What Is PDPA? The 8 Things Organizations Must Do (And Which Ones a Security Tool Can Actually Help With)
What is PDPA compliance in Thailand? All 8 legal requirements, the 7M baht JIB fine, and which 2 a security tool can actually help with. Get a free consult.
What Is PDPA? The 8 Things Organizations Must Do (And Which Ones a Security Tool Can Actually Help With)
On 21 August 2024, Thailand's Personal Data Protection Committee (PDPC) fined J.I.B. Computer Group — a major IT retailer — 7,000,000 baht. It was the first administrative fine ever issued under PDPA since the law came into full force.
What's worth noticing is that the 7 million baht wasn't one violation — it was three, stacked together: failing to appoint a DPO despite processing data for over 100,000 people (1 million baht), inadequate security measures that let data leak in the first place (3 million baht), and missing the 72-hour PDPC notification window even after 23 customers had already complained (3 million baht). In plain terms, this one company failed at several different checkpoints at the same time.
The first question people usually ask about PDPA is some version of this: "How many things does PDPA actually require, and what are they?" This article answers all 8. And because we sell security products, not legal services, we're also going to tell you plainly which of the 8 a security tool like ours can genuinely help with — and which ones no amount of software will fix, because they're paperwork, legal work, and people decisions.
PDPA in the shortest version possible
PDPA stands for the Personal Data Protection Act B.E. 2562 (2019). It was published in Thailand's Royal Gazette back in 2019, but enforcement got pushed back repeatedly during COVID — it didn't actually take full effect until 1 June 2022.
The regulator is the Personal Data Protection Committee (PDPC), backed by the Office of the PDPC as its secretariat. Between the two, they issue sub-regulations, run investigations, and hand out fines.
Penalties come in three separate tracks, not just administrative fines: administrative penalties up to 5,000,000 baht per violation (for processing sensitive data without a proper legal basis), criminal penalties up to 1 year imprisonment and/or a 1,000,000 baht fine (for cases involving fraudulent intent or unlawful gain), and civil penalties that let a court award actual damages plus punitive damages up to 2x on top. These three tracks are independent of each other — one organization can get hit by all three at once, which is close to what happened to JIB.
The law protects "personal data" belonging to anyone identifiable — customers, employees, vendors, anyone. If your organization collects a name, email address, phone number, or even an IP address tied to a real person, PDPA applies to you. This isn't a law that only IT companies or large enterprises need to worry about.
The 8 things PDPA requires of every organization
Listed in roughly the order the law's sections run, with an honest note at the end of each on whether zcr can actually help.
1. A legal basis for processing, and proper consent management
Before you collect or use anyone's personal data, you need a "legal basis" to stand on — that could be consent under Section 24, or another basis like contractual necessity, legitimate interest, or a legal obligation. Sensitive data (religion, ethnicity, health records, and similar categories) needs explicit consent under Section 26, a stricter bar than ordinary data.
This is consent banner design, consent management platform selection, and picking the right legal basis for each individual data flow in your organization — work that genuinely needs a lawyer or a dedicated privacy team. No zcr product touches any part of this.
2. Maintain a RoPA — Record of Processing Activities
Section 39 requires data controllers to keep a Record of Processing Activities (RoPA): what data you collect, why, how long you keep it, and who you share it with. This is typically the first document a PDPC investigator will ask to see.
One common misunderstanding worth clearing up: the PDPC did issue an SME exemption from the RoPA requirement (the data-controller side took effect 8 April 2025) — but this is not a blanket exemption from PDPA. It only exempts the single RoPA requirement. The SME threshold generally used is annual revenue under 100 million baht with 50 or fewer employees, or revenue under 50 million baht with 30 or fewer employees (the exact numbers shift slightly by business type). And even a qualifying SME still has to maintain a RoPA if its processing creates risk to data subjects' rights, isn't merely occasional, or involves sensitive data under Section 26. All 7 of the other checklist items still apply to SMEs in full, regardless of size.
