THAILAND Trends and Developments Contributed by: Jutharat Anuktanakul, Suphakorn Chueabunchai and Pitchaya Roongroajsataporn, Chandler Mori Hamada Limited
Case 5 – collectible toy company + processor (reservation system compromise) A collectible toy company used a data processor for a reservation system, which was compromised for a brief period (reported to be around ten minutes), resulting in unauthorised amendments to approxi - mately 200,000 records. The PDPC fined both parties: the toy retailer THB500,000 and the data processor THB3 million, highlighting that processors can face serious exposure where they fail to contain incidents, notify controllers or support remediation. Practical enforcement themes emerging from the cases Across these fact patterns, three recurring compliance failures stand out, each of which is likely to remain front and centre in 2026. Security measures and security governance The PDPC repeatedly focused on whether security measures were “appropriate” and subject to ongoing review, including risk assessments, access controls, and privacy and security by design. It also examined whether data retention, deletion and destruction prac - tices were appropriate and ensured that personal data was not retained longer than necessary. Breach reporting discipline and incident response maturity Several penalties emphasised failures to notify the regulator (and in some cases, failures to notify coun - terparties within controller–processor relationships), demonstrating that “late or missing reporting” is no longer regarded as a minor technicality. DPO designation and vendor governance (including DPAs) In addition to substantive security controls, the PDPC’s enforcement posture continues to treat gov - ernance obligations – ie, the designation of a DPO where required and the implementation of contrac - tual controls via DPAs – as “core compliance” require - ments rather than optional best practice. In short, enforcement actions in 2025 convert PDPA compliance into an enterprise risk-management issue that must sit with senior management, IT/security and
procurement/vendor owners – not only legal/compli - ance teams. Proactive Monitoring and High-Risk Processing: PDPC Eagle Eye and the World/Worldcoin Biometrics Case PDPC Eagle Eye as an operational enforcement capability A further indicator of intensifying enforcement is the regulator’s investment in proactive monitoring func - tions. Over the past year, PDPC Eagle Eye has oper - ated as a dedicated unit using technology to monitor and detect personal data leaks, including scanning search engines, online sources and dark web loca - tions, as well as co-ordinating with relevant agencies on follow-up actions. In many instances where there is public reporting of personal data breaches or improper use of personal data, PDPC Eagle Eye has published preliminary details through its online channels to raise public awareness of personal data protection threats. This has, at times, led organisations to perceive such disclosures as reputationally damaging, even where the underlying facts have not yet been fully verified. This development is significant for organisations because it fundamentally alters the practical risk equation: regulatory enforcement no longer depends solely on a complaint from a data subject. Where a data leak is visible online, or otherwise detectable through proactive monitoring, organisations may be contacted by the regulator even in the absence of any formal complaint by affected individuals. The “iris scan in exchange for crypto tokens” enforcement action (World/Worldcoin) The most high-profile illustration of the PDPC’s 2025 posture is the enforcement action against the business offering iris scanning in exchange for cryptocurrency tokens, widely reported as World (formerly Worldcoin). In late November 2025, multiple outlets reported that Thai authorities ordered the operator to halt the iris scan service and delete biometric data of approxi - mately 1.2 million users in Thailand, citing PDPA breaches and concerns around unlawful consent and biometric data risk.
506 CHAMBERS.COM
Powered by FlippingBook