Data Breach Response (72-hour Notification)
รับมือเหตุข้อมูลรั่ว (Data Breach 72-hr Response) · § Litigation
What to know before you act
When personal data is leaked, accessed without authority or lost, the controller must assess risk and notify the PDPC within the statutory window from becoming aware, and may need to tell affected individuals if risk is high. We help contain the incident, preserve evidence, decide whether notification is required, draft notices and put prevention measures in place.
Timing and external dependencies: The PDPC notification clock runs from awareness, so contact us as soon as you suspect an incident — confirm the period under current law and PDPC notifications.
Official fee: Notification is free, but failing to notify on time can bring administrative fines — confirm with the PDPC.
Timing is not a promise of an outcome or hearing date. Check the notice, limitation period and current authority rules for your matter.
What to send for the first review
Send every relevant page, a dated sequence of events, any hearing or filing deadline, and the outcome you need. This lets counsel identify urgent steps, missing evidence and a precise scope of work.
- Incident details (logs, timeline)
- Count of affected data subjects
- Types of data leaked (name, ID, financial, health)
Legal Basis
PDPA §37(4) and PDPC Breach Notification Rules 2022 — notify PDPC within 72 hours; where the risk to data subjects is high, notify affected individuals as well.
📚 Official sources — check the current law and procedure before acting
- สำนักงานคณะกรรมการคุ้มครองข้อมูลส่วนบุคคล (สคส.)— PDPC Thailand
- สำนักงานคณะกรรมการกฤษฎีกา — ตัวบทกฎหมายฉบับทางการ— Office of the Council of State
Who Needs This
Organisations facing ransomware, phishing, insider leaks, API data exposure, misconfigured S3 buckets, or credential-stuffing incidents.
Required Documents
- Incident details (logs, timeline)
- Count of affected data subjects
- Types of data leaked (name, ID, financial, health)
- Initial remediation measures
Common Pitfalls
- Deleting logs or reinstalling systems, destroying evidence of scope
- Waiting for a complete investigation before notifying and missing the deadline
- Sending customer emails that admit more than the facts support without review
Typical Use-cases
- Ecommerce hit by credential stuffing affecting 500,000 customers
- Hospital ransomware compromising medical records
- SaaS discovers a misconfigured S3 bucket exposing customer data
FAQ
- One email went to the wrong person — must we notify?
- Not always. If the assessment finds no risk to rights and freedoms, notification may not be needed, but document the assessment.
- We were hit by ransomware — what first?
- Isolate infected machines, preserve evidence, call specialists and consider a police report before any decision about payment.
- Our vendor leaked the data — who notifies?
- The processor informs the controller and the controller notifies the PDPC; the contract should require this.
Other Legal Services
Request a quote — Call 083-2494999 · LINE @NYC168 · contact@nyclegal.co.th
Knowledge bases behind every service
3,307 answered questions written by our lawyers and translators, grouped by service. Free to read, no sign-up.
- Master Service Hub — every service we file
The cross-service index: certified translation, interpreting, visa/work permit/BOI, tax-legal-estate, cross-border M&A, aviation & maritime, and holding-company structuring.
649 answered questions
- Certified translation — every language
Certified translation across civil, academic, corporate, contractual, financial, medical, technical and IP documents — with the Notary → MFA → embassy legalization chain handled end to end.
500 answered questions
- Thai MFA consular legalization
Thai MFA legalization workflow: fees, turnaround, inbound foreign documents, and how the chain connects to destination-country apostille requirements.
500 answered questions
Official sources — legal services
The information on this page follows the official sources below. Always check the latest version before you file.
- Office of the Judiciary— Office of the Judiciary
- Ministry of Justice— Ministry of Justice
- Lawyers Council of Thailand — Notarial Services Attorneys— Lawyers Council of Thailand
- Office of the Council of State — Thai law database— Office of the Council of State
- Royal Thai Government Gazette— Royal Thai Government Gazette
Related services
Most document work runs across several steps — jump straight to the next one you need.
Contact us by phone, LINE or email for a free initial enquiry and a quote after document review. Timing depends on the work and relevant authorities.
General information before proceeding: Confirm current requirements with the receiving authority before using your documents. This page is not a legal opinion for your individual case — meet the team · editorial policy
Not sure which service you need? Read the guides
Each guide answers first, then explains: decision criteria, comparison tables, the real process and the mistakes we see most often.
- Choosing a certified translation provider
How to pick a translator accepted by consular, embassy and receiving bodies
- Services for expats living in Thailand
Signature certification, residence, marriage and everyday paperwork
- Notary Public and consular legalization
The correct order of steps before sending documents abroad
- Choosing the right visa and work permit
Compare visa categories and the documents each one needs translated
- Translation by language
English, Chinese, Japanese, European, Arabic, Russian and embassy rules
- Specialized translation
Contracts, financial statements, MSDS, ISO and BOI filings
Talk to us first: 083-2494999 · LINE @NYC168 · contact@nyclegal.co.th
Frequently asked questions
- Can a foreigner own 100% of a Thai company?
- Full foreign ownership is possible for some activities, but there is no blanket permission. Check the Foreign Business Act definition, actual activities, sector-specific restrictions and any required licence or certificate. BOI promotion and treaty rights apply only within their approved scope; they do not automatically confer land rights, visas or work permits. Do not use nominee shareholders. Verify the proposed structure with DBD.
- What is the minimum registered capital for a Thai company?
- Do not apply one capital figure to every incorporation, foreign-business licence, visa or work-permit application. Registered capital and paid-up capital are different, and the applicable requirements depend on actual activities, ownership, permit category and any BOI or treaty conditions. Capital is a company funding requirement, not our service fee. Confirm the relevant criteria with DBD, the Department of Employment and Immigration before choosing the structure. Ask our team for a quotation for the agreed work.
- How long does company registration take?
- Separate document preparation, name reservation, signatures and DBD review from VAT registration, Social Security and bank onboarding. Timing depends on the filing channel, complete documents and any requests for corrections or additional evidence; no completion date is guaranteed. Ask our team for a quotation and a planning estimate after the proposed structure and documents have been reviewed.
- What ongoing accounting obligations does a Thai company have?
- A Thai limited company keeps statutory books and prepares audited annual statements even without trading. Tax returns depend on its payments, VAT status, accounting period and taxpayer category: PND1, PND3 and PND53 are not universal monthly returns for every company, and PP30 applies to VAT-registered businesses, including nil-return months while registration remains active. Check PND50, PND51 and each filing deadline with RD; check annual statements and shareholder filings separately with DBD.