How to Notify a Personal Data Breach in Thailand within 72 Hours If there are reasonable grounds to believe a personal data breach has occurred, the data controller must notify the Office of the Personal Data Protection Committee (PDPC Office) without delay and within 72 hours of becoming aware of it, under Section 37(4) of the Personal Data Protection Act B.E. 2562 (2019), unless the breach poses no risk to people's rights and freedoms. Where the risk is high, affected data subjects must also be told without delay, together with remedial measures.
On a Saturday morning, the manager of an online store finds that a file of customer names, addresses and phone numbers has been sitting behind a public download link. The team spends the whole day debating who to tell, how to tell them, and when the 72-hour clock actually started.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Notify the PDPC Office without delay and within 72 hours of becoming aware, unless the breach poses no risk to people's rights and freedoms.
- If the risk is high, also notify affected data subjects without delay, with remedial measures.
- If necessary reasons push you past 72 hours, you can ask the PDPC Office to waive the offence, but you must notify within 15 days of becoming aware.
- Processor contracts must require the processor to notify you within 72 hours of the processor becoming aware.
- The electronic channel for notifying the PDPC Office is email to saraban@pdpc.or.th, under a 2025 PDPC Office notification.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Log when you became awareRecord the date and time the breach was first reported or discovered, whether orally, in writing or electronically, because the 72 hours run from awareness.
- Check the facts and contain itAssess how credible the report is and review your security measures without delay. If the risk is high, stop or limit the breach immediately, yourself or through your processor (Clause 5(1) and (2) of the 2022 Notification).
- Assess the risk levelWeigh the 8 factors in Clause 12, such as the type and volume of data, how severe the impact could be, and whether minors, people with disabilities or other vulnerable persons are affected.
- Notify the PDPC Office within 72 hoursSend a written notice covering the 4 essentials in Clause 6, as far as you know them at that point, by email to saraban@pdpc.or.th.
- Tell data subjects if the risk is highNotify them without delay under Clause 10, with remedial measures and advice on what they can do themselves. If individuals cannot be reached, Clause 11 allows group or public notice.
- Fix, recover and reviewContain, remedy and recover from the breach, then review your security measures to prevent a repeat (Clause 5(5)), keeping evidence of every step.
What must the notice to the PDPC Office include, and where do you send it?
Clause 6 of the PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) requires a written or electronic notice covering the following four essentials, as far as you are able to provide them.
A 2025 PDPC Office notification, which replaced the 2023 version, sets the electronic channel: email saraban@pdpc.or.th, with a subject line in the prescribed Thai format, [การแจ้งเหตุการละเมิดข้อมูลส่วนบุคคล], followed by the data controller's name.
- The nature and type of the breach, which may include the number of data subjects or records involved
- The name and contact details of the Data Protection Officer (DPO) or a designated coordinator
- The likely impact of the breach
- Measures taken or planned to prevent, stop or fix the breach or remedy the damage
What if you cannot notify within 72 hours?
Clause 7 lets a data controller ask the PDPC Office to waive the offence of late notification where there are necessary reasons, such as preliminary fact-checking or containment work. You must explain the reasons and notify as soon as possible, and no later than 15 days from becoming aware.
If the PDPC Office accepts the reasons, the controller is treated as exempt from the Section 37(4) deadline. Notifying the PDPC Office does not, however, remove duties or liability under sector-specific or other laws.
When do you not have to notify the PDPC Office?
Only when the breach poses no risk to people's rights and freedoms, and the data controller has to prove it. Clause 9 gives examples: data that cannot identify anyone, or data rendered unusable by adequate technological measures.
A data controller relying on this exception must give the PDPC Office information, documents or evidence supporting it, including details of its security measures.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Waiting for the full investigation before notifying, and missing the 72 hours. | ✓ Clause 6 asks for the essentials as far as you are able, so a good practice is to send a first notice on time and follow up as facts emerge. AIPDPA's breach register shows a 72-hour countdown clock and generates the PDPC Office letter from what you have logged. |
| ✗ Vendor contracts say nothing about breach notification. | ✓ Clause 8 requires your contracts to oblige processors to notify you within 72 hours of becoming aware. Work through every vendor in AIPDPA's vendor register and use its ready-to-use data processing agreement (DPA) as your baseline. |
| ✗ Deciding 'no need to notify' with nothing in writing. | ✓ Record your assessment against the Clause 12 factors and keep evidence such as encryption details. The risk assessment in AIPDPA's breach register keeps the reasoning behind each decision, ready to show the PDPC Office. |
Be ready for the 72-hour clock before a breach happens
AIPDPA's breach register gives you a 72-hour countdown clock, a structured risk assessment and ready-to-use letters to the PDPC Office and to data subjects. See the demo account, no sign-up needed.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
How many hours do I have to report a data breach in Thailand?
72 hours. Notify the PDPC Office without delay and within 72 hours of becoming aware, so far as possible, under Section 37(4) and Clause 5(3) of the 2022 Notification, unless the breach poses no risk to people's rights and freedoms.
Can I still notify the PDPC Office after 72 hours?
Yes. If necessary reasons caused the delay, notify with an explanation and ask the PDPC Office to waive the offence. Under Clause 7 of the 2022 Notification, this must be done as soon as possible and within 15 days of becoming aware.
Do I need to report a breach of encrypted data?
Possibly not, if you can prove the breach poses no risk to people's rights and freedoms. Clause 9 of the 2022 Notification cites data made unusable by adequate technological measures as an example, but you must give the PDPC Office the evidence.
Who reports the breach if our vendor caused it?
You do, as the data controller: Clause 4 of the 2022 Notification covers breaches caused by your processors. Clause 8 also requires your contract to oblige the processor to notify you within 72 hours of becoming aware.
What if we cannot contact every affected person?
Clause 11 of the 2022 Notification allows notice to groups, or a general notice through public media, social media or other electronic channels that affected people can access, provided the notice itself causes them no harm.
Sources
This guide relies on 3 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 37(4)
- PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022), Clauses 4–12
- PDPC Office Notification on Electronic Channels for Personal Data Breach Notification by Data Controllers B.E. 2568 (2025), Clause 2
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
A 72-hour countdown starts the moment you log an incident, with a risk assessment and ready-to-send letters to the PDPC Office and data subjects.
Join the waitlist →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Join the waitlist →Know who processes data for you, how risky they are and whether the contract is in place.
Join the waitlist →A professional DPO on retainer, without a full-time hire.
See plans →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.