Breach notification when a vendor leaks data is a relay: the processor must tell the data controller under PDPA section 40(2), within 72 hours as the contract must require, and the controller then notifies the PDPC Office and affected people under section 37(4). This guide shows procurement, legal and DPOs who reports to whom, when, and what the contract must say.
- Under PDPA s.40(2) a processor must tell the controller about a breach, with no prior risk assessment.
- Clause 8 of the 2022 Notification makes the controller write a 72-hour reporting duty into the processor contract.
- Notifying the PDPC Office and data subjects is the controller's duty under s.37(4); a vendor may do it on your behalf, but liability stays with you.
- TDPG 4.0 (guidance) treats the controller as aware once the processor reports, so the controller's 72 hours start then.
- Under s.40 paragraph two, a processor that uses data outside your instructions is treated as a controller for that processing.
Hardly any company today keeps all its customer data in-house. Payroll runs on a provider's cloud, the customer base lives in a well-known CRM, and delivery addresses sit with the courier. Each of these vendors holds data for you, and one day the leak may come from their side.
The questions arrive at once: who has to tell whom? Must the vendor report to the PDPC Office itself? Should you wait for its investigation to finish? When does your own 72-hour deadline start? This article answers each link in the chain from the legal texts.
In legal terms, the company that decides why data is collected is the data controller. The vendor acting on its instructions or on its behalf is the data processor. Their breach duties are different, and they are confused more often than anything else in this area.
When a vendor leaks data, whom must it tell first?
The processor must tell the data controller, meaning the company that hired it, not the PDPC Office. This duty comes straight from section 40(2) of the Personal Data Protection Act B.E. 2562 (2019); it does not depend on the contract.
(2) provide appropriate security measures for preventing unauthorized or unlawful loss, access to, use, alteration, correction or disclosure, of Personal Data, and notify the Data Controller of the Personal Data breach that occurred;
Section 40(2) sets no time limit. The time limit comes from clause 8 of the PDPC's 2022 Notification on Criteria and Methods for Notification of Personal Data Breaches, and it is framed as a duty of the controller to put into the contract.
the data controller must stipulate in the agreement or in the relevant contract that the data processor has a duty to notify a personal data breach to the data controller without delay and within seventy-two hours from the time the data processor becomes aware of it, so far as it is able to do so.
In practice, if your vendor contract lacks this clause, the vendor still has to report under section 40(2), but your company is the one out of line with clause 8. Fix the contract before an incident, not after it.
Must the processor assess the risk before reporting?
No. Only the controller weighs how far a breach threatens people's rights and freedoms. The TDPG 4.0 guidelines say plainly that a processor must report every breach. This matters because some vendors like to decide for their clients that an incident is "too small to mention".
Since the law provides that the data processor must notify a personal data breach to the data controller, if the incident that occurred is a personal data breach, the data processor must notify the data controller in every case, without needing to consider the level of risk as the data controller must [31]
Can the vendor notify the PDPC Office for you?
It can act for you if you agree, but the legal duty stays with the controller. Section 37(4) gives the duty to notify the Office and data subjects to the controller alone, and no provision moves it to the processor.
notify the Office of any Personal Data breach without delay and, where feasible, within 72 hours after having become aware of it, unless such Personal Data breach is unlikely to result in a risk to the rights and freedoms of the Persons.
A data processor may notify a data breach on behalf of the data controller, if the data controller has given proper authorization and such action is part of the agreement made between the data controller and the data processor.
The same TDPG passage adds that legal responsibility for notifying remains with the controller. If a vendor promises to notify for you and does it late, your company answers to the Office; the vendor's breach of contract is a separate civil matter.
When does your company's 72-hour deadline start?
TDPG 4.0 item J17 explains that the controller is aware from the moment the processor reports. Your 72 hours to notify the Office therefore start when the vendor tells you, not when the vendor first found the problem.
the data controller shall be deemed to have become aware of the personal data breach from the time the data processor notifies the data controller of that breach incident [55]
Read this way, the gap between the vendor discovering a breach and your notice to the Office could stretch to 72 plus 72 hours. Do not plan around that number. Both clause 8 and section 37(4) put without delay in front of the 72 hours, and TDPG 4.0 item J9 warns that 72 hours is only an outer frame, not a right to wait.
| Link | From → To | Threshold | Timing | Source |
|---|---|---|---|---|
| 1 | Processor → controller | Every breach; no prior risk assessment | Without delay, within 72 hours of the processor's awareness (as the contract must require) | s.40(2) · 2022 Notification cl. 8 · TDPG [31] |
| 2 | Controller → PDPC Office | Every breach unless there is no risk to rights and freedoms | Without delay, within 72 hours of awareness | s.37(4) · cl. 5(3) |
| 3 | Controller → data subjects | High risk, together with remedial measures | Without delay | s.37(4) · cl. 10 |
| — | Processor → Office or data subjects | No statutory duty; may act for the controller if authorised by contract | As agreed | TDPG J9 [37] (guidance) |
How does the PDPC guide treat a vendor incident?
