Per Thailand PDPA Section 37: implement appropriate security measures. Requirements include (a) implement Security Measures including organisational + technical + physical measures appropriate to risk + (b) implement Encryption of personal data at rest + in transit + appropriate to classification + (c) implement Pseudonymization Techniques where appropriate + (d) implement Access Control for personal data including authentication + authorisation + audit + (e) conduct Regular Security Testing and Assessment + (f) integrate with broader information security programme + (g) maintain documented security measures aligned to PDPC guidance + minimum standards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.