PDPC Reports 4,210 PDPA Complaints and 1,650 Data Breaches

The Office of the Personal Data Protection Committee (PDPC) held an event titled "PDPC Clears the Air: Answering Every Question on PDPA," creating a close dialogue with media outlets and releasing statistics on 4,210 complaints and consultations and 1,650 personal data breach notifications, reflecting Thailand's personal data protection landscape while clarifying the PDPC's limits and investigation processes before ruling on PDPA violations.

Pol. Lt. Col. Surapong Ploengkham, Secretary-General of the Personal Data Protection Committee, stated that media plays a crucial role in helping the public understand personal data rights, as many PDPA-related incidents start from relatable issues before being amplified rapidly through mass, online, and social media. Accuracy from the outset directly shapes public understanding. "The PDPC views media not just as news reporters but as key partners in making PDPA — which may appear complex — understandable so citizens know their rights and organizations know their duties. We therefore want to give media a space to ask direct questions, especially on trending social issues."

The PDPC also summarized its proactive and reactive operations, revealing 4,210 complaints and consultations — a key indicator of public awakening to data rights. Of these, 3,889 complaints targeted the private sector and 321 targeted the public sector. The top three cited violations were: Section 27 (disclosure without consent) at 1,025 cases; Section 4 (exemptions for personal benefit) at 724 cases; and Sections 24/26 (personal data collection) at 586 cases.

Beyond complaints, 1,650 data breach notifications were received from 2023 through May 31, 2026. These split into non-cyber incidents (849 cases, 51.45%), cyber incidents (747 cases, 45.27%), and other causes (54 cases, 3.28%). Cyber breaches included 567 cyber threat cases and 180 social media cases, while non-cyber breaches largely involved human error.

The financial, investment, and insurance sector reported the most breaches (723 cases), followed by government agencies and state enterprises (206), retail/wholesale and e-commerce (204), energy/utilities/manufacturing (105), and public health (87).

Of the 1,650 total incidents, 569 remain under investigation, 1,071 are under monitoring, 9 were referred to the expert committee, and 1 was sent to the consultation and complaint center. "The figure of 1,650 incidents shows clearly that data leaks are not just about 'being hacked,' since over half fall under non-cyber and human error. Prevention must therefore look beyond cybersecurity alone."