Cybersecurity and Privacy Protection at True

Cybersecurity and personal data protection are critical issues across all industries, but network and communication technology providers play a fundamental role in mitigating and safeguarding users from rights violations and online threats. Therefore, True must rigorously pursue cybersecurity and personal data protection efforts, including the establishment of control measures, audits, and continuous improvement of management practices to meet standards consistently. This also involves building internal staff capabilities, educating business partners, collaborators, and continuously educating users and consumers. This ensures the creation of a secure digital environment for everyone, reducing legal, financial, and reputational risks for the Company.

GOVERNANCE AND STRUCTURE

One of True’s missions is to prioritize the management of personal data security in accordance with the Personal Data Protection Act B.E. 2562 (PDPA), as well as international guidelines and standards, such as the ISO 27001 Information Security Management Standard, covering all business units, including TrueMove H, True Online, TrueVisions, and True Digital.

The company has established the IT & Security Division and the Business Security Department under the Chief IT and Security Officer (CISO). It reports the results of Information Security and Cyber Security operations to the Risk, Cybersecurity, and Finance Committee, as well as to the management committee. Additionally, a Data Protection Division has been established to specifically manage personal data protection issues. Its main responsibility is to control the personal data protection processes in accordance with the company’s policies and the PDPA. This division operates under the Chief Corporate Affairs Officer Group and reports progress and operational results to the Corporate Governance and Sustainability Committee and the management committee.

In general, the scope duties and responsibilities of the Risk, Cybersecurity and Finance Committee in relation to cybersecurity and privacy protection include:

Oversee risk policy framework and process for risk management of the Company, including all strategies, policies, rules and operational manuals to determine, evaluate, monitor and recommend cybersecurity risk, and data privacy risk to the Board of Directors;
Regularly review the policy framework and process for cybersecurity and data privacy risk and propose recommendation for revision to the Board of Directors and determine risk metrics of the Company’s business;
Promote and implement the policy by enhancing the level of cybersecurity risk awareness through the development of appropriate procedures and commitment of resources;
Support the monitoring of risks including cybersecurity risk and data privacy risk across the Company and regularly report to the Board of Directors;
Oversee and review the cybersecurity and privacy protection management and performance of the Company, including meeting regularly with management and commenting and giving opinions on any recommendations of management to the Board of Directors regarding long and short term strategies, expenses, etc.
Monitor and evaluate the cybersecurity and privacy protection performance of the Company against the Company’s budget

Mr. Vichaow Rakphongphairoj previously served as Group Chief Operating Officer of True Corporation Public from 2008 to 2016 overseeing network and technology operations including information technology and cybersecurity. He was subsequently appointed Deputy Chief Executive Officer from 2016 to 2017 and later served as Co-President from 2017 to 2019.

CYBERSECURITY & DATA PROTECTION POLICY

Cybersecurity and data protection are critical concerns globally, particularly in the telecommunications industry, which faces over 6 billion cyberattacks annually.

High ethical standards form the foundation of the Company’s business practices, applied to employees, business partners, and stakeholders across all regions and situations. Organizational integrity is seen as a key indicator of success and sustainable
growth.

At True, we are committed to upholding the highest standards of cybersecurity and data protection to safeguard customer, partner, and employee information. To reinforce our commitment to protecting data and maintaining a secure digital ecosystem, True has developed and implemented the True Information Security Policy, which provides a comprehensive framework for managing information security risks across our operations.

The policy outlines our strategic direction and operational approach to ensure business continuity, safeguard stakeholder trust, and comply with relevant legal and regulatory requirements. It covers a wide range of critical areas, including but not limited to:

Ensuring the integrity, confidentiality, and availability of data and IT assets
Establishing clear roles, responsibilities, and accountability for information security across all levels of the workforce
Defining information security requirements for third parties, including suppliers and service providers
Managing access control and protecting against unauthorized access, loss, or misuse of data
Promoting information security awareness and training to build a culture of vigilance
Supporting secure system development and changing management processes
Monitoring, detecting, and responding to information security threats in a timely and effective manner
Ensuring incident response procedures are in place to manage and mitigate potential breaches
Conducting audits and reviews to assess compliance and identify areas for improvement
Continuously improving information security systems through regular assessments and updates

This policy is reviewed regularly and integrated into True’s broader risk management and governance frameworks.

