THAILAND Law and Practice Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
Proactive investigations triggered by “signals” (dark web + social media), not just formal complaints In January 2025, PDPC action in relation to an alleged breach followed a post advertising data for sale on the dark web, with the organisation instructed to inves - tigate and report within 72 hours; the PDPC also described the role of its Eagle Eye unit in monitor - ing online sources (including the dark web and social platforms). Regulator communications and reputational pressure via public channels In April 2025, the PDPC publicly confirmed an investi - gation into a major company’s incident and indicated that it would require a detailed internal report (covering scope, root cause, impacts and risk assessment). The report was announced via PDPC’s Facebook page, signalling that enforcement risk can quickly become a public-facing issue. Biometric data enforcement: suspension and deletion orders (Worldcoin/iris scanning) On 24 November 2025, Thai authorities stated that the PDPC ordered relevant service providers/entities to suspend iris scanning and delete/destroy iris and personal data already collected. This action reflected heightened expectations for biometric processing (consent quality, necessity and security). Practical Takeaways for Organisations The last 24 months show that the PDPC is prioritising the following aspects (in practice). • Security controls as the first line requirement (access controls, password practices, monitoring, periodic reviews/risk assessments). • Breach response maturity being treated as equally important as prevention – prompt triage, docu - mented risk assessment, timely notification and remediation. • DPO and governance not treated as mere “paper - work” – absence or ineffectiveness treated as a serious aggravating factor. • Processor governance as an enforceable obliga - tion: due diligence, clear DPAs, oversight and ensuring processors can detect/notify/contain incidents.
• Healthcare/records handling and destruction as high-sensitivity areas – physical records and ven - dors remaining in scope. • Proactive scrutiny if a leak becomes visible on the dark web or social media – the PDPC demands rapid clarification and evidence. • Biometrics (eg, iris scans) attracting a heightened enforcement posture, including suspension and deletion orders. In addition to enforcement under the PDPA, Thailand strengthened criminal enforcement through the Emer - gency Decree on Measures for the Prevention and Suppression of Technology Crimes (No 2) B.E. 2568 (2025) (effective from 13 April 2025). This decree intro - duces specific criminal offences targeting the misuse of personal data (including data relating to deceased persons) in connection with technology crimes. Where a person collects, possesses or discloses such data with intent to enable criminal activity, the penalty is imprisonment for up to one year and/or a fine of up to THB100,000. Where the conduct involves a commer - cial/exploitative element (eg, buying, selling, exchang - ing or unlawfully profiting from the data), the penalty increases to imprisonment for up to five years and/or a fine of up to THB500,000. As described in 1.8 Enforcement Proceedings and Fines , the PDPA grants the expert committee enforce - ment powers to issue administrative orders to address any misconduct under the PDPA. However, most cas - es have been discharged or have ceased at the expert committee stage, and there are no publicly available high court cases in Thailand regarding personal data. In addition to the powers of the expert committee, the PDPA provides for three types of liability: • criminal liability; • administrative liability; and • civil liability. 2. Privacy Litigation 2.1 Privacy Litigation Overview For criminal liability, the authority may pursue crimi - nal proceedings against any commercial operator that
498 CHAMBERS.COM
Powered by FlippingBook