# Personal Data Protection Act B.E. 2562 (2019) and Penetration Testing

Locale: `en`

Source: `/en/compliance/pdpa/`

Summary: Section 37 requires data controllers to provide appropriate security measures. Penetration Testing is one way to validate the effectiveness of technical controls.

On this page

1. [Overview](/en/compliance/pdpa/#topic-overview)
2. [Testing in support of PDPA security measures](/en/compliance/pdpa/#compliance-control-summary)
3. [Requirements Matrix](/en/compliance/pdpa/#compliance-matrix)
4. [Readiness Assessment](/en/compliance/pdpa/#compliance-readiness-checklist)
5. [Frequently Asked Questions](/en/compliance/pdpa/#compliance-faq)
6. [Related Frameworks](/en/compliance/pdpa/#related-compliance-frameworks)

# Personal Data Protection Act B.E. 2562 (2019) and Penetration Testing

Section 37 requires data controllers to provide appropriate security measures. Penetration Testing is one way to validate the effectiveness of technical controls.

Executive Summary and Mandate Overview

Target Audience

Data Controllers under Section 37(1) and Data Processors under Section 40(2) handling personal data within the PDPA's scope

Mandatory Frequency

Review measures when necessary or when technology changes (Sec 37(1)); no statutory annual pentest cadence

Required Scope

Customer Databases, Web Portals, APIs handling PII, Cloud Infrastructure

Non-Compliance Risk

A controller's failure to comply with Section 37 has a THB 3 million ceiling (THB 3,000,000) under Section 83; specified Section 26 data offences under Section 84 have a THB 5 million ceiling. Civil and criminal liability require separate legal elements.

## Testing in support of PDPA security measures

Section 37 requires controllers to apply appropriate measures. Testing helps demonstrate control effectiveness, but it is not the sole evidence of PDPA compliance.

[![From personal-data risk to security evidence: Data and purpose → Assess risk → Appropriate safeguards → Test with minimized real data → Review and respond](/assets/compliance/guide-pdpa-compliance-control-summary-en-v1.webp)](/assets/compliance/guide-pdpa-compliance-control-summary-en-v1.webp)

**From personal-data risk to security evidence**

Testing helps evaluate safeguards; one pentest does not establish complete PDPA compliance.

1. **Data and purpose** — Identify information, systems, and processing purpose
2. **Assess risk** — Consider effects on individual rights and freedoms
3. **Appropriate safeguards** — Prevent unauthorized loss, access, use, alteration, or disclosure
4. **Test with minimized real data** — Prefer synthetic data and redact evidence
5. **Review and respond** — Update safeguards as technology changes and prepare breach response

- Link tested systems to the data inventory, processing purpose, and personal-data risk so scope reflects actual impact.
- Examine authentication, authorisation, data protection in transit and at rest, and the handling of sessions, APIs, and administrative functions.
- Control test data, minimise real personal data, redact evidence, and define retention or deletion for testing artefacts.
- Review measures when risk, technology, or processing changes. One pentest does not establish complete compliance on its own.
- Notify the PDPC without delay and, where feasible, within 72 hours unless the breach poses no risk to rights and freedoms. Assess transfers under section 28, including its exceptions, or section 29 mechanisms. Section 41(2) combines core regular monitoring and large-scale processing; 100,000 data subjects is one deemed large-scale case, not the only criterion.

PERSONAL DATA PROTECTION

### Section 37 duty

- A data controller must provide appropriate security measures to prevent unauthorized or unlawful loss, access, use, alteration, correction, or disclosure of personal data.
- Minimum safeguards must include organizational and technical measures and may include physical measures where necessary according to risk. They must be reviewed when necessary or when technology changes.

### Sub-regulations and Enforcement Criteria

- **Data Breach Notification (B.E. 2565)**: Controllers must notify the PDPC without undue delay and, where feasible, within 72 hours of awareness unless the breach poses no risk to rights and freedoms. High-risk breaches also require notification to affected data subjects without undue delay.
- **Cross-Border Data Transfers (Sections 28 & 29 B.E. 2566)**: Assess destination protection and section 28(1)-(6) exceptions, or section 29 mechanisms such as BCRs reviewed and certified by the Office or enforceable contractual safeguards meeting the notification criteria.
- **DPO Designation (Section 41(2) B.E. 2566)**: Section 41(2) combines core activities requiring regular monitoring with large-scale data; 100,000 data subjects is one deemed large-scale case. Section 41(3) separately covers core processing of section 26 data.

### Role of Penetration Testing

- Testing can validate whether technical controls across web, mobile, API, network, and cloud environments resist unauthorized access or disclosure in practice.
- Assessments must be authorized and risk-based, minimize unnecessary personal-data collection, redact evidence, and define secure retention and deletion.

**Not complete compliance evidence**

The PDPA does not mandate annual Penetration Testing. Section 37 and the security-measures notification require appropriate measures, while testing is one way to validate technical controls; a test report alone is not evidence of complete PDPA compliance.

