THAILAND Trends and Developments Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
PDPC imposed penalties on both the data controller and a data processor involved in the processing activ - ities, reinforcing that accountability under the PDPA is not confined to the most visible brand name in the processing chain. What the five cases indicate regulators care about most As reflected in public reporting, the five cases from 2025 provide a practical “compliance map” of regula - tory priorities. Case 1 – state agency online services (cyber-attack and dark web leakage) A cyber-attack against a state agency’s web appli - cation reportedly resulted in the leakage of personal data relating to approximately 200,000 data subjects. The PDPC’s findings pointed to fundamental security deficiencies, including weak password controls, the absence of a formal risk assessment, and a failure to conduct regular reviews and update security meas - ures. The regulator also identified a governance lapse – namely, the absence of a data processing agreement with the software developer acting as a data proces - sor. As a result, the PDPC imposed administrative fines of THB153,120 on both the state agency and the developer. Although the monetary penalties imposed on the public sector entity were relatively modest compared with those more commonly imposed on private sector organisations, this case is significant in underscoring the PDPC’s position that state agencies are subject to the PDPA and its enforcement regime on an equal footing. Importantly, the decision also clarifies that being the victim of a cyber-attack does not, in itself, amount to wrongdoing. However, where an organisa - tion fails to implement appropriate and proportionate security and governance measures, it may still be held accountable as a wrongdoer under the PDPA, not - withstanding the involvement of third-party attackers. Case 2 – private hospital (outsourced document destruction failure) A private hospital engaged an individual contractor to destroy patient medical record documents. The contractor reportedly mishandled the documents and reused them as wrapping for sweets, resulting
in the leakage of personal and medical data of more than 1,000 individuals and subsequent public expo - sure via social media. Beyond the inherently sensi - tive nature of health data, the PDPC focused on the hospital’s failure to implement adequate security and oversight measures, as well as its failure to report the breach in accordance with the PDPA. The hospital was fined THB1,210,000, while the contractor was fined THB16,940. This case is notable not only for turning what was once regarded as an anecdotal “joke” about the reuse of paper for food packaging in Thailand into a concrete compliance failure, but also for illustrat - ing the PDPC’s proportional approach to penalties. The significant disparity between the fines imposed on the hospital and on the individual contractor dem - onstrates that the regulator takes into account the nature, scale and capacity of the offender, as well as the degree of organisational responsibility and control, when determining administrative sanctions. Case 3 – “computer and accessories trading giant” (breach linked to call centre scams) More than 100 data subjects reportedly complained following call centre scams tied to a breach incident. The PDPC cited a lack of security measures, failure to report breach incidents, and failure to appoint a DPO. The company was fined THB7 million (with public reporting indicating that the company’s revenue and size were taken into account). This case closely mirrors the landmark enforcement action taken by the PDPC in 2024, in terms of both the factual circumstances and the legal bases for liability. Taken together, these cases suggest that the PDPC is developing a consistent enforcement benchmark for large-scale data breaches involving inadequate secu - rity governance, delayed breach notification and the absence of a DPO. Case 4 – cosmetics company A cosmetics company reportedly suffered leakage of personal data to a call centre gang due to inad - equate security measures, and also failed to notify the PDPC of the breach incident. The company was fined THB2,500,000.
505 CHAMBERS.COM
Powered by FlippingBook