This one isn't ours either — a RoPA documents an organization's entire data flow. It's not something a log management or security tool can generate on your behalf.
3. A Privacy Policy or Privacy Notice for data subjects
Section 23 requires notifying data subjects — before or at the time you collect their data — what you're collecting, why, how long you'll keep it, and what rights they have. The Privacy Policy page most websites already have is one common form this takes.
This is legal or privacy-consulting work, not ours. Writing a Privacy Policy that's both legally complete and actually matches your organization's real data flows is a drafting exercise, not a security monitoring problem.
4. Mechanisms for data subject rights
Sections 30–36 give data subjects several rights — to access their data, correct it, request deletion, request portability, and withdraw consent at any time. Organizations need real channels and processes to handle these requests, not just rights that exist on paper.
This falls entirely outside zcr's product scope. Building a request intake form, a requester identity-verification process, and an internal approval workflow is CRM or data-governance work, not security monitoring.
5. Appropriate security measures — this is where zcr genuinely helps
Section 37(1) requires data controllers to maintain "appropriate security measures," covering access control, encryption, and audit logging. The JIB case mentioned at the start was fined 3 million baht specifically on this point — inadequate security measures were what let the data leak in the first place.
This is where security tools actually earn their place:
- zcrLog centralizes access logs across your systems and data, with RBAC controlling who can view logs and an audit trail of who accessed what and when. If someone asks "who accessed the customer database last night," the organization needs to be able to answer that, not guess. The PDPA and Log Management article goes deep on exactly this angle, if you want the specifics on collecting logs without running afoul of PDPA and Thailand's Computer Crime Act at the same time.
- zcrSIEM uses AI-assisted threat hunting to help analysts spot unusual data-access behavior faster — type a plain-language sentence like "unusual access to customer database at night" and AI turns it into a query. Critically, the analyst always reviews and can edit that query before it actually runs; the AI isn't left to decide anything on its own. More on how that feature actually works in What Is AI-Assisted Threat Hunting?
- zcrWAF protects web applications and APIs that handle personal data from OWASP Top 10 attacks, including SQL injection — one of the most common ways attackers pull data straight out of a customer database.
- zcrCTEM scans for assets accidentally exposed to the internet, like a misconfigured database that's reachable from outside your network, so you find it before an attacker does.
All four of these are genuinely "appropriate security measures" in the Section 37(1) sense — not just marketing language stretched to fit.
6. Appoint a DPO when the threshold applies
Section 41 requires appointing a Data Protection Officer when an organization's core activity involves large-scale, regular monitoring of personal data or systems, or when its core activity is processing sensitive data under Section 26, or when it's a public authority the PDPC has designated. The clarifying notification on this took effect 13 December 2023.
One thing worth flagging: the "100,000+" figure that a lot of articles cite as the "large scale" threshold actually comes from the specific facts of the JIB case (JIB happened to be processing data for over 100,000 people when it was fined) — it is not a numeric threshold written into the PDPC's notification itself. What's actually confirmed is that "large scale" is judged on the specifics of the activity, not a fixed number in the law. If you're not sure whether your organization meets the threshold, ask a lawyer directly rather than guessing from a number you saw in a blog post.
Appointing a person is an organizational and HR decision — no software fixes that, and this item is no exception. zcr has no role here.
7. An incident response plan, and 72-hour PDPC notification — the other item zcr genuinely helps with
Section 37(4) requires notifying the PDPC of a personal data breach without undue delay, and where feasible, within 72 hours of becoming aware of it. (There's an exemption if a documented risk assessment concludes the breach poses no risk to data subjects' rights, and if you genuinely miss the 72-hour window, you still have to notify as soon as possible — no later than 15 days — with a documented justification.) JIB was fined 3 million baht on this point specifically because it only learned of the breach from 23 customers who complained directly, not from any detection system of its own, and missed the notification deadline as a result.