In addition, as part of our commitment to continuous improvement, True has appointed dedicated IT and Information Security personnel responsible for overseeing the performance and advancement of our security systems. Regular cross-functional meetings are conducted with relevant departments and management level to assess the status of IT operations and identify any security-related issues or opportunities for improvement. Through this structured engagement, key findings and proposed enhancements are escalated to management for timely review and decision-making.

IT & SECURITY STRUCTURE AND RESPONSIBLE PERSONNEL

The IT & Security Division and the Business Security Department both report to Chief IT and Security Officer (CISO). These units are responsible for overseeing data and cybersecurity operations and report their performance to various committees, including the Risk, Cybersecurity and Finance Committee, as well as the company’s Board of Directors.

The CISO has the following duties and responsibilities:

Establish procedures for controlling and auditing third parties and external agencies authorized to access the company’s data and assets, ensuring strict adherence to this policy.
Regularly review the company’s policies and practices related to information and cybersecurity, assess risks, and ensure that high-risk issues are recorded in the company’s risk register.

Additionally, the Head of Security was appointed with the primary responsibility of ensuring that data and asset security operations align with company policies and providing performance progress updates, including reports on any policy violation incidents.

True has Personal Data Protection Policy designed in accordance with the PDPA framework, which is enforced rigorously within the Company, including subsidiaries, business partners and those appointed to act on behalf of the Company. One key aspect of the policy is defining the Company’s role as a “Data Controller,” which entails the authority to determine the purposes and methods of processing personal data arising from business operations. This is considered the duty and responsibility of the Company as the Data Controller, requiring various measures to ensure effective and appropriate data protection under PDPA principles and using customer data only for the purposes for which consent has been provided.

Additionally, a Data Protection Officer (DPO) is appointed, tasked with providing guidance to management, employees, and relevant individuals on risks and best practices regarding personal data processing. The DPO reports non-compliance and policy violations to the Company’s management and operates independently to review the use of personal data within the Company’s internal activities without interference.

The policy includes other important aspects in line with the PDPA, such as:

Defining the responsibilities of employees or authorized personnel who access personal data, along with implementing controls and access limitations.
Clearly defining the duration of data retention, usage, and destruction, as specified in customer consent agreements, and strictly adhering to these guidelines.
Establishing procedures to control and audit partners and external entities authorized to access personal data from the Company, ensuring strict compliance with this policy.
Making personal data protection a focal point in internal audits across all business operations, reporting audit findings to the Audit Committee, and taking immediate corrective actions upon discovering violations or policy breaches.
Regularly reviewing policies, practices and assessing risks related to personal data, with high-risk issues being documented in the Company's risk register.
Establishing data storage and maintaining records of customer personal data.
Providing channels for complaints and reporting situations that may deviate from or violate policies and practices.
Enhancing employee understanding and capabilities through communication, knowledge training, and awareness-building initiatives.

The Company assesses and reviews its personal data sharing processes and practices with internal entities and third parties annually, conducted by both internal and external auditors to ensure privacy policy compliance.

IT & SECURITY MANAGEMENT PROGRAM

To ensure the integrity, resilience, and continuous improvement of our cybersecurity infrastructure, True has developed a comprehensive IT system and audit framework aligned with international standards and industry best practices. This framework is designed not only to protect data and digital assets but also to strengthen stakeholder confidence through transparency and accountability.

Key elements of our IT system and testing/audit program include:

Security Management Systems & Operational Procedures

True has established formal security management systems that integrate key components such as risk assessment, access control, data protection, and incident response. These are supported by:

A regularly tested Business Continuity Plan (BCP) to ensure operational resilience
- This process clearly outlines roles, responsibilities, and communication channels to promptly escalate incidents to appropriate response teams and management, ensuring timely containment, investigation, and resolution of security events A defined escalation process for managing security incidents
Clearly documented internal procedures, such as the “Information Security Incident Response Procedure” and “IT Risk Management Guidelines“
- These procedures provide step-by-step guidance for identifying, reporting, analyzing, and mitigating information security risks and incidents, supporting consistent and effective handling aligned with organizational policies and compliance requirements

Certification: ISO/IEC 27001

True has established a comprehensive cybersecurity and data protection framework aligned with international standards to safeguard sensitive information and maintain digital resilience.
The Company achieved ISO/IEC 27001:2022 certification, reflecting full compliance across all operations. In 2024, True successfully upgraded its ISO 27001 certification from 2013 to the 2022 version, covering all business operations and ensuring 100% compliance and keeping maintained with 2022 version.

