Educational Information Only — Not Legal Advice

    This site provides educational information only and is not a substitute for professional legal advice. Consult a qualified Thai lawyer for personalized guidance. Laws may change. Full DisclaimerPrivacy Policy

    Skip to main content
    Thai LawKNOWLEDGE AUTHORITY
    Last updated:
    Share:

    Educational Information Only

    The content on this page is for general educational purposes and does not constitute legal advice. Every legal situation is unique. For matters involving investigation, arrest, litigation, or formal proceedings, consult a qualified legal professional.

    Data Protection
    moderate offence

    Failure to Notify Data Breach in Thailand

    Failing to notify the PDPC and affected individuals of a personal data breach within 72 hours.

    Last updated: February 2026
    Legal Sections

    PDPA Section 37(4), PDPA Section 90

    Maximum Penalty

    THB 3,000,000 administrative fine

    Severity Level

    moderate

    Definition

    Failing to notify the PDPC and affected individuals of a personal data breach within 72 hours. Under Thai law, this offence is classified as a moderate offence within the category of Data Protection.

    Elements of the Offence

    For a conviction, the prosecution must prove all of the following elements beyond reasonable doubt:

    1

    Personal data breach occurred

    2

    Risk to rights and freedoms of data subjects

    3

    Failure to notify within 72 hours

    Penalties

    Maximum Penalty

    THB 3,000,000 administrative fine

    Actual sentences depend on factors including the severity of the conduct, harm caused, prior convictions, and mitigating circumstances. Courts have discretion to impose lesser sentences within the statutory range.

    Possible Defences

    The following defences may be available depending on the circumstances:

    Breach did not pose risk to data subjects

    Notification was made within required timeframe

    Appropriate safeguards rendered data unintelligible

    Note: The availability of defences depends on specific facts. Professional legal advice is essential.

    For Foreigners

    Special Considerations for Foreign Nationals

    International companies must have breach notification procedures covering their Thai data processing operations.

    When Legal Representation Matters

    If you are accused of failure to notify data breach or facing investigation, immediate legal representation is essential to protect your rights and build an effective defence.

    Anglo Siam Legal provides experienced legal services across Thailand for both Thai nationals and foreigners.

    feedback.wasThisHelpful