Personal Data Protection Act B.E. 2562 (2019) and Penetration Testing
Section 37 requires data controllers to provide appropriate security measures. Penetration Testing is one way to validate the effectiveness of technical controls.
- Target Audience
- Data Controllers under Section 37(1) and Data Processors under Section 40(2) handling personal data within the PDPA's scope
- Mandatory Frequency
- Review measures when necessary or when technology changes (Sec 37(1)); no statutory annual pentest cadence
- Required Scope
- Customer Databases, Web Portals, APIs handling PII, Cloud Infrastructure
- Non-Compliance Risk
- A controller's failure to comply with Section 37 has a THB 3 million ceiling (THB 3,000,000) under Section 83; specified Section 26 data offences under Section 84 have a THB 5 million ceiling. Civil and criminal liability require separate legal elements.
Testing in support of PDPA security measures
Section 37 requires controllers to apply appropriate measures. Testing helps demonstrate control effectiveness, but it is not the sole evidence of PDPA compliance.
Testing helps evaluate safeguards; one pentest does not establish complete PDPA compliance.
- Data and purpose — Identify information, systems, and processing purpose
- Assess risk — Consider effects on individual rights and freedoms
- Appropriate safeguards — Prevent unauthorized loss, access, use, alteration, or disclosure
- Test with minimized real data — Prefer synthetic data and redact evidence
- Review and respond — Update safeguards as technology changes and prepare breach response
- Link tested systems to the data inventory, processing purpose, and personal-data risk so scope reflects actual impact.
- Examine authentication, authorisation, data protection in transit and at rest, and the handling of sessions, APIs, and administrative functions.
- Control test data, minimise real personal data, redact evidence, and define retention or deletion for testing artefacts.
- Review measures when risk, technology, or processing changes. One pentest does not establish complete compliance on its own.
- Notify the PDPC without delay and, where feasible, within 72 hours unless the breach poses no risk to rights and freedoms. Assess transfers under section 28, including its exceptions, or section 29 mechanisms. Section 41(2) combines core regular monitoring and large-scale processing; 100,000 data subjects is one deemed large-scale case, not the only criterion.
PERSONAL DATA PROTECTION
Section 37 duty
- A data controller must provide appropriate security measures to prevent unauthorized or unlawful loss, access, use, alteration, correction, or disclosure of personal data.
- Minimum safeguards must include organizational and technical measures and may include physical measures where necessary according to risk. They must be reviewed when necessary or when technology changes.
Sub-regulations and Enforcement Criteria
- Data Breach Notification (B.E. 2565): Controllers must notify the PDPC without undue delay and, where feasible, within 72 hours of awareness unless the breach poses no risk to rights and freedoms. High-risk breaches also require notification to affected data subjects without undue delay.
- Cross-Border Data Transfers (Sections 28 & 29 B.E. 2566): Assess destination protection and section 28(1)-(6) exceptions, or section 29 mechanisms such as BCRs reviewed and certified by the Office or enforceable contractual safeguards meeting the notification criteria.
- DPO Designation (Section 41(2) B.E. 2566): Section 41(2) combines core activities requiring regular monitoring with large-scale data; 100,000 data subjects is one deemed large-scale case. Section 41(3) separately covers core processing of section 26 data.
Role of Penetration Testing
- Testing can validate whether technical controls across web, mobile, API, network, and cloud environments resist unauthorized access or disclosure in practice.
- Assessments must be authorized and risk-based, minimize unnecessary personal-data collection, redact evidence, and define secure retention and deletion.
The PDPA does not mandate annual Penetration Testing. Section 37 and the security-measures notification require appropriate measures, while testing is one way to validate technical controls; a test report alone is not evidence of complete PDPA compliance.
Requirements and Testing Scope Matrix
Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.
| Reference | Mandate Title | Scope Required | Testing Cycle |
|---|---|---|---|
| Section 37(1) | Appropriate Technical and Organizational Safeguards | PII Databases, Web Portals, Cloud Workloads | When necessary or when technology changes |
| Personal Data Protection Committee Notification on Security Measures of Data Controllers B.E. 2565, clauses 4 and 5 | Risk-based security measures and review, not a named annual pentest requirement | Personal Data Processing Infrastructure | When necessary or technology changes, including after a breach unless it poses no risk to rights and freedoms under clause 5 |
| PDPC Breach Notification B.E. 2565 (Sec 37(4)) | 72-Hour Personal Data Breach Notification | Incident detection and response systems handling personal data breaches | Notify PDPC without delay and, where feasible, within 72 hours unless no risk; notify affected data subjects without delay if high risk |
| PDPC Cross-Border Transfer B.E. 2566 (Section 28) | Cross-Border Personal Data Transfer (Adequacy Standard) | Cross-border cloud infrastructure, APIs, and systems transferring personal data overseas | Assess destination safeguards and section 28(1)-(6) exceptions before transfer; transit and storage exclusions depend on the notification conditions, not encryption alone |
| PDPC Cross-Border Transfer B.E. 2566 (Section 29) | Appropriate Safeguards (Binding Corporate Rules and Standard Contractual Clauses) | Intra-group transfers (BCRs) or third-party international transfers (SCCs) | Execute prior to transfer; BCRs require PDPC approval, and contracts must be legally enforceable |
| PDPC DPO Designation Criteria B.E. 2566 (Section 41(2)) | Criteria for Appointing a Data Protection Officer (DPO) | Core activities involving regular monitoring and large-scale data under clauses 4-6; 100,000 data subjects is one deemed large-scale case, not the sole criterion | Assess the cumulative monitoring and large-scale criteria; section 41(3) separately covers core processing of section 26 data |
Compliance Readiness Self-Assessment
Select items your organization has completed to evaluate your readiness score.
Frequently Asked Questions (FAQ)
Key answers and practical guidance addressing common compliance questions.
Is penetration testing mandatory under Thailand's PDPA?
Section 37(1) and the Personal Data Protection Committee's Security Measures Notification B.E. 2565 (2022) require appropriate risk-based safeguards and review, not annual penetration testing for every organisation. Penetration testing is one way to evaluate the effectiveness of safeguards. Separately check applicable sector-specific requirements and contractual commitments.
Does a data breach or the absence of a penetration test automatically create PDPA liability?
No automatic penalty arises merely from not purchasing a penetration test. Liability depends on the applicable duties and legal elements. A controller's non-compliance with Section 37 may attract an administrative fine of up to THB 3 million (THB 3,000,000) under Section 83. The THB 5 million ceiling in Section 84 concerns the specified offences involving Section 26 data. Civil liability under Sections 77-78 and criminal liability under Sections 79-81 require separate, fact-specific analysis.
