PDPC is gathering evidence within 30 days on government agencies whose weak passwords and access controls exposed citizens' personal data, and may pursue administrative and criminal action. Experts say weak or guessable passwords and poorly managed outsourced contractors are the main causes. For a Thai business that handles customer personal data or builds software for clients, this signals stricter expectations: use strong, unique passwords with access limits, and put PDPA data-processing terms in vendor contracts, since the law can reach subcontractors.