A single security checklist for both PDPC and NCSA rules means one set of controls that covers two notifications built on the same confidentiality, integrity and availability principles and the same five stages. The PDPC notification applies to every data controller; the NCSA one binds state agencies, regulators and CII. This is for DPOs and IT teams, showing where the two overlap and differ.
- The 2022 PDPC notification binds every data controller; the 2023 NCSA notifications bind state agencies, regulators and CII.
- Both use confidentiality, integrity and availability and the same five stages: identify, protect, detect, respond, recover.
- NCSA rates C, I and A as low, medium or high; a system with mixed data takes the highest level and is reviewed at least every 3 years.
- The PDPC is more explicit on paper records, audit trails and reviewing measures after every risky breach.
- Clause 7 of the PDPC notification: compliance with another law's security rules must still meet the PDPC minimum.
IT teams at companies serving Thai government clients often get two requests in the same month. The DPO wants evidence of compliance with the PDPC's security measures notification. The client wants a questionnaire filled in against the NCSA minimum standard.
Done separately, that produces two piles of paper that overlap by more than half. This article puts three notifications side by side, shows where they ask for the same thing and where they differ, and merges them into one checklist that answers both.
"agency" means a State agency, a regulatory or supervisory agency, and a critical information infrastructure organisation.
A private company that is not CII is therefore not directly bound by the NCSA notifications. But Clause 4(4) of the PDPC notification asks controllers to consider standards accepted for businesses of the same or similar type. Borrowing the NCSA structure is a sensible move, especially for companies already serving government or CII clients.
Do the two regulators define security the same way?
In substance, yes. Both rest on confidentiality, integrity and availability, the CIA triad IT teams already know. The PDPC notification puts it this way:
"Security" means the maintenance of confidentiality, integrity and availability of personal data, in order to prevent loss, access, use, alteration, correction or disclosure of personal data without authority or unlawfully.
"cybersecurity control measures" means measures established in order to maintain the confidentiality, the integrity, and the availability of information or information systems.
The difference is scope. The PDPC looks only at personal data. The NCSA looks at all of an agency's data and information systems. A system with no personal data at all, such as a production control system, sits outside the PDPC notification but squarely inside the NCSA's view if its owner is an agency as defined.
Is our system low, medium or high impact?
On the NCSA side, classification always comes first. The 2023 Notification on the Standard for Determining Cybersecurity Characteristics of Data or Information Systems has you rate the impact for each security objective separately, on three levels.
| Objective | Event measured | Low | Medium | High |
|---|---|---|---|---|
| Confidentiality (Clause 7) | Unauthorised disclosure, in whole or in part | Limited or negligible adverse effect | Serious adverse effect | Severe or catastrophic adverse effect |
| Integrity (Clause 8) | Unauthorised modification or destruction | Limited or negligible adverse effect | Serious adverse effect | Severe or catastrophic adverse effect |
| Availability (Clause 9) | Inability to access or use the data or system | Limited or negligible adverse effect | Serious adverse effect | Severe or catastrophic adverse effect |
Effect is weighed across the four areas in Clause 6: financial, asset or reputational damage; the number of people who may be harmed; the agency's ability to perform its functions; and national security and public order. For CII, the regulator sets the assessment guidance. Clause 4 paragraph two adds that data already made public need not be rated for confidentiality.
The rule IT teams most often miss is Clause 10. A system usually holds several data categories, and it takes the highest level for each objective.
(2) determine the cybersecurity characteristics of the information system by using, for each cybersecurity objective under clause 4, the impact level of the data category with the highest impact level.
Suppose a CRM holds an ordinary customer list plus health-check results for some customers. If leaking the health results would be severe, the whole system is high for confidentiality, even though most records are just names and phone numbers. One way out is to move the sensitive data to a separate system rather than raising controls for everything.
An agency shall review the determination of cybersecurity characteristics for data or information systems at least every 3 years, or review it when the data, information system, or the agency's functions change significantly, and shall record the review outcome together with the reasons for retaining, or amending, the potential impact level of each cybersecurity objective under clause 4.
What controls does each level require?
Clause 4 of the 2023 minimum standard answers cumulatively. Low has ten headings, medium adds three, and high adds four more. Every heading points back to the Cybersecurity Regulating Committee's 2021 Code of Practice and Standards Framework.
(2) Where the information or information system has cybersecurity characteristics at the medium level, minimum cybersecurity control measures for the information or information system shall be established under the following headings: (a) comply with paragraph (1); (b) Cybersecurity Audit Plan; (c) Remote Connection; (d) Removable Storage Media.
- Low (Clause 4(1)): cybersecurity risk assessment, incident response plan, asset management, risk assessment and risk management strategy, access control, system hardening, awareness, threat detection and monitoring, crisis communication plan, and cybersecurity exercises.