## Requirements and Testing Scope Matrix

Summary of the referenced clauses, the testing scope they cover, and the expected evaluation cycle.

| Reference | Mandate Title | Scope Required | Testing Cycle |
| --- | --- | --- | --- |
| **Section 37(1)** | Appropriate Technical and Organizational Safeguards | PII Databases, Web Portals, Cloud Workloads | When necessary or when technology changes |
| **Personal Data Protection Committee Notification on Security Measures of Data Controllers B.E. 2565, clauses 4 and 5** | Risk-based security measures and review, not a named annual pentest requirement | Personal Data Processing Infrastructure | When necessary or technology changes, including after a breach unless it poses no risk to rights and freedoms under clause 5 |
| **PDPC Breach Notification B.E. 2565 (Sec 37(4))** | 72-Hour Personal Data Breach Notification | Incident detection and response systems handling personal data breaches | Notify PDPC without delay and, where feasible, within 72 hours unless no risk; notify affected data subjects without delay if high risk |
| **PDPC Cross-Border Transfer B.E. 2566 (Section 28)** | Cross-Border Personal Data Transfer (Adequacy Standard) | Cross-border cloud infrastructure, APIs, and systems transferring personal data overseas | Assess destination safeguards and section 28(1)-(6) exceptions before transfer; transit and storage exclusions depend on the notification conditions, not encryption alone |
| **PDPC Cross-Border Transfer B.E. 2566 (Section 29)** | Appropriate Safeguards (Binding Corporate Rules and Standard Contractual Clauses) | Intra-group transfers (BCRs) or third-party international transfers (SCCs) | Execute prior to transfer; BCRs require PDPC approval, and contracts must be legally enforceable |
| **PDPC DPO Designation Criteria B.E. 2566 (Section 41(2))** | Criteria for Appointing a Data Protection Officer (DPO) | Core activities involving regular monitoring and large-scale data under clauses 4-6; 100,000 data subjects is one deemed large-scale case, not the sole criterion | Assess the cumulative monitoring and large-scale criteria; section 41(3) separately covers core processing of section 26 data |

### Compliance Readiness Self-Assessment

Select items your organization has completed to evaluate your readiness score.

0%

Evidence of risk-based safeguard verification for personal-data portals and APIs, using pentesting where appropriate or specifically required
          
          
            
            Database access controls audited following Least Privilege principles
          
          
            
            Protect personal data in transit with encryption appropriate to risk, without claiming that the PDPA mandates TLS 1.3
          
          
            
            Security flaw review conducted prior to deploying features involving personal data

Assessment Status

Check items above to view assessment result.

[Request Pentest Quote](/en/#contact)

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### Is penetration testing mandatory under Thailand's PDPA?

Section 37(1) and the Personal Data Protection Committee's Security Measures Notification B.E. 2565 (2022) require appropriate risk-based safeguards and review, not annual penetration testing for every organisation. Penetration testing is one way to evaluate the effectiveness of safeguards. Separately check applicable sector-specific requirements and contractual commitments.

### Does a data breach or the absence of a penetration test automatically create PDPA liability?

No automatic penalty arises merely from not purchasing a penetration test. Liability depends on the applicable duties and legal elements. A controller's non-compliance with Section 37 may attract an administrative fine of up to THB 3 million (THB 3,000,000) under Section 83. The THB 5 million ceiling in Section 84 concerns the specified offences involving Section 26 data. Civil liability under Sections 77-78 and criminal liability under Sections 79-81 require separate, fact-specific analysis.

## Related Compliance Frameworks and Security Standards

- [
                Does ISO/IEC 27001:2022 require penetration testing?
                
              ](/en/compliance/iso-27001/)
- [
                NCSA Cloud Security Standard B.E. 2567 (2024)
                
              ](/en/compliance/ncsa-cloud-security-standard/)
- [
                Thailand Cybersecurity Act 2019 and penetration testing
                
              ](/en/compliance/cybersecurity-act/)
- [
                Thailand Digital ID: ETDA, DGA, IAL/AAL, and DPS Security
                
              ](/en/compliance/thailand-digital-id/)

Open full-size image to zoom

## Official source documents

Original files from the regulating authorities, hosted on sth.sh for convenience. Always defer to the latest version at the source link.