The PDPC Office's guide on breach risk assessment includes example 7, which is exactly this situation: a web hosting provider whose access-check program fails, so customers cannot use the service. The guide is guidance, not law, and has no English version, so the Thai text is quoted below.
แจ้งเหตุแก่สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล: ต้องแจ้งผู้ควบคุมข้อมูลส่วนบุคคล เพื่อให้ผู้ควบคุมข้อมูลส่วนบุคคลแจ้งสำนักงานฯ เนื่องจากมีผลกระทบต่อกลุ่มลูกค้าพอสมควรIn plain English: the vendor must notify the controller so that the controller notifies the Office, because a fair number of customers are affected. The guide does not have the vendor report to the Office itself. Its reasoning adds that if the investigation reveals a cyber attack, the vendor must promptly tell the controller, and the controller must promptly notify both the Office and data subjects.
An outage can be a breach. Clause 4 of the 2022 Notification includes availability breaches, so a vendor who thinks "it was only down, nothing leaked, no need to tell the client" is wrong from the start.
What if the vendor uses your data outside your instructions?
Section 40 paragraph two answers this directly: a processor that does not follow the controller's instructions for a given collection, use or disclosure is treated as the controller for it.
The Data Processor, who fails to comply with (1) for the collection, use, or disclosure of the Personal Data, shall be regarded as the Data Controller for the collection, use, or disclosure of such Personal Data.
Our reading is that, once treated as a controller, the vendor takes on the controller's section 37 duties for that processing, including breach notice. But the hiring company should not lean on this as an escape route: section 37(2) already requires the controller to prevent recipients from using or disclosing data unlawfully in the first place.
What are the penalties for failing to report?
Both sides face administrative fines under Part 2 of Chapter 7 of the PDPA, in separate sections. The processor is liable under section 86 and the controller under section 83.
| Who | Failure | Maximum fine | Section |
|---|---|---|---|
| Processor | Fails to comply with section 40 without appropriate reasons, including not reporting to the controller | THB 3 million | s.86 |
| Controller | Violates or fails to comply with section 37, including not notifying the Office or data subjects | THB 3 million | s.83 |
Any Data Processor who fails to comply with section 40 without appropriate reasons
The words "without appropriate reasons" appear in section 86 but not in section 83 for controllers. That is one more reason a hiring company should not assume it can push all the risk onto its vendor.
What should the vendor contract say about breach reporting?
Section 40 paragraph three already requires the controller to have an agreement with the processor, usually called a DPA (data processing agreement). The list below covers the breach section. Item 1 comes from clause 8 of the 2022 Notification; the rest are our recommendations.
In carrying out the activities in accordance with the Data Processor's obligations as assigned by the Data Controller under paragraph one, the Data Controller shall prepare an agreement between the parties to control the activities carried out by the Data Processor to be in accordance with the Data Processor's obligations for compliance with this Act.
- Report without delay and no later than 72 hours after the vendor becomes aware (mandatory under clause 8). A shorter period is fine.
- Report every breach, without waiting for a risk assessment, because assessment is your job.
- Minimum content matching the four items in clause 6 of the 2022 Notification, so you can pass it to the Office straight away.
- Emergency contacts on both sides, reachable outside office hours, with a duty to update them.
- A duty to follow containment instructions, supporting clause 5(2), which lets the controller instruct the processor.
- Sub-processors must report through the main vendor within the same window.
- No notice to the Office or customers on your behalf unless you authorise it in writing.
- Vendors with many clients report to each client separately, as TDPG 4.0 item J9 recommends.
To find out whether your team is ready, use a vendor leak as the scenario in a half-day breach drill. If customers must be told, continue with the breach letter to data subjects.
Frequently asked questions
Does clause 8 apply to an overseas cloud provider?
Clause 8 is a duty on the controller to put into the contract, so a Thai controller needs it in every vendor contract wherever the vendor sits. If a vendor will not change its standard terms, record your assessment and any compensating measures.
The vendor says it is "still investigating". Are we aware yet?
TDPG 4.0 item J17 treats the controller as aware from the time the processor reports a breach. If the message says an incident has happened, treat the clock as started and log the time you received it. If it is vague, ask in writing immediately.
The vendor never told us and we learned from the news. Are we still liable?
The vendor may have breached section 40(2), but your own section 37(4) duty runs from your awareness, which here is when you saw the news and had enough to believe a breach occurred.
Is a courier that loses our customer list a processor?
If it uses the data on your instructions or on your behalf to deliver goods, it acts as a processor and this article applies. Any use for its own purposes needs a separate role analysis.
If the processor reports after 72 hours, do we get extra time?
No. Your deadline runs from your own awareness and does not shrink or grow with the vendor's delay. The delay is, however, evidence of breach of contract worth keeping.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (2) (4) · Section 40 · Section 83 · Section 86
- PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) — Clause 4 · Clause 5 (2) · Clause 8
- TDPG 4.0 Thailand Data Protection Guidelines, Chapter J on breach management — guidance, not law — TDPG 4.0 Clause J6–J9 · J17 · J53–J54
- PDPC Office Guide on Breach Risk Assessment and Notification, version 1.0 (15 December 2022) — guidance, not law — Example 7
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)