- Medium (Clause 4(2)): everything at low, plus an audit plan, remote connection and removable storage media.
- High (Clause 4(3)): everything at medium, plus vulnerability assessment and penetration testing, third-party management, information sharing, and resilience and recovery.
Where do the PDPC and the NCSA ask for the same thing?
Right down to the skeleton. Clause 4(3) of the PDPC notification walks through five stages of security work, in the same order as the five parts of the NCSA framework: identify, protect, detect, respond and recover.
(3) Such security measures must take into account the conduct of security-related actions, from the identification of significant risks that may arise in relation to significant information assets, the prevention of significant risks that may arise, the inspection and monitoring of threats and personal data breaches, the response when a threat or a personal data breach is detected, and also the remediation and recovery of damage arising from a threat or a personal data breach
| Topic | PDPC 2022 | NCSA minimum standard 2023 |
|---|---|---|
| Confidentiality, integrity, availability | Clause 3 and Clause 4(4) | Clause 3, and Clause 4 of the classification notification |
| Five stages from identify to recover | Clause 4(3) | Five parts of the annexed table |
| Access control, authentication, least privilege | Clause 4(6)(a) and (b) | Heading 2.1, all levels |
| Staff awareness | Clause 4(7) | Heading 2.5, all levels |
| Controls scaled to risk or impact | Clauses 4(2), (4), (5), (6): appropriate to the level of risk | Low, medium and high under Clause 4 |
| Controlling third parties with data access | Clause 6: agreement with data processors | Heading 1.4, third-party management (high) |
Where do they differ, and what gets missed?
They differ in drafting style. The NCSA gives fixed headings per level; the PDPC sets principles to be applied appropriately to the level of risk. Yet on some points the PDPC is more specific, and those are exactly the points an IT team working only from the NCSA list tends to miss.
What the PDPC spells out but the NCSA table has no heading for
- Paper records. Clause 4(1) covers personal data whether in documents, electronic form or any other form. A cabinet of job applications needs controls too.
- Physical measures. Clause 4(2) says measures may include necessary physical measures.
- Defence in depth. Clause 4(5) covers storage, servers, clients, networks, software and applications in multiple layers.
- User responsibilities. Clause 4(6)(c) includes preventing unauthorised copying and theft of devices.
- Audit trails. Clause 4(6)(d), quoted below.
(d) The provision of methods enabling retrospective verification concerning access to, alteration, correction or deletion of personal data (audit trails), appropriate to the methods and media used in the collection, use or disclosure of personal data.
What the NCSA names but the PDPC does not
The minimum-standard table includes headings the PDPC notification never names: system hardening, crisis communication, exercises, remote connection, removable media, an audit plan, vulnerability assessment and penetration testing, and information sharing. For a private controller, these headings make it much easier to explain concretely why its measures are appropriate.
The review cycles are not the same
The NCSA requires the classification to be reviewed at least every 3 years under Clause 11. The PDPC's Clause 5 paragraph one requires review when necessary or when technology changes, and paragraph two adds a very clear trigger:
When a personal data breach occurs, it shall be deemed that the data controller has a necessity to review the security measures under paragraph one, except where such breach is unlikely to result in a risk to the rights and freedoms of persons.
In practice, every breach that carries risk should close with a recorded review of security measures, not just a notification to the PDPC Office. The encryption cases in the PDPC's 10 breach examples show which measures actually reduce risk.
In the case where a data controller has a duty under other laws to provide appropriate security measures in order to prevent loss, access, use, alteration, correction or disclosure of personal data without authority or unlawfully, the data controller shall proceed in accordance with those laws; however, such security measures of the data controller must also comply with the minimum standards prescribed in this Notification.
The root of it all is Section 37(1) of the PDPA, which the 2022 PDPC notification fleshes out:
(1) provide appropriate security measures for preventing the unauthorized or unlawful loss, access to, use, alteration, correction or disclosure of Personal Data, and such measures must be reviewed when it is necessary, or when the technology has changed in order to efficiently maintain the appropriate security and safety. It shall also be in accordance with the minimum standard specified and announced by the Committee;
The combined checklist: one table for both regulators
This table puts both sides on the same row. The NCSA column shows the level from which a heading becomes mandatory. The last column lists evidence worth keeping; that is our practical suggestion, not text from either notification.