[
            
              
              
              ![First-page preview of Personal Data Protection Committee Notification on Security Measures for Data Controllers B.E. 2565 (2022)](/assets/process/compliance-sources/sth-source-pdpc-minimum-security-measures-2565.webp)
            
          ](/assets/documents/sth-source-pdpc-minimum-security-measures-2565.pdf)

### Personal Data Protection Committee Notification on Security Measures for Data Controllers B.E. 2565 (2022)

By Personal Data Protection Committee

[Open document (PDF) ](/assets/documents/sth-source-pdpc-minimum-security-measures-2565.pdf)
              [Download ](/assets/documents/sth-source-pdpc-minimum-security-measures-2565.pdf)
              
              [Source ](https://ratchakitcha.soc.go.th/documents/17211326.pdf)

[
            
              
              
              ![First-page preview of Personal Data Protection Act B.E. 2562 (2019)](/assets/process/compliance-sources/sth-source-pdpa-act-2562.webp)
            
          ](/assets/documents/sth-source-pdpa-act-2562.pdf)

### Personal Data Protection Act B.E. 2562 (2019)

By Royal Thai Government Gazette

[Open document (PDF) ](/assets/documents/sth-source-pdpa-act-2562.pdf)
              [Download ](/assets/documents/sth-source-pdpa-act-2562.pdf)
              
              [Source ](https://ratchakitcha.soc.go.th/documents/17082307.pdf)

[
            
              
              
              ![First-page preview of Personal Data Protection Committee Notification on Criteria and Methods for Personal Data Breach Notification B.E. 2565 (2022)](/assets/process/compliance-sources/sth-source-pdpc-data-breach-notification-2565.webp)
            
          ](/assets/documents/sth-source-pdpc-data-breach-notification-2565.pdf)

### Personal Data Protection Committee Notification on Criteria and Methods for Personal Data Breach Notification B.E. 2565 (2022)

By Personal Data Protection Committee

[Open document (PDF) ](/assets/documents/sth-source-pdpc-data-breach-notification-2565.pdf)
              [Download ](/assets/documents/sth-source-pdpc-data-breach-notification-2565.pdf)
              
              [Source ](https://pdpc.gdcatalog.go.th/dataset/83da6761-86a6-49cb-b9d6-6a918da4be65/resource/4aee4e4a-504e-470b-9ba0-688c179cf158/download/-..-2565.pdf)

[
            
              
              
              ![First-page preview of Personal Data Protection Committee Notification on Criteria for Protection of Personal Data Transferred Abroad under Section 28 B.E. 2566 (2023)](/assets/process/compliance-sources/sth-source-pdpc-cross-border-sec28-2566.webp)
            
          ](/assets/documents/sth-source-pdpc-cross-border-sec28-2566.pdf)

### Personal Data Protection Committee Notification on Criteria for Protection of Personal Data Transferred Abroad under Section 28 B.E. 2566 (2023)

By Personal Data Protection Committee

[Open document (PDF) ](/assets/documents/sth-source-pdpc-cross-border-sec28-2566.pdf)
              [Download ](/assets/documents/sth-source-pdpc-cross-border-sec28-2566.pdf)
              
              [Source ](https://pdpc.gdcatalog.go.th/dataset/8af7fdec-bc38-42ba-8228-7e966d39b591/resource/804b53a2-456e-4534-b3e7-9274b871f6a4/download/-28-.pdf)

[
            
              
              
              ![First-page preview of Personal Data Protection Committee Notification on Criteria for Protection of Personal Data Transferred Abroad under Section 29 B.E. 2566 (2023)](/assets/process/compliance-sources/sth-source-pdpc-cross-border-sec29-2566.webp)
            
          ](/assets/documents/sth-source-pdpc-cross-border-sec29-2566.pdf)

### Personal Data Protection Committee Notification on Criteria for Protection of Personal Data Transferred Abroad under Section 29 B.E. 2566 (2023)

By Personal Data Protection Committee

[Open document (PDF) ](/assets/documents/sth-source-pdpc-cross-border-sec29-2566.pdf)
              [Download ](/assets/documents/sth-source-pdpc-cross-border-sec29-2566.pdf)
              
              [Source ](https://pdpc.gdcatalog.go.th/dataset/32e0f280-7e2a-4056-a9d3-e04e1b21c124/resource/5d8742d7-2fa5-455e-994b-79967ca5c95e/download/-29-..-2562-..-2566.pdf)

[
            
              
              
              ![First-page preview of Personal Data Protection Committee Notification on Designation of Data Protection Officers under Section 41 (2) B.E. 2566 (2023)](/assets/process/compliance-sources/sth-source-pdpc-dpo-criteria-sec41-2566.webp)
            
          ](/assets/documents/sth-source-pdpc-dpo-criteria-sec41-2566.pdf)

### Personal Data Protection Committee Notification on Designation of Data Protection Officers under Section 41 (2) B.E. 2566 (2023)

By Personal Data Protection Committee

[Open document (PDF) ](/assets/documents/sth-source-pdpc-dpo-criteria-sec41-2566.pdf)
              [Download ](/assets/documents/sth-source-pdpc-dpo-criteria-sec41-2566.pdf)
              
              [Source ](https://pdpc.gdcatalog.go.th/dataset/52162641-a0db-4bb2-b2f1-a6a3dc880e97/resource/230c4d60-dd01-4129-b27c-2a1d777d9737/download/-41-2-..-2562-..-2566.pdf)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

## PDF document

[Open in new tab ](/en/compliance/pdpa/)
              [Download](/en/compliance/pdpa/)

Last updated 16 October 2026