Personal Data Protection – Duties after your business faces a cyber-attack or hacking

Author: Yothin Intaraprasong, Yuyu Komine, Poonyisa Sornchangwat (Co-author)

Download full text (PDF)

Publisher: Nagashima Ohno & Tsunematsu

Journal / Book: NO&T Thailand Legal Update No.8 (January, 2021)

Reference

Practice Areas

*Please note that this newsletter is for informational purposes only and does not constitute legal advice. In addition, it is based on information as of its date of publication and does not reflect information after such date. In particular, please also note that preliminary reports in this newsletter may differ from current interpretations and practice depending on the nature of the report.

Background
From time to time, there are news reports of hackers breaching computer systems through the use of ransomware or by other means resulting in, in many cases, the breach of personal data and the leakage thereof in large numbers. To many business operators who, in their normal course of business, are in possession of the personal data of their clients or customers to handle, this may lead to one of the most essential questions: “What do we do next?”

To address such question with respect to the soon-to-be-fully-enforced Personal Data Protection Act of 2019 (“PDPA”) which is currently scheduled to be fully enforced from 1 June 2021 onwards, we will, in this article, discuss about the general duties of the business operators who act as data controllers and/or data processors under the PDPA once they face a cyber-attack or hacking that results in them being the victims of the breach of personal data after the PDPA becomes fully enforced. Importantly, the cyber-attacks or hacking may be regulated by and punishable under other relevant laws as well such as Cyber Security Act of 2019 or Computer Crime Act of 2007, however, such laws shall be discussed on another occasion.

Download Newsletter PDF