Thai Cyber Security: Public-Private Build-Out and PDPA Enforcement

Questions this report answers

What's the 2025 threat-landscape picture? Per Nation Thailand: NCSA logged 1,002 cyber incidents in the first 5 months of 2025 — extrapolating implies a 2,400+ incident-volume trajectory for the full year, well above the 2024 baseline. Per Chiang Rai Times: 63%🔒 of Thai organisations experienced data breaches in 2025; 52%🔒 admitted to paying ransom (both well above ASEAN averages). Per Thailand Insurance: breach costs ranged USD 430K🔒-1.4M🔒 per incident, prompting a structural surge in corporate cyber-insurance demand.^{[6, 5, 7]}

What changed in the 2025 regulatory perimeter? Per Lexology and Silk Legal: the 2025 NCSA notification replaced earlier 2023 classifications, expanding the Critical Information Infrastructure (CII) designation to include cloud platforms, data centres, and managed IT services. The structural implication is significant — many private-sector Thai operators that were previously outside CII designation are now covered. CII operators face mandatory NCSA-approved cyber-control standards, periodic risk assessments and technical audits, statutory incident-reporting timeframes, and cooperation with NCSA investigations.^{[1, 8]}

How do the Cybersecurity Act and PDPA work together? Per Siam Legal and PDPA-report cross-reference: the two regimes operate as a coordinated enforcement stack. NCSA enforces the Cybersecurity Act on CII operators (and increasingly private-sector entities); PDPC enforces PDPA on data controllers and processors. Both require security measures and breach-notification timeframes; failure on either side faces enforcement consequences. PDPC's August 2025 batch of 8 fines / 5 cases / >THB 21.5M🔒 total demonstrates the practical enforcement reality. Sector-specific regulators (BOT for banking, SEC for securities, NBTC for telecom) coordinate cyber-supervision with NCSA on standards and audits.^{[9, 4]}

What's the corporate compliance cost structure? Per Formichella and Sritawat: 2025 mandatory technical and organizational website-security protocols apply to government agencies, regulatory bodies, CII operators, and designated private entities. Thai operators must invest in technical controls (firewalls, EDR, SIEM, vulnerability management), MSSP partnerships (24/7 SOC, incident response), DPO appointment, breach-response capability, and increasingly cyber-insurance to transfer residual risk. Per BSA's Cybersecurity Act amendment comments: foreign-tech vendors face additional regulatory engagement on draft amendments to the Cybersecurity Act.^{[2, 3]}

Executive summary

Thailand's cyber-security landscape entered 2026 in a state of structural escalation. NCSA logged 1,002 incidents in the first 5 months of 2025 (extrapolating to 2,400+ for the full year); 63%🔒 of Thai organisations experienced data breaches and 52%🔒 paid ransom per Chiang Rai Times; breach costs ranged USD 430K🔒-1.4M🔒 per incident per Thailand Insurance. The volume, breach rate, and ransom-payment rate are all materially above ASEAN regional averages — Thailand is now a higher-risk cyber jurisdiction than Singapore, Malaysia, or Vietnam.^{[6, 5, 7]}

The regulatory regime expanded in parallel. The 2025 NCSA notification (per Lexology / Silk Legal) extended Critical Information Infrastructure (CII) classification to cloud platforms, data centres, and managed IT services — bringing many private-sector operators under direct NCSA jurisdiction for the first time. CII obligations include NCSA-approved cyber-control standards, periodic risk assessments and audits, statutory incident-reporting timeframes, and investigation cooperation. The Cybersecurity Act and PDPA now operate as a coordinated enforcement stack: PDPC issued more than THB 21.5M🔒 in fines across 5 cases in 2025 for security and breach-notification failures. Sector-specific regulators (BOT for banking, SEC for securities, NBTC for telecom) coordinate with NCSA on standards and audits.^{[1, 9]}

The corporate-compliance response is structural compliance-budget growth across technical controls, MSSP partnerships, DPO appointment, breach-response capability, and cyber-insurance. The cyber-insurance market saw a structural demand surge in 2025 — once a niche product, now central to corporate risk management per Thailand Insurance. The 2026 outlook is continued threat-volume growth (AI-era attacks, ransomware, supply-chain), continued regulatory expansion (CII designation likely extends further; Cybersecurity Act amendments in BSA-comment phase), and continued compliance-budget expansion across both public and private sectors. For institutional investors, Thai-listed cybersecurity service providers and MSSPs face structural demand tailwind.^{[7, 3]}

Cyber-incident metrics and 2025 enforcement