Who needs a data protection officer (DPO)
Required for public authorities as the Committee prescribes; where collecting, using or disclosing data requires regular monitoring of personal data or systems because of a large amount of data, as the Committee prescribes; and where the core activity is processing sensitive data.
As of 21 Oct 2026
When a breach must be reported
To the Office without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights; to the people affected without delay if the risk is high.
As of 21 Oct 2026
Penalties
Administrative fines up to THB 1 million, 3 million or 5 million per offence, depending on the provision.
As of 21 Oct 2026
Sources
- Royal Gazette (PDF)As of 21 Oct 2026