What minimum security measures must a data controller have under the PDPA? The minimum security a data controller needs is set by Section 37(1) of the Personal Data Protection Act B.E. 2562 (2019): it must have appropriate security measures that meet the minimum standard in Clause 4 of the PDPC Notification on Security Measures of Data Controllers B.E. 2565 (2022). In short: organisational and technical measures covering paper and electronic records, least-privilege access control, audit trails and staff awareness, all scaled to risk.
An online shop owner in Bangkok discovers that a sales assistant who quit three months ago can still log in to the customer spreadsheet. Meanwhile, a binder of customers' ID card copies sits on an unlocked shelf behind the counter. He wonders what he could actually show if someone asked to see the shop's security measures today.
What you need to know
The 4 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Section 37(1) requires "appropriate" security measures; the 2022 PDPC Notification sets the minimum standard and has applied since 21 June 2022.
- You need organisational and technical measures, plus physical measures where necessary, chosen according to risk.
- The access minimum has four parts: access control, user access management, defined user responsibilities and audit trails.
- A personal data breach is deemed to trigger a review of your measures unless it poses no risk to people's rights and freedoms.
How to do it in 5 steps
Work through these 5 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Map where personal data livesList every place that holds personal data: paper files, servers, staff laptops, mobile devices, networks, software and applications. Clauses 4(1) and 4(5) of the Notification expect your measures to cover them.
- Rank the risksScore each location by the type of data, why you use it, how likely an incident is and how much harm it would cause, following Clauses 4(2) and 4(3). Higher-risk areas deserve stronger controls.
- Lock down accessGrant access on a need-to-know basis, add and remove users promptly when they change roles or leave, manage privileged accounts separately and review access rights on a schedule, as Clause 4(6)(a) and (b) expect.
- Switch on audit trailsMake sure you can check after the fact who accessed, changed, corrected or deleted personal data, using a method that suits each medium (Clause 4(6)(d)).
- Review and write it into contractsReview the measures when needed, when technology changes and after a risky breach. Consider requiring processors by contract to meet the Clause 4 minimum and to report breaches to you (Clauses 5 and 6).
What does "appropriate security measures" mean under Section 37(1)?
Appropriate measures are those that prevent the loss of personal data and its unauthorised or unlawful access, use, alteration, correction or disclosure, and they must meet the minimum standard set by the Personal Data Protection Committee. That minimum standard is the Notification on Security Measures of Data Controllers B.E. 2565 (2022), in force since 21 June 2022.
The Notification defines security as preserving the confidentiality, integrity and availability of personal data. What counts as appropriate depends on risk, weighed together with technology, context, standards accepted in your type of business, the resources required and feasibility.
What are the minimum requirements in Clause 4 of the 2022 Notification?
Clause 4 of the 2022 Notification lists seven things your security measures must include at a minimum, each scaled to risk, resources and feasibility.
- (1) Cover the collection, use and disclosure of personal data in any form: documents, electronic or otherwise.
- (2) Combine organisational and technical measures, plus physical measures where needed.
- (3) Span the full cycle: identify risks to key information assets, prevent, monitor, respond and recover.
- (4) Preserve confidentiality, integrity and availability in line with the risk.
- (5) For electronic data, protect storage, servers, client devices, networks, software and applications with multiple layers of controls.
- (6) Control access on a least-privilege basis, manage user access, set user responsibilities and keep audit trails.
- (7) Build privacy and security awareness so staff and users know and follow your policies.
When do you have to review your security measures?
Clause 5 of the 2022 Notification requires a review when necessary or when technology changes. When a personal data breach occurs, a review is deemed necessary unless the breach poses no risk to people's rights and freedoms.
Separately, Section 37(4) requires you to notify the PDPC Office of a breach without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach poses no risk to people's rights and freedoms. A good practice is to close every breach file with a documented review of your measures.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Treating security as an IT-only job and forgetting paper files. | ✓ Clause 4(1) covers data in every form, so filing rooms and cabinets belong on your control list. AIPDPA's security controls module gathers controls mapped to PDPC guidance, the ETDA framework and the NCSA standards in one place, and each control names the evidence to keep, so you never start from a blank page. |
| ✗ Former employees still have working accounts. | ✓ Tie access removal to your leaver process and review who has access on a schedule, as Clause 4(6)(b) expects; a good practice is at least once a year. AIPDPA's control list covers user account management and periodic access reviews, and tells you which record an auditor will ask for. |
| ✗ Never checking the website that collects customer data. | ✓ Clause 4(5) extends your measures to software and applications, so test your website against a recognised standard regularly. AIPDPA's website security scan checks your site against the NCSA website security standard and shows what to fix first. |
See every security control in your organisation on one screen
AIPDPA's security controls module maps your measures to PDPC guidance, the ETDA framework and NCSA standards, ready to use. See the demo account, no sign-up needed.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
Do small businesses need PDPA security measures?
Yes. Section 37(1) places this duty on data controllers, and the 2022 Notification lets you scale measures to your risk, resources and feasibility, so a small business can choose controls that fit its size.
How often should we review our security measures?
The Notification sets no fixed interval: it requires a review when necessary, when technology changes and after a breach that carries risk. A good practice is to review at least once a year and keep the record.
Does the Thai PDPA require encryption or ISO 27001 certification?
The 2022 Notification does not name a specific technology or certification. It asks you to consider standards accepted in your type of business, so encryption and recognised standards are practical ways to show your measures match the risk.
We already answer to a sector regulator. Does the Notification still apply?
Yes. Clause 7 says you follow the other law's security duties, but your measures must also meet the Notification's minimum standard.
If we use a cloud provider, who is responsible for security?
You remain responsible as the data controller under Section 37(1). Clause 6 asks you to consider requiring the provider, by agreement, to meet the Clause 4 minimum and to report breaches to you.
Sources
This guide relies on 7 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 37(1)
- Personal Data Protection Act B.E. 2562 (2019), Section 37(4)
- Notification of the Personal Data Protection Committee on Security Measures of Data Controllers B.E. 2565 (2022), Clause 3
- Notification of the Personal Data Protection Committee on Security Measures of Data Controllers B.E. 2565 (2022), Clause 4
- Notification of the Personal Data Protection Committee on Security Measures of Data Controllers B.E. 2565 (2022), Clause 5
- Notification of the Personal Data Protection Committee on Security Measures of Data Controllers B.E. 2565 (2022), Clause 6
- Notification of the Personal Data Protection Committee on Security Measures of Data Controllers B.E. 2565 (2022), Clause 7
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
PDPC, ETDA and NCSA requirements in one place — do the work once, evidence several standards.
Join the waitlist →Scan your sites against the NCSA website security standard and get certificate-expiry alerts.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.