No Let-Up in PDPA Enforcement: PDPC Issues New Fines and Tightens Compliance Measures

Personal Data Protection Committee (PDPC) recently released a press statement addressing importance on laws concerning personal data protection, especially in cases where organizations collect, use or disclose a large amount of both sensitive personal data without implementing adequate security measures. They also issued administrative fines to private and public organizations for failing to implement adequate personal data security measures, notify the PDPC of personal data breaches and to appoint a Data Protection Officer as required under the Personal Data Protection Act (PDPA).
Following a previous case last year 2024 where a major e-commerce company was fined at 7 million Baht, the PDPC continued its enforcement in the year 2025, issuing penalties to both public and private entities that violated or failed to comply with the PDPA. This represents a significant milestone, emphasizing that data protection is more than just an internal management concern but a responsibility to safeguard citizens' fundamental rights.