The Personal Data Protection Act B.E. 2562 (“PDPA”) mandates prompt notification to the authority and/or affected data subjects in the event of a data breach. Despite this requirement, many operators have historically hesitated to report breaches due to fear of potential non-compliance with the PDPA.

According to the recently released third-quarter data breach findings reported under the Notifiable Data Breach Scheme (NDB), the Office of the Australian Information Commissioner (OAIC) has found that human error is the major cause of email data breaches.