Data Breach Notification Measures under the Personal Data Protection Laws

Abstract

This article aims to study issues related to the notification of personal data breaches under the Personal Data Protection Act B.E. 2562, with a particular focus on determining when it can be considered that the data controller has become aware of the breach. The author conducted a study of the Personal Data Protection Act of Thailand alongside the General Data Protection Regulation (GDPR) of the European Union. This study includes an examination of the notification guidelines provided by the European Data Protection Board (EDPB), as well as the guidelines for interpretation by personal data protection supervisory authorities of the European Union regarding the determination of the timeframe for considering when the data controller becomes aware of a personal data breach.

The purpose of this study is to analyze and advocate for the establishment of clear guidelines regarding the timeframe for data controllers to become aware of personal data breaches, enabling them to notify such breaches within the legally specified timeframe. Furthermore, it also aims to protect the rights of data subjects by ensuring they receive appropriate and accurate notifications of personal data breaches in accordance with the law.