| Topic | PDPC 2022 | NCSA 2023 (mandatory from) | Evidence to keep |
|---|---|---|---|
| Classify data and systems | Clause 4(4): CIA according to risk | Classification notification Clauses 4 to 10 (do this first) | System register with C/I/A levels, reasons and review date |
| Information asset register | Clause 4(3): identify risks to significant information assets | 1.1 Asset management (low) | List of systems, devices and personal data stores |
| Risk assessment | Clause 4(2) and (3) | Element 2 and 1.2 (low) | Risk assessment report and treatment plan |
| Access control and authentication | Clause 4(6)(a) | 2.1 Access control (low) | Least-privilege access policy |
| User account management, reviews and removal | Clause 4(6)(b) | No separate heading in the table | Periodic access reviews and leaver account closures |
| User duties, copying and device theft | Clause 4(6)(c) | 2.4 Removable storage media (medium) | Acceptable use agreement and removable media policy |
| Audit trails | Clause 4(6)(d) | No separate heading in the table | Logs of access, changes and deletion of personal data |
| System hardening and defence in depth | Clause 4(5) | 2.2 System hardening (low) | Secure baselines, patch cycle, website scan results |
| Remote connection | Within Clause 4(5), network systems | 2.3 Remote connection (medium) | Who connects from outside, and how |
| Staff awareness | Clause 4(7) | 2.5 Awareness (low) | Training records and notices of revised policies |
| Threat monitoring | Clause 4(3): inspection and monitoring | 3.1 (low) | Alerting and a named person who watches it |
| Incident response plan | Clause 4(3): response | Element 3 and 4.1 (low) | A plan with reporting channels to both the PDPC Office and the NCSA |
| Crisis communication plan | Not named | 4.2 (low) | Prepared messages for customers and media |
| Exercises | Not named | 4.3 (low) | Drill records and lessons learned |
| Audit plan | Clause 5: review when necessary | Element 1 (medium) | Annual audit plan and findings |
| Vulnerability assessment and penetration testing | Not named | 1.3 (high) | Test reports and remediation |
| Third-party providers | Clause 6: agreements with processors | 1.4 (high) | Contracts with security and breach-notice terms |
| Threat information sharing | Not named | 2.6 (high) | Channels for sending and receiving threat information |
| Resilience and recovery | Clause 4(3): remediation and recovery | 5.1 (high) | Backup restore test results |
| Paper records and physical measures | Clause 4(1) and (2) | No separate heading in the table | Locked cabinets, record rooms and shredding procedure |
| Review of measures | Clause 5, including after every risky breach | Classification notification Clause 11: every 3 years | Review records with reasons |
For a private controller that is not an agency under the NCSA definition, a sensible approach is to complete every row carrying a PDPC clause first, then use the NCSA level column to decide which systems deserve stronger controls, such as those holding large volumes of sensitive data.
Where can we start this week?
- List your systems that store or use personal data, including filing cabinets and cloud folders.
- Rate C, I and A for each system under Clauses 7 to 9, taking the highest level under Clause 10 where data is mixed.
- Check the all-levels rows first: access control, awareness, incident response and exercises.
- Switch on logging of access to and changes of personal data, since the PDPC names it directly.
- Go through your processor contracts for minimum security and breach-notice duties under Clause 6.
- Set review dates: after every breach, and at least every 3 years for classification.
The outside of your website is the quickest place to check. The free website scan looks at TLS, the certificate, HSTS, security headers, cookie flags and DNSSEC, all part of hardening. For the rest of the table, AIPDPA's control register is already mapped to PDPC, ETDA and NCSA clauses, so your team ticks once and sees how many rulebooks it answers. If you might be CII, read is your company critical information infrastructure?
Frequently asked questions
Must a private company follow the NCSA minimum standard?
The National Cyber Security Committee's 2023 notification on minimum standards defines the bodies it binds as state agencies, regulatory or supervisory agencies and critical information infrastructure organisations. An ordinary private company is not directly bound, but must still follow the PDPC's 2022 security notification as a data controller.
How do you classify a system holding several types of data?
Clause 10 of the NCSA's 2023 classification notification requires each data category to be rated first, then the system takes the highest impact level for each of confidentiality, integrity and availability.
What controls does a low-impact system need?
Clause 4(1) of the minimum standard lists ten headings: risk assessment, incident response plan, asset management, risk management strategy, access control, system hardening, awareness, threat detection and monitoring, crisis communication and exercises.
Does the PDPC's 2022 notification require audit logs?
Clause 4(6)(d) requires methods enabling retrospective verification of access to, alteration, correction or deletion of personal data (audit trails), appropriate to the methods and media used and to the level of risk.
If we already follow our sector regulator's security rules, do we still need the PDPC notification?
Yes. Clause 7 of the PDPC's 2022 notification says a controller with security duties under another law follows that law, but its measures must also meet the PDPC minimum standard.
Law and sources
- PDPC Notification on Security Measures of Data Controllers, B.E. 2565 (2022) — Clause 3 – Clause 7
- National Cyber Security Committee Notification on Minimum Standards for Information or Information Systems, B.E. 2566 (2023) — Clause 3 · Clause 4
- National Cyber Security Committee Notification on the Standard for Determining Cybersecurity Characteristics of Data or Information Systems, B.E. 2566 (2023) — Clause 4 – Clause 11
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (1)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)