Per Thailand PDPA Section 37(4): breach notification + enforcement. Requirements include (a) implement Data Breach Notification - notify PDPC within 72 hours of becoming aware of breach unless unlikely to result in risk + notify affected data subjects where high risk + (b) operate Security Incident Response Procedures including detection + triage + containment + recovery + lessons learned + (c) operate Complaints Handling mechanism for data subjects + (d) maintain Compliance Monitoring and Auditing + Regulatory Reporting and Cooperation with PDPC + (e) maintain Enforcement and Penalties awareness including administrative penalties + criminal penalties + civil liability + (f) maintain documented breach log + incident response + tabletop exercises + (g) integrate with broader incident management.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.