ThailandPersonal Data Protection Act, breach notification
Personal Data Protection Act B.E. 2562 (2019), Section 37(4)
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- none
What it requires
- An app that experiences a personal data breach affecting an individual in Thailand must notify the Personal Data Protection Committee's Office without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk to the affected individuals; where the breach is likely to cause high risk, the app must also notify each affected individual without delay.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Committee of Thailand, through its Notification on criteria and procedures for personal data breach notification B.E. 2565 (2022), made under Sections 16(4) and 37(4) of the Act and hosted by the Ministry of Digital Economy and Society (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The page is the Committee's own notification made under Sections 16(4) and 37(4) of the Act, so it sets rules for the duty rather than advising on it.
- As of
- Guidance link
- https://www.mdes.go.th/law/detail/6336
- Guidance body
- Personal Data Protection Committee of Thailand, through its Notification on criteria and procedures for personal data breach notification B.E. 2565 (2022), made under Sections 16(4) and 37(4) of the Act and hosted by the Ministry of Digital Economy and Society
- Open questions
- Does 'ทราบเหตุ' ("becoming aware of the incident"), from which Article 5(3) of the Notification counts the 72 hours, start when the controller first receives information under 'ได้รับแจ้งข้อมูลในเบื้องต้น' ("receives preliminary information"), or only once the controller concludes there is 'เหตุอันควรเชื่อ' ("reasonable cause to believe") that a breach occurred?
- Must a controller that concludes a breach carries 'ไม่มีความเสี่ยง' ("no risk") to individuals still notify the Office so the Office can weigh the exemption, given that Article 9 says the controller may raise the exemption 'เพื่อประกอบการพิจารณา' ("for consideration") if it 'พิสูจน์ได้' ("can prove") the absence of risk?
What it makes you log
Logging duty
Section 37(4) makes the controller notify the Office without delay and where feasible within 72 hours of learning of a breach, unless the breach is unlikely to risk persons' rights and freedoms, and tell the data subject as well where the risk is high. It is a duty to notify, and it names no record the controller must keep of breaches. The section 39 records are not cited by this row.
- Kind
- None
- As of
What this law does
The Data Controller must notify the Office of any personal data breach without delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of the affected individuals. Where the breach is likely to cause high risk, the Data Controller must also notify the data subject without delay, together with remedial measures.
This section number is inferred from a cross-reference in the retention clause rather than confirmed against its own article heading directly.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .