PDPA Update – Thailand's New Legislation on Personal Data Breach Notification

•   arising out of any breach of security measures resulting in any loss, access, use, change, alteration or disclosure of personal data without authorisation;
•   whether caused by willful misconduct or negligence, or caused by any data controller itself, or data processor (as well as its employees, contractors, agents);
•   including (i) confidentiality breaches (causing unauthorized access to or disclosure of personal data), (ii) integrity breaches (causing any incorrect or inaccurate personal data), and (iii) availability breaches (resulting in the personal data not being readily available).

1.      Inspect and assess the level of risk first: Upon becoming aware of personal data breach, a data controller must access the creditability and inspecting the details of personal data breach without any delay, as well as assess the level of risk and its impact on data subject's rights and liberties (where the criteria on risk assessment are also provided).

2.      Notify:

o   Notify the PDPC if there is any breach: If there is any reason to believe that such breach is occurred, the data controller must notify the PDPC without delay and within 72 hours after becoming aware of the breach, irrespective of the level of risk.

o   Notify the data subject (only) if the risk is high: If such risk is high, the data controller must also inform the data subjects impacted by such breach.

o   No risk, no notification required: No notification required if the data processor can prove that such risk is none.

3.      Take action: The data controller must, to its fullest, implement measures to rectify or mitigate such breach and to prevent any respective similar breach. During the inspection in 1., in high-risk cases, the data controller is required to do so immediately and procure its relevant data processor(s) to do the same.

• To PDPC: in writing or via electronic means as prescribed by the PDPC
• To data subjects: in writing or via electronic means specifically addressed to each data subject. If not possible, a data controller may notify a group of data subjects (if not individually identifiable), via public media, social media or any other means accessible to the data subjects.

• incorporate a contractual obligation in relevant data processing agreements to notify any personal data breach to the data controller within 72 hours after becoming aware of such breach, and
• procure its data processor to prevent and mitigate the breach (only in high-risk cases) (see above).