General information only, not advice on a specific case. Check the version of the law in force.
Official sources
Legal service for foreign clients
PDPA Personal Data Breach Claims in Thailand
Complaints, damages claims or defence when personal data is misused or leaked.
Quick answer
Where personal data is collected, used or disclosed in breach of the Personal Data Protection Act B.E. 2562, the data subject may complain to the expert committee and claim compensation under section 77; the court may add punitive damages of up to twice the actual damages under section 78. Organisations must assess and notify breaches within the period in section 37(4).
Contact our team for a quotation — Contact our team for a quotation; government fees are billed separately. · Timeframe stated in the quotation
Who this is for
- Individuals whose data was leaked or used without a lawful basis
- People refused access or erasure requests
- Organisations facing a breach and notification duty
- Organisations facing a PDPA complaint or claim
What you receive
- Assessment of processing basis and evidence of damage
- Drafting data-subject requests or demand letters
- Filing complaints with the PDPC Office
- Civil claims or defence, and advice on criminal exposure
- For organisations: incident assessment and notification preparation
Documents to prepare
- Evidence of the leak or use, e.g. screenshots, emails
- Any breach notice received from the organisation
- Evidence of loss, e.g. unauthorised transactions
- Copies of rights requests and replies
How it works
3-step process
- 1
Preserve evidence and assess
We gather evidence and check whether processing lacked a lawful basis or security measures were inadequate.
- 2
Check limitation
Section 78 sets three years from knowing of the damage and the responsible controller or processor, or ten years from the violation.
- 3
Choose the route
We compare an administrative complaint with a civil claim; administrative fines go to the state, not to the complainant.
FAQ
Frequently asked questions
Can I sue as soon as my data leaks?
You must show damage and a PDPA breach. Under section 77 the controller or processor is liable unless it proves force majeure, the data subject's own act, or compliance with a lawful official order.
How fast must an organisation notify a breach?
Section 37(4) requires notifying the Office without delay, within 72 hours of becoming aware where feasible, unless there is no risk to rights and freedoms; data subjects must also be told where the risk is high.
Is there criminal liability?
In some cases, such as unlawful use or disclosure of sensitive data under section 79. Ordinary cases involve civil liability and administrative fines; the facts must be checked case by case.
Related services
PDPA Compliance & Data Protection Counsel
Making every use of customer and staff data explainable — before someone complains.
Cybercrime, Data Breach, and Liability for AI Systems
When data leaks the clock starts at once, and the law measures from when you knew — not from when the review is finished.
Civil Litigation — Contract Breach & Damage Claims
Trial team across all Thai civil courts — from complaint to enforcement.
Written by: Thai Law & Accounting Services — attorneys and licensed accountants
Professional review: A lawyer must review the applicable law and facts before use in a real matter. This notice does not establish that this page has been reviewed or certified by a lawyer.
Last updated: 2026-08
Information as of August 2026. Government fees and processing times change — verify with the relevant agency before acting, or let our team verify for you.