Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 28 DECEMBER 2022

Thailand PDPC Notification On Data Breaches

Tilleke & Gibbins
Tilleke & Gibbins
Contributor
Tilleke & Gibbins

Tilleke & Gibbins

Tilleke & Gibbins has been present in Vietnam since 1992, when it became the first foreign law firm...

View firm profile
Explore more from Tilleke & Gibbins

On December 15, 2022, Thailand's Personal Data Protection Committee (PDPC) issued the Notification on the Criteria and Procedures for Handling Personal Data Breaches.

ThailandPrivacy
Nopparat Lalitkomon
Nopparat Lalitkomon
Athistha (Nop) Chitranukroh
Athistha (Nop) Chitranukroh
Suruswadee Jaimsuwan
Suruswadee Jaimsuwan
Pemika Pongmekin
Pemika Pongmekin
Author LinkedIn connections

On December 15, 2022, Thailand's Personal Data Protection Committee (PDPC) issued the Notification on the Criteria and Procedures for Handling Personal Data Breaches.

What Constitutes a "Data Breach"?

A "personal data breach" refers to a breach of security measures that causes unlawful or unauthorized loss, access, use, modification, or disclosure of personal data, resulting from an intentional, willful, negligent, accidental, unauthorized, or unlawful act, or an act related to computer crimes, cyber threats, mistakes or accidents, or any other act. The notification also classifies personal data breaches into three categories: confidentiality breach, integrity breach, and availability breach.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Thailand Releases New Draft PDPA Guidance On Lawful Bases And Marketing

Thailand's data protection regulator has published draft guidance on lawful bases for processing personal data and marketing practices under the PDPA. The guidance introduces a five-step process for selecting lawful bases, emphasizes separating marketing consent from core services, and addresses AI-driven marketing transparency. Organizations processing personal data in Thailand face new expectations around accountability, consent management, and documentation of compliance efforts.
ThailandPrivacy
Tilleke & Gibbins
Tilleke & Gibbins
Article

Thailand Proposes Significant Amendments To The Personal Data Protection Act

Thailand's Personal Data Protection Act faces significant amendments that could reshape how government agencies and private organizations handle personal data. The proposed changes introduce new exemptions for anticorruption operations, clarify which entities qualify as government agencies, and fundamentally restructure the legal framework for data processing to align with international standards like the GDPR. These modifications would shift consent from a default requirement to one of seven equal lawful b
ThailandPrivacy
Tilleke & Gibbins
Tilleke & Gibbins
Article

Vietnam’s New Forced-Labor Import Ban: How Should Businesses Respond?

Vietnam has introduced a new prohibition on importing goods produced through forced labor under Decree No. 292/2026/ND-CP, effective September 5, 2026. While the Ministry of Home Affairs has yet to publish implementing guidance, businesses face immediate legal exposure and must establish internal controls, supply-chain safeguards, and remediation procedures to manage forced-labor risks across their operations and commercial relationships.
VietnamInternational Law
Tilleke & Gibbins
Tilleke & Gibbins
Article

Vietnam’s New Drug Registration Regulations To Reduce Administrative Burden

Vietnam's Ministry of Health has issued Circular No. 32/2026/TT-BYT, introducing significant reforms to the drug registration process that will take effect on October 1, 2026. The new regulations establish a five-year data exclusivity period for new drugs, simplify requirements for foreign legal documents, and introduce a re-examination pathway that could reduce administrative burdens for pharmaceutical companies.
VietnamFood, Drugs, Healthcare, Life Sciences
Tilleke & Gibbins
Tilleke & Gibbins
Article

Thailand Releases New Draft PDPA Guidance On Lawful Bases And Marketing

Thailand's data protection regulator has published draft guidance on lawful bases for processing personal data and marketing practices under the PDPA. The guidance introduces a five-step process for selecting lawful bases, emphasizes separating marketing consent from core services, and addresses AI-driven marketing transparency. Organizations processing personal data in Thailand face new expectations around accountability, consent management, and documentation of compliance efforts.
ThailandPrivacy
Tilleke & Gibbins
Tilleke & Gibbins