Most Thai businesses that think about PDPA at all picture a privacy policy page and a consent checkbox on a sign-up form—two things a lawyer helped write once, then filed away. On August 1, 2025, Thailand's Personal Data Protection Committee issued eight administrative fines across five separate cases, totaling roughly THB 14.5 million. Read the actual reasoning behind each one, and not a single case was fined for a missing checkbox.
The fines ranged from a state agency paying THB 153,120 to an IT retailer paying THB 7 million, and they crossed five completely different industries—a state agency, a hospital, an electronics retailer, a cosmetics company, and a toy company. It sounds like the lesson is "get your paperwork in order." Read case by case, the actual pattern is narrower and more specific: every fine traces back to what happened, or failed to happen, after a breach was already underway—not the paperwork that came before one. This piece walks through the five cases individually, what they have in common, and what that common thread actually means for how a Thai business should be organizing its customer data today.
None of the five 2025 PDPA cases were fined for a missing consent checkbox. Every one of them was fined for what happened, or didn't happen, in the days after a breach was already underway.
The Five Cases, Read Together
According to Tilleke & Gibbins, the PDPC's August 1, 2025 enforcement round broke down as follows:
- A state agency and its software developer, fined THB 153,120 each, after a breach affecting 200,000 data subjects—citing weak passwords, no risk assessments, and a missing data processing agreement between the two parties.
- A private hospital and a contractor, fined THB 1,210,000 and THB 16,940, after medical records were leaked during document destruction—citing inadequate security measures and failure to report the breach.
- A computer and electronics retailer, fined THB 7 million—the largest single fine of the round—after a breach fed directly into a call-center fraud operation, citing inadequate security, failure to report the breach, and no data protection officer ever appointed.
- A cosmetics company, fined THB 2.5 million, after customer data leaked to scam operators, citing failure to notify the PDPC of the breach.
- A collectible toy company and its data processor, fined THB 500,000 and THB 3 million, after unauthorized access affected roughly 200,000 records, citing inadequate security measures.
Five industries, five very different-sized businesses, one recurring shape to the story.
Response Infrastructure: What a Breach Needs That a Consent Form Never Covers
Call it Response Infrastructure: the specific, named capabilities a business needs the moment a breach happens—not before. Across all five cases, the violations cited weren't about whether consent had been collected in the first place. They were about security measures that weren't in place, breach notifications that weren't filed, and in the retailer's case, a data protection officer who was never appointed at all. A business can have a technically correct consent form and still be exposed on every one of those points, because Response Infrastructure is a completely different set of muscles than a privacy policy is.
The fine amounts themselves tell part of the story: THB 153,120 for the smallest case, THB 7 million for the largest. That's not a random spread—it reflects how each case's specific facts were assessed, including what data was exposed and what happened afterward. What stayed constant across every case, regardless of size, was the same category of gap: nobody had built the muscle memory for what to do in the hours and days after a breach, because nobody had assigned that responsibility to a specific role before one happened.
Why "We Have a Consent Checkbox" Isn't the Same as PDPA-Ready
The toy company's case is worth sitting with specifically, because roughly 200,000 records accessed without authorization sounds like a large enterprise's problem—until you notice the mechanism: unauthorized access to a records system, the same kind of reservation or customer database structure a mid-sized service business runs every day. A business doesn't need enterprise scale to be holding the same category of data at the same category of risk. It needs a records system, a vendor with access to it, and no clear answer to "who is responsible for noticing if something goes wrong here." For the fuller build-out of what a compliant customer database actually requires, see our guide to building a PDPA-ready customer database.
Picture a hypothetical three-branch phone repair chain called Witthaya Mobile Repair, keeping customer names, phone numbers, and device IMEI numbers in a shared repair-ticket app across all three locations. The app has a privacy notice, and customers tick a box before dropping off a device—by that narrow measure, Witthaya Mobile Repair looks compliant. But nobody at the company has been named the point of contact if that app's vendor reports a breach, nobody knows there's a 72-hour clock that starts the moment a breach is discovered, and nobody has checked in over a year whether the vendor is still storing passwords the way it promised to. The consent box being ticked never actually addresses any of that.
This is the same underlying weakness as the customer-data gap we've written about separately—a business that never built one legible customer data layer in the first place usually can't answer "where does this data live and who's responsible for it" either, which is exactly the question a breach forces overnight.
The Response Infrastructure Playbook
- Name a Data Protection Officer, Even a Part-Time One—the retailer's THB 7 million fine specifically cited the absence of a DPO; a named, accountable person is the starting point every other step depends on.
- Know the 72-Hour Clock—breach notification failure appears across nearly every 2025 case; know in advance who calculates that window and who files the notification when it starts ticking.
- Security Measures Are Not a One-Time Setup—weak passwords and missing risk assessments were cited in the smallest fine of the round, proving this isn't only an enterprise-scale failure.
- Vendor Contracts Need a Data Processing Agreement—the state agency's case specifically named a missing DPA between the agency and its developer; any vendor touching customer data needs this in writing before the relationship starts, not after an incident.
A furniture delivery company storing customer addresses and payment references in a shared spreadsheet with its outsourced logistics partner faces the identical exposure the toy company's case revealed—a vendor with unmonitored access to customer records, and no documented agreement governing what happens if that access is misused.
Response: what this all comes down to
If there's one word for what actually separated the businesses that got fined in 2025 from the ones that didn't, it's Response—not the size of the company, not the length of the privacy policy, just whether someone could detect a breach and act on it correctly before day three.
So here's the question worth sitting with: if your business discovered tomorrow that a vendor holding your customer data had been breached, do you know who calculates the notification deadline, and who actually files it? If the honest answer involves a pause and a phone call to figure out whose job that is, that's the exact gap four of the five 2025 cases were fined for.
FAQ
Were all five fined companies large enterprises?
No. The cases spanned a state agency, a hospital, an IT retailer, a cosmetics company, and a toy company, with fines ranging from THB 16,940 up to THB 7 million. Company size wasn't the determining factor—what happened after each breach was.
Does having a privacy policy protect a business from fines like these?
Not on its own. None of the five 2025 cases were cited for a missing privacy policy or consent mechanism. They were cited for inadequate security measures, missed breach notifications, and in one case, no data protection officer at all.
What is a DPO, and does a small business actually need one?
A data protection officer is a named person responsible for a business's data protection compliance, including breach response. The retailer's THB 7 million fine specifically cited its absence—a strong signal that "we'll figure it out if something happens" is not a defensible position once a breach occurs.
What's the fastest way to check if this gap exists in our business?
Ask, in writing, whether anyone at your company can name who would be notified first if a customer database vendor reported a breach today, and whether that person knows the 72-hour notification clock exists. If nobody can answer confidently, that's the exact Response Infrastructure gap this enforcement round was built around.
What this looks like with NAWA CRM
None of NAWA CRM's features are a substitute for legal compliance advice, but a single customer record with visible ownership and a shared activity timeline makes it easier to know what customer data exists, who has touched it, and how quickly your team could answer a straightforward question about it—exactly the kind of readiness that separates a fast, defensible response from the silence that turned a breach into a fine in these 2025 cases.
If you're not confident your business could answer "who is responsible for our customer data, and where does it actually live" today, talk to us about mapping your current customer data setup.
Sources: Tilleke & Gibbins, "More Than a Warning: Eight Serious Fines Imposed in Thai Data Protection Cases"