Cybersecurity Policy Report, State Agency Compliance, Data Breach Sanctions Reported by Thai DPA, (Aug 5, 2025)
By Tony Foley
The Personal Data Protection Committee (PDPC), Thailand’s data protection authority, announced the results of a report outlining issues faced by government agencies regarding compliance with the Personal Data Protection Act (PDPA) and also described recent sanctions against both government and private-sector organizations for violations of the PDPA.
Government agency report. The PDPC emphasized in a news release about its report that, although the PDPA was enacted by the state, it did not exempt government agencies from its requirements. The PDPC outlined a recent fine levied against a government agency of more than 150,000 baht ($4,650) for failing to adopt appropriate security measures in an online system providing public services, exposing the system to cyber attacks resulting in leaks of personal information. The agency used weak passwords, failed to conduct a regular risk assessment, failed to enter into a data processing agreement with the system developer, and lacked a process to report the violations.
The PDPC noted that the fine was relatively minor in comparison to private-sector fines for similar violations but added that it nevertheless emphasized the failure of government agencies to comply with the laws. The report identified several systemic flaws that frequently cause public agencies to violate the PDPA, including the misconception that the law does not apply to government agencies, a lack of internal governance infrastructure, neglecting to work with data processors through a data processing agreement, and a lack of awareness of cyber threats.
The agency said government agencies should act more proactively, ensuring that personal data protection becomes part of the organizational culture. Specifically, agencies should officially appoint data protection officers (DPOs), prepare for regular risk assessments, budget appropriately for cybersecurity, establish internal breach reporting processes, and maintain controlled vendor and outsourcing management.
Recent sanctions. In an Aug. 1 Facebook post, the PDPC outlined recent enforcement actions in both the public and private sectors to enforce the PDPA. The post reiterates the agency’s fine against the government agency discussed above, and provided details on several other administrative sanctions, including the following:
A fine of 1.2 million baht ($37,125) against a hospital related to the leak of more than 1,000 patient records and a fine of almost 17,000 baht ($525) against the individual hired by the hospital to destroy the documents, who took some of the records home without following agreed-upon procedures;
A fine of 7 million baht ($216,600) against a network sales agency that regularly collected personal data from users but did not appoint a DPO;
A fine of 2.5 million baht ($77,300) against a cosmetics agency that failed to adopt appropriate security measures and did not report data breaches as required under the PDPA; and
A fine of 500,000 baht ($15,500) against a toy sales agency for failing to implement appropriate security measures.
News: LitigationEnforcement InternationalLegislation DataSecurity DataBreach