Here's a question most organizations never actually ask themselves: "if our data leaked right now, how many hours would it take us to even know?" That matters because the 72-hour clock starts the moment you become aware, not the moment the breach actually happens. An organization that's slow to detect is burning its own clock before it even starts running — which is essentially what happened in the JIB case.
This is where automation makes a concrete difference. zcrSIEM's Security Operations dashboard condenses the raw event stream into incidents sorted by severity, and gathers into one view the numbers that show how fast the team actually moves: mean time to acknowledge, mean time to resolve, how long detection itself takes, and how many incidents stay inside SLA. The more of that first-pass triage that happens automatically, the more of an analyst's remaining time goes into deciding which incidents are real and reportable, instead of manually working through log lines one at a time.
Detecting fast isn't enough on its own — you also need to respond fast. zcrSOAR handles that side with playbooks built from typed nodes: a Trigger node kicks the playbook off from an incoming alert, Action nodes run automatically for low-risk steps like enriching an IOC or pulling additional logs, an Approval node always sits in front of anything that touches production — isolating a machine, disabling an account — and a Human Task node hands work off to a person when a step genuinely needs human judgment rather than a script. That human-on-the-loop design is covered in more detail in How Agentic Automation Works in SOAR.
To be blunt about it: an organization still relying entirely on manual review has almost no realistic chance of detecting a breach fast enough to notify the PDPC inside 72 hours. The clock starts the moment you know, not the moment it happens — that's a real, checkable value proposition, not a marketing line.
8. Data processing agreements with third-party vendors
Section 40 requires that when you hand data processing to a third party — a cloud provider, a payroll outsourcing firm, a marketing agency — there needs to be a contract spelling out scope and the security measures that processor is obligated to follow. You can't just hand data off with no legal obligation attached.
This is ultimately contract work, which belongs to legal and procurement teams — not somewhere zcr operates.
The honest summary: zcr helps with 2 of 8, not all 8
Of the 8 items above, zcr genuinely helps with item 5 (security measures) and item 7 (incident response and timely PDPC notification). The other 6 — consent, RoPA, Privacy Policy, data subject rights, DPO appointment, vendor contracts — are paperwork, legal work, and organizational decisions that no security tool can substitute for, no matter how the marketing is written.
We're choosing to say this plainly because we think an organization working toward full PDPA compliance needs to know up front that it should be running a legal consultant in parallel with any security investment — not assuming one tool purchase covers everything. And as it happens, the 2 items we can help with are the same 2 that carried the heaviest fines in the JIB case (6 million of the total 7 million baht combined). So while it's only 2 of 8 items, they're the 2 with the highest financial risk if you get them wrong.
Where to start if you haven't done any of this yet
If your organization hasn't started on PDPA at all, here's a reasonable order to work through it:
- Bring in legal counsel to build your RoPA and Privacy Policy first — these two are the foundation everything else references. You need to know what data you're actually collecting before you can know what to protect.
- Assess whether you meet the DPO threshold. If you're not sure, ask a lawyer directly rather than guessing.
- In parallel, start putting concrete security measures in place — access control, encryption, and audit logging that satisfy Section 37(1).
- Prepare an incident response plan and detection capability fast enough to matter, because the 72-hour clock doesn't wait for anyone.
Steps 3 and 4 are where we can genuinely help — take a look at the zcrSIEM, zcrLog, and zcrSOAR plans to see what fits your organization's size.
Get in touch
Want to know how ready your organization actually is on items 5 and 7 of PDPA? Our team offers a free consultation, no cost attached.
Sources
- Thailand Personal Data Protection Committee, GPPC Privacy Policy — an example of documenting data, purposes, and retention for a specific processing activity: https://gppc.pdpc.or.th/privacy-policy/ (accessed September 14, 2026)
- PDPC Portal — information on controller/processor roles and DPO requirements: https://dpo.pdpc.or.th/registration (accessed September 14, 2026)
- Note: this checklist is general guidance, not a legal determination; each organization must assess its own legal basis, purpose, and retention period