room left for not notifying.
Example 5: keep looking after the first report
Example 5 begins with one customer calling in and ends with ten affected people. The Office says to notify those ten, and to keep investigating whether anyone else was hit.
เนื่องจากข้อมูลดังกล่าวเป็นข้อมูลที่รั่วไหลออกไปจริง ในเบื้องต้นมีผลกระทบเฉพาะผู้ที่ถูกเรียกเก็บเงินตามใบแจ้งหนี้ อย่างไรก็ตาม ธนาคารในฐานะผู้ควบคุมข้อมูลส่วนบุคคลจะต้องดำเนินการตรวจสอบเพิ่มเติมว่ามีบุคคลอื่นใดที่ข้อมูลรั่วไหลออกไปภายนอกหรือไม่ หากพบจะต้องแจ้งเพิ่มเติมThe point: the data genuinely leaked, the first known impact was limited to the people billed, but the bank as controller must check whether others were affected and notify them too. One misdirected email is often a symptom of something larger, such as a mail-merge mapping error or a mis-sorted source file. Check the whole batch before concluding it happened once.
How do you assess risk when your case does not match an example?
Use the eight factors in clause 12 of the 2022 Notification, which is binding law, unlike the guide. The clause says the controller "may consider" them, so you do not need to tick every box, but the factors that fit your incident should have an answer on file.
| Factor | Question for a misdirected email | Signals of higher risk |
|---|---|---|
| (1) nature and type of breach | Who could see the data: one person or a whole list? | Sent outside the organisation or to a large mailing group |
| (2) nature or type of data | What is in the file? | ID numbers, bank details, salaries, health data |
| (3) volume | How many people and records? | Tens or more (example 10 had 100) |
| (4) status of data subjects | Are children, patients or vulnerable people included? | Student, patient or elderly records |
| (5) severity and effect of remedies | Can the email be recalled or deleted for certain? | Recipient silent or has already forwarded it |
| (7) storage system and security measures | Was the file encrypted, and the password sent separately? | No encryption, or the password in the same email |
Factor (4) deserves a full reading, because the Notification names the groups that call for extra care. Organisations that routinely send documents about children or patients, such as schools, clinics and insurers, should set stricter internal thresholds.
(4) the nature, type or status of the affected data subjects, including whether and to what extent the affected data subjects comprise minors, persons with disabilities, incompetent persons, quasi-incompetent persons, or vulnerable persons who lack the ability to protect their own rights and interests owing to various limitations;
When might you not need to notify the PDPC Office?
When the controller can prove the breach poses no risk to people's rights and freedoms. Clause 9 gives two illustrations: the data cannot identify anyone, or the data is unusable because adequate technological measures are in place.
if the data controller can prove that such personal data breach does not give rise to a risk of an impact on the rights and freedoms of persons, which includes the case where the personal data involved in such personal data breach is data from which the data subject cannot be identified, or where such personal data is not in a usable state because sufficient technological measures are in place
For a misdirected email, "sufficient technological measures" usually means an encrypted attachment whose password the wrong recipient never received. If the password travelled in the same email, or was something guessable like a birth date, the exemption carries little weight.
| Scenario | Closest PDPC example | Direction |
|---|---|---|
| CSV of 300 customers with phone numbers sent unencrypted to the wrong outside company | Example 9 | Notify the Office; consider notifying individuals |
| Newsletter sent with an open Cc line exposing dozens of addresses | Example 10 | Notify the Office and individuals unless clause 9 can be proved |
| One employee's payslip sent to a colleague inside the company | Example 5 (real leak, small number) | Assess under clause 12; not notifying needs evidence of no risk under clause 9 |
| Strongly encrypted attachment, password sent by SMS to the right person only | Example 10 (encryption caveat) | Clause 9 exemption may be available; keep proof of encryption |
| An employee's medical certificate sent to the wrong person | Example 9 (sensitive data) | High risk: notify the Office and the individual |
What should happen between spotting the mistake and the 72-hour mark?
