Data Breach Response Kit: 12 Forms + Guide
The Data Breach Response Kit is a set of 12 ready-made forms and a guide for handling a personal data breach under the PDPA, from detecting the incident and assessing risk to notifying the PDPC Office within 72 hours and closing the case. It is for organisations that want a response process in place before an incident, priced at THB 2,990.
Both buttons open the secure Stripe payment page (Kooru does not store card numbers) · Questions before you buy? Ask an expert on LINE
The full set of 4 documents totals ฿6,460 · each can be bought separately
Use together · from the Kooru network
| This Word file | AiPDPA | Kooru legal team | |
|---|---|---|---|
| Who fills it in | You do | Generated from your company data | The legal team does it |
| Scope | This document | A full set for your business | Gap Analysis + system set-up |
| Price | ฿2,990 | See plans ↗ | From ฿5,900 |
A data breach: you have 72 hours before facing a fine of up to THB 3,000,000.
An employee sends an email to the wrong person, a single phishing attack, or a sudden system outage can immediately make you a data controller in breach of the PDPA. The law does not distinguish between intentional and unintentional breaches. Administrative fines of up to THB 3,000,000 for failing to secure data or notify a breach (Section 37), civil liability and reputational damage await the company.
The problem for most Thai companies is not knowing what to do in the first 72 hours: no forms, no procedure, no DPO ready to act. The result is a missed deadline for notifying the PDPC Office, repeated penalties and a lasting loss of customer confidence. If the PDPC Office investigates and no documents are available, the remaining option is to hire a lawyer to defend the case, at a cost that starts in the hundreds of thousands of baht, with no guarantee of outcome.
This kit addresses these problems with 12 ready-made documents covering the whole process:
- 001 SOP + 002 DPO appointment order: set up the system before an incident occurs
- 003-004 Incident report + risk assessment: completed and sent to the DPO within 4 hours
- 005 Breach register + 010 Timeline Tracker: track the full 72 hours
- 006 Investigation report + 007 Evidence checklist: investigate in a professional manner
- 008 Notice to data subjects + 009 Notice to the PDPC Office: send within the legal deadline
- 011 Remediation plan + 012 Case closure report: close the case end to end
Every file is a ready-made template that you fill in with your details, consistent with the PDPA B.E. 2562 (2019) and ISO 27001. It comes with a guide, and the Kooru legal team, Thai lawyers and Barristers-at-Law who have completed DPO training, provide a free initial consultation if a dispute arises.
The price of this kit is THB 2,990, against a potential fine of up to THB 3,000,000.
The document files are provided in Thai.
What you get in this product:
- [PDPA] Data Breach Response Kit: 12 forms + guide (1 set)
– 001 Data Breach Response Policy and Procedure (Data Breach Response SOP)
– 002 Order appointing the DPO and working group
– 003 Initial Incident Report
– 004 Risk Assessment + 72hr Decision form
– 005 Breach Register / Log
– 006 Internal Investigation Report
– 007 Evidence Preservation Checklist
– 008 Notice of data breach to data subjects
– 009 Notice of personal data breach to the PDPC Office
– 010 Notification Timeline Tracker
– 011 Remediation & Preventative Action Plan
– 012 Post-Incident Review Report - User guide (1 set)
- Register via LINE @kooru to receive consultation in the event of a dispute
Frequently asked questions
How many documents are in the Data Breach Response Kit and what are they?
12 documents: a breach response SOP, a DPO appointment order, an initial incident report, a risk assessment, a breach register, an investigation report, an evidence checklist, a notice to data subjects, a notice to the PDPC Office, a Timeline Tracker, a remediation plan and a post-incident review report.
How much is this data breach response kit?
THB 2,990. You receive 1 set of 12 forms, 1 user guide, and registration via LINE @kooru for an initial consultation in the event of a dispute. The documents are consistent with the PDPA B.E. 2562 (2019) and ISO 27001.
How does the kit help with the 72-hour notification deadline?
It includes a risk assessment and notification decision form (72hr Decision) and a Notification Timeline Tracker to track the time frame, together with notices to the PDPC Office and to data subjects that you complete and send.