3. Data Governance & Operational Safeguards

Data Classification & User Access Review:
- Annually conducted to categorize data based on sensitivity and manage access rights accordingly.
Data Loss Prevention (DLP):
- Annually Fully implemented DLP systems to prevent unauthorized data leaks.
Disaster Recovery Plan (DRP):
- DRP and Incident Response Plans are reviewed semi-annually for critical systems.

4. Penetration Testing, Vulnerability Scanning & Threat Response

Penetration and Vulnerability Testing:
- Includes simulated attacks and abnormal behavior detection using advanced analytics for real-time threat prevention.
- Performed annually to assess over 2,000 servers for system weaknesses and strengthen cyber defenses.
Vulnerability Analysis & Threat Management
- A regular vulnerability assessments and threat analysis activities is conducted to identify potential system weaknesses.

5. Employee Awareness & Capacity Building

Cybersecurity Awareness Training: 100% of employees participated in both online and on-site training sessions to promote a security-first mindset.
Security Personnel & Governance: A dedicated cybersecurity team and responsible officers—including the appointed Data Protection Officer (DPO)—oversee policy implementation, threat monitoring, and issue escalation to management.

PERSONAL DATA PROTECTION POLICY

The policy includes other important aspects in line with the PDPA, such as:

Defining the responsibilities of employees or authorized personnel who access personal data, along with implementing controls and access limitations.
Clearly defining the duration of data retention, usage, and destruction, as specified in customer consent agreements, and strictly adhering to these guidelines.
Establishing procedures to control and audit partners and external entities authorized to access personal data from the Company, ensuring strict compliance with this policy.
Making personal data protection a focal point in internal audits across all business operations, reporting audit findings to the Audit Committee, and taking immediate corrective actions upon discovering violations or policy breaches.
Regularly reviewing policies, practices and assessing risks related to personal data, with high-risk issues being documented in the Company’s risk register.
Establishing data storage and maintaining records of customer personal data.
The Company will only use personal data for marketing, promotional, or analytical purposes with the customer’s prior consent.
Customers have the right to withdraw their consent for specific data processing at any time.

Enhancing employee understanding and capabilities through communication, knowledge training, and awareness-building initiatives.
Providing channels for complaints and reporting situations that may deviate from or violate policies and practices.
Punitive measures in case of privacy policy violation by any employees, suppliers or business partners, the company will consider taking punitive measures according to our regulations and/or taking appropriate legal action.

During 2025, we fulfilled 100% of all customer requests for data access, correction, deletion, and
portability, while also handling 826 inquiries for Call Detail Records (CDR). Additionally, 71% of customer personal data is used for secondary purposes in accordance with the company’s policy with prior consent obtained from the customers.

HANDLING AUTHORITY REQUESTS FOR DATA DISCLOSURE

COMPLIANT REPORTING AND HANDLING, REMEDIATION AND PUNISHMENT

True provides channels for employees, customers, partners, and the general public to report complaints and situations that may violate or deviate from the company’s policies and practices regarding data security and customer data protection. These reports are handled through processes involving assessment, investigation, inquiry, mediation, and penalties for violations of the company’s Code of Conduct. The Compliance & Ethics Department oversees these processes. In the event of personal data breaches, the company has effective legal remedies in accordance with PDPA criteria and methods. If violations that contravene policies are identified, legal penalties will be considered. Additionally, if company employees violate policies and practices, they will face disciplinary action in accordance with the Code of Conduct and may be subject to legal penalties as prescribed by law.

e-mail: TruePrivacy@truecorp.co.th
CyberSOC@truecorp.co.th

True Call Center 1424
dtac Call Center 1678

Every Branch of True and dtac Shops

RESPONSIBLE ARTIFICIAL INTELLIGENCE (RAI)

True Corporation has embraced artificial intelligence as a core pillar of its strategic direction, using AI to modernize its network, protect its customers, and strengthen its communities. As AI adoption accelerates across the business including governance, processes, and culture needed to ensure that AI is developed and used responsibly.

Since the Responsible Artificial Intelligence (RAI) governance framework was formally established, True has moved quickly from policy design to enterprise-wide implementation across the organization, RAI governance and assurance process are now mandatory for every new AI use case, and Responsible AI training has been made compulsories for all employees. The sections below describe how this program works and the impact it has already had on delivery.

