Test the Security Measures PDPA Section 37 Requires
Section 37(1) requires every data controller to maintain appropriate security measures. The Act names no test, so our penetration testing gives you evidence that those measures work.
What is the PDPA?
The Personal Data Protection Act B.E. 2562 (2019) is Thailand's data protection law. It governs how organizations collect, use, and disclose personal data.
- Governs collection, use, disclosure, and transfer of personal data
- Applies broadly to organizations that handle personal data, with exemptions listed in Section 4
- Enforced by the Personal Data Protection Committee (PDPC)
Reference: Personal Data Protection Act B.E. 2562 (2019), published in Royal Gazette
Who Must Comply with PDPA?
The PDPA applies broadly to organizations that collect, use, or disclose personal data. Section 4 lists the exemptions.
Financial Institutions
Banks, insurers, and payment processors handling client financial data
Healthcare Providers
Hospitals, clinics, and health-tech companies processing patient records
E-Commerce & Retail
Online platforms and retailers collecting client information
Technology Companies
SaaS providers, app developers, and IT service companies
Any Company with Client Data
Any business collecting names, emails, phone numbers, or IDs
Government Agencies
Public sector organizations processing citizen data
Key PDPA Compliance Requirements
What the Act and its Security Measures Notification require, and where Reconix adds a recommendation.
Appropriate Security Measures
Section 37(1) requires appropriate security measures, reviewed when necessary and when technology changes. The Security Measures Notification 2565 adds review after any breach that carries risk, and requires measures matched to risk and designed with regard to standards recognized for similar organizations.
Security Testing (Reconix Recommendation)
The PDPA and its Security Measures Notification name no testing. In our view, penetration testing and vulnerability assessment are a common way to show your security measures work and to support each review.
Breach Notification within 72 Hours
Under Section 37(4), notify the PDPC Office of a personal data breach without delay and, where feasible, within 72 hours of becoming aware of it, unless the breach carries no risk. For high-risk breaches, also notify data subjects with the remedial measures.
Processor Duties
Under Section 40(2), processors keep security measures and tell the controller about personal data breaches.
Penalties for Non-Compliance
The PDPA provides for administrative fines, criminal penalties, and civil liability. This page does not cover penalty amounts; confirm them with your counsel.
Administrative fines. Confirm amounts and conditions with your counsel.
Criminal penalties. Confirm amounts and conditions with your counsel.
Civil liability. Confirm scope and conditions with your counsel.
How Penetration Testing Supports PDPA
Reconix recommendation: the tests we match to systems that handle personal data. The PDPA names no specific test.
PDPA Compliance Checklist
Reconix recommendations that support Section 37. The Act does not list these items.
Official References
Consult the original regulatory documents for full requirements.
Related Security Services
Testing services for systems that handle personal data.
PDPA Compliance FAQ
Common questions about PDPA penetration testing and compliance requirements.
Get PDPA-Ready Today
Protect personal data, test the security measures Section 37 requires, and get reports that document what we tested and what you fixed.
Reconix is the proof-first offensive security specialist in Thailand, serving regulated digital businesses of all sizes.