Thailand’s PDPC issues eight severe fines under PDPA

Thailand’s Personal Data Protection Committee (PDPC) announced hefty fines in eight cases under the Personal Data Protection Act (PDPA). The penalties follow various acts of mishandling data, including insufficient security measures, using sensitive records in ways that fail to meet regulatory standards (including wrapping merchandise), failure to appoint a Data Protection Officer, failure to notify the controller, and more. 

‍

According to the regulator, these cases mark a transition from education-only responses to active financial sanctions, signalling that the Thai regulator expects full compliance from public- and private-sector bodies alike.

‍