Policy and Commitments

Policy coverage

True’s Responsible AI Policy Statement, part of the Company’s broader corporate governance framework, commits True to the responsible development, deployment, and use of AI in a manner that supports good corporate governance, accountability, human oversight, data protection, security, and compliance with applicable laws and regulations. It establishes an AI governance framework that manages AI across its full lifecycle; acquisition, design, development, deployment, monitoring, and decommissioning, under a structured, risk-based approach, and is read together with the Company’s Corporate Governance Policy and its wider risk management, compliance, privacy, data protection, and security frameworks.

Governance structure

Responsible AI is not managed as a stand-alone function, it is embedded in True’s existing governance architecture and reinforced by two dedicated AI bodies at policy and operational level, so that oversight scales with the pace of AI adoption across the business.

Roles and Responsibilities

1. Board of Directors

Approves the AI Governance Policy, sets strategic direction, oversees key AI risks and controls, and promotes ethical AI use.

2. AI Governance Committee

Senior governance body responsible for AI policy-level matters and enterprise-wide governance standards.

3. AI Council Committee

Operational governance committee that reviews and approves new AI use cases and monitors live use cases, meeting on a biweekly cadence with priority given to high-risk items.

4. Data Protection Office (DPO)

Reviews every use case for data-privacy impact, issues a Data Privacy Impact Assessment (DPIA) where required, and prescribes mitigating controls before development proceeds.

5. Information Technology (IT) / Security

Manages secure AI infrastructure, implements and verifies cybersecurity and data-protection controls prior to launch, and monitors technology-related risk, including for externally hosted / vendor AI.

6. AI Developer / Use-case Owner

Ensures the AI system is accurate, secure, reliable, and traceable; completes the risk-screening, privacy, and deployment checklists; owns post-launch monitoring and remediation.

7. Employees Comply with the Policy, use AI responsibly, and report concerns or suspicious activity through designated channels; completion of mandatory RAI training is required of every employee.

True’s AI Charter

AI usage is comprising of 3 aspects:

1. Setting ethical goals,

2. Ensuring all employees have technology knowledge for the transition to a Data-First and AI-First organization, and

3. Prioritizing ethical principles in AI usage.

True has already drawn up “True’s AI Charter” to lay down AI governance guidelines for its internal use. This charter prescribes four following guidelines:

1. Good Intent: AI should only be used for the benefit of customers and not pose a threat to others.

2. Fairness and Bias Mitigation: AI must not lead to results that reflect discriminatory practices.

3. Data Privacy and AI Functionality: The outcomes of AI usage should adhere to privacy principles, respecting the level of access customers provide.

4. Transparency: Despite the complexity of AI operations, the results of AI processing must be explainable, considering “rights” where consumers are paramount.

True Corporation Reaffirms Its Position as a Thai Tech Company, Emphasizing That No Matter How Intelligent AI Becomes, It Must Be Used Ethically, with Respect for Human Rights, Transparency, and Accountability

In today’s fast-paced digital world powered by technology, Artificial Intelligence (AI) is rapidly playing a significant role in both business and society. With processing capabilities over 200,000 times faster than the human brain, AI can diagnose diseases with over 95% accuracy and support sustainability efforts, such as addressing climate change. However, on the other hand, AI can be a “double-edged sword.” Without ethical frameworks, it can lead to privacy violations, the spread of misinformation, and increased inequality due to biases hidden within the data used to train AI. As a technology organization that recognizes the importance of ethical AI development, True Corporation reiterates its commitment to supporting the ethical use of AI.

AI is a technology closely linked to personal data protection. As an organization committed to good governance principles, True places great importance on safeguarding customers’ personal data, which is another dimension of respecting human rights in the digital era. The company adheres to the principle of “Privacy and Security by Design,” ensuring that customer privacy is protected from the very beginning of the design process. True also evaluates the impact of every service involving personal data, especially those resulting from the use of AI technology.

1. Transparency – Providing clear and explainable information about AI processes and decision-making, based on factual evidence.

2. Respect for Human Rights – Upholding the dignity, privacy, and freedom of every individual, ensuring that AI does not harm humans.

3. Fairness and Inclusion – Ensuring that AI delivers equitable outcomes, free from bias and discrimination against any individual.

4. Human-Centered Design – Prioritizing the well-being, safety, and accessibility of all users.

True Corporation is the first organization in Thailand to implement a Responsible AI (RAI) policy in accordance with the GSMA’s framework at the organizational level. The company has integrated the RAI Framework into its internal processes and established guidelines for performance evaluation aligned with international standards. This ensures the safe, fair, and sustainable use of AI, in line with global best practices.