Data breaches articles
Data breaches articles are 7 AIPDPA pieces that quote Thai law word for word and say what organisations must do. They suit DPOs, legal teams and business owners, who get answers with the legal text and links to read further.
Data breaches
Data breachesCCTV Footage Leaked? What to Do in the First 72 Hours
When footage leaks or a camera system is broken into, the 72-hour clock runs from the moment you become aware, not from the moment it happened. The order of work, and which parts are law and which are only NCSA recommendations.
Data breachesA Data Leak at 2 a.m.: The First 72 Hours, Hour by Hour, Under Three Thai Laws
The clock starts when you become aware, not when the investigation ends. An hour-by-hour playbook that puts the PDPA, the 2022 breach notification, the Computer-Related Crime Act and the Cybersecurity Act on one timeline.
Data breachesWhat the Breach Letter to Affected People Must Say
The PDPC Office reads your regulatory notice with a trained eye. Your customers read their letter while wondering whether their bank account is safe. Clause 10 of the 2022 Notification sets four things you must tell them; the rest is the craft of writing so people know what to do next.
Data breachesA Half-Day Data Breach Drill for the Whole Company
Response plans that have never been rehearsed tend to fail at the very first question: when did the company actually become aware? Here is a four-hour drill script, scenarios adapted from the PDPC Office's own examples, and scoring tied to the legal deadlines.
Data breachesSent an Email or File to the Wrong Person? When Thai Law Says You Must Report It
A payroll file sent to the wrong address, a hundred customers exposed in the CC line, an invoice delivered to a stranger. No hacker is involved, yet each one is a personal data breach under Thailand's 2022 breach notification rules. The PDPC Office has already assessed three such cases, and its answers are stricter than many firms expect.
Data breaches10 Breaches the PDPC Has Already Assessed: How Far Does Encryption Get You?
A lost encrypted USB stick needs no notification. Ransomware with no backup must be reported to both the PDPC Office and data subjects. The difference lies in three words in Clause 4 of the 2022 Notification: confidentiality, integrity and availability.
Data breachesWhen a Vendor Leaks Your Data: Who Must Notify Whom, and How Fast
Payroll platforms, cloud CRMs, delivery firms: every vendor that holds customer data for you is a data processor. When the leak happens on their side, Thai law sets out the notice duties link by link, and the main liability stays with the company that hired them.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)