Clause 5 of the 2022 Notification sets out the order: check the facts, contain the damage, notify the Office, notify the individuals if the risk is high, and prevent a repeat. The 72-hour deadline runs from becoming aware, not from the end of your investigation.
(3) where, upon consideration of the facts under (1), it appears that there are reasonable grounds to believe that a personal data breach has in fact occurred, the data controller shall notify the breach to the Office without delay and within seventy-two hours from becoming aware of it, so far as it is able to do so, except where such breach is unlikely to result in a risk to the rights and freedoms of persons;
- First minutesTry to recall the email if your system allows it, revoke file-sharing links, and ask the recipient to delete and confirm in writing.2022 Notification cl. 5(2)
- Day oneEstablish whose data was in the file, how many people, what kinds of data, and whether other messages in the same batch also went astray.cl. 5(1) · cl. 12
- Within 72 hoursNotify the PDPC Office if there is risk, or record the reasons and evidence if you rely on the exemption.PDPA s.37(4) · cl. 5(3) · cl. 9
- Without delayIf the risk is high, tell the affected people what happened, the remedies, and how they can protect themselves.cl. 5(4) · cl. 10
- After closureReview controls such as address auto-complete defaults, send delays, and attachment encryption.cl. 5(5)
A recipient's confirmation that the file is deleted lowers the risk under factor 12(5). It does not undo the breach. The breach has happened; what changes is the risk level you use to decide who must be told.
In AIPDPA, the breach register includes a helper that matches your incident against the PDPC's ten examples. Enter a misdirected email with data on dozens of people and it points you to example 9 or 10, counts 72 hours from awareness, and asks a named person to confirm each decision, with the history kept.
How do you stop it happening again?
Clause 5(5) asks controllers to review their measures after an incident, weighing risk, resources and feasibility together. The measures below are common practice; the law does not name any particular tool, so scale them to your organisation.
- Switch off or restrict address auto-complete for teams that routinely send personal data, such as payroll and HR.
- Add a short send delay so people have time to hit undo.
- Send newsletters through a system that mails each person individually, never through To or Cc.
- Encrypt attachments that contain personal data and send the password through a different channel.
- Prefer sharing links that verify the recipient and expire on their own over raw attachments.
- Warn users when they send outside the company domain, especially with Excel or CSV files attached.
The last two map directly onto the reasoning in examples 9 and 10: encryption. With reliable encryption, the next misdirected file may still be a breach, but the clause 9 exemption becomes a real option. For the full sequence of the first three days, see the first 72 hours of a data breach.
Frequently asked questions
Do I have to notify the PDPC Office every time one email goes to the wrong person?
Not every time. Section 37(4) of the PDPA exempts breaches with no risk to people's rights and freedoms, but the controller must be able to prove that under clause 9 of the 2022 Notification. In all three wrong-recipient examples in the PDPC Office's guide, the Office said notification was required.
The recipient says they deleted it. Do I still need to notify?
Deletion lowers the risk under factor 12(5) but does not erase the breach. You still assess what the data was, how many people it covered and whether it was encrypted. If risk remains, notify the Office within 72 hours of becoming aware.
How serious is putting customer emails in CC instead of BCC?
Example 10 of the PDPC Office's guide is exactly this case, with 100 recipients, and the Office said to notify both the Office and the individuals because many people were involved, unless the data was encrypted with reliable technology.
Is sending a file to the wrong colleague inside the company a breach?
It can be, if that colleague had no right to see the data. Clause 4(1) speaks of access or disclosure without authority and does not require an outsider. The risk may be lower than an external send, so assess it under clause 12.
When must the affected individuals be told?
When the breach is likely to result in a high risk to their rights and freedoms. Clause 10 requires notice without delay, covering what happened, a contact point, the likely impact and the remedies. If individual contact is impossible, clause 11 allows group or public notice.
Law and sources
- PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) — Clause 3 · Clause 4 (1) · Clause 5 · Clause 9 · Clause 12
- PDPC Office Guide on Breach Risk Assessment and Notification, version 1.0 (15 December 2022) — guidance, not law — Example 5 · Example 9 · Example 10 · Note
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (4)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)