Thailand's PDPC has moved from warnings to real enforcement, issuing fines totaling roughly THB 21.5 million across recent cases, with a single penalty as high as THB 7 million — most triggered by weak security measures, missed 72-hour breach notifications, no DPO, and missing vendor data processing agreements. A separate 2025 emergency decree also created criminal penalties for misuse of personal data.
HTI provides cybersecurity assessments and Firewall/network design that support SME compliance with PDPA. This article is general information, not legal advice — consult a qualified lawyer for compliance guidance.