Cybersecurity & PDPA Compliance Services in Thailand

Where most Thai businesses are actually exposed

In our assessment work the same six gaps recur: shared administrator accounts, no audit logging, unencrypted backups, third-party vendors holding unmanaged standing access, no working consent-withdrawal path, and no ability to answer whether data has been accessed improperly.

None of these require advanced tooling to fix. They persist because nobody owns them, not because the technology is difficult or expensive. That is genuinely good news — it means most of the risk reduction available to a Thai SMB costs configuration time rather than licence fees.

The last gap is the one that matters most under the PDPA. The Act expects notification of qualifying breaches within 72 hours, and 72 hours is not enough time to build detection capability after an incident has already happened. If you cannot currently answer "has anyone accessed this improperly?", that is the first thing to fix, ahead of everything else.

PDPA and ISO 27001, run as one programme

PDPA is Thai law and mandatory; ISO 27001 is a voluntary international framework. Their controls overlap heavily — access control, encryption, logging, incident response and supplier management satisfy both — so running them as a single workstream costs substantially less than two separate projects.

The efficient order is PDPA first, because it is legally required, then ISO 27001 layered on top. By the time the PDPA technical work is complete you will have produced the data inventory, access review and incident-response plan that ISO 27001 also requires.

Be aware that ISO 27001 certification does not by itself make you PDPA compliant. The PDPA additionally requires a lawful basis for processing, recorded consent, and the ability to honour data-subject requests within 30 days — none of which the standard addresses.

What an assessment produces

A written gap list mapped to specific controls, prioritised by risk and by effort, with an indicative cost against each item. You keep the findings whether or not you engage us — they describe your environment, and withholding them would make the assessment a sales device rather than a service.

We do not open with a product recommendation. Most assessments conclude that the highest-value actions are configuration changes to systems you already own, and a report that ignores those in favour of something to sell is not an assessment.

Where remediation genuinely does require investment — a SIEM, endpoint detection, a penetration test — we say so, price it, and explain what risk it removes. You should be able to decline any individual line and still have a coherent plan.

• Access review — who can reach what, and whether they still need to
• Logging and detection — can you evidence improper access if asked?
• Backup integrity — tested restores, and whether backups survive ransomware
• Patch posture — what is exposed and how long it has been exposed
• Third-party access — vendors with standing credentials into your systems
• PDPA readiness — data inventory, lawful basis, consent records, DSAR capability

Ongoing monitoring versus a one-off project

A penetration test tells you your posture on one day. Monitoring tells you when it changes. Most Thai SMBs are better served by continuous logging and alerting than by an annual test, because the realistic threat is opportunistic scanning against known vulnerabilities, not a targeted adversary.

Penetration testing has real value once the fundamentals are in place — it is how you find the issues that scanning misses. Commissioning one before you have patching, MFA and logging working tends to produce an expensive report confirming what you already suspected.

Our SOC service is included in the Enterprise managed IT tier and available standalone. Either way the commitment is the same: defined response times for security incidents, in writing, with escalation contacts agreed before anything happens.