ICLG - Cybersecurity Laws and Regulations - Thailand Chapter covers common issues in cybersecurity laws and regulations, including cybercrime, applicable laws, preventing attacks, specific sectors, corporate governance, litigation, insurance, and investigatory and police powers.
1.1 Would any of the following activities constitute a criminal or administrative offence in your jurisdiction: hacking; denial-of-service attacks; phishing; infection of IT systems with malware; distribution, sale or offering for sale of hardware, software or other tools used to commit cybercrime; possession or use of hardware, software or other tools used to commit cybercrime; identity theft or identity fraud; electronic theft; unsolicited penetration testing; or any other activity adversely affecting or threatening the security, confidentiality, integrity or availability of any IT system, infrastructure, communications network, device or data? If so, please provide details of the offence, the maximum penalties available, and any examples of prosecutions in your jurisdiction:
Hacking (i.e. unauthorised access)
Gaining unauthorised access to a computer system is considered a criminal act. Offenders face up to six months’ imprisonment and/or a fine of up to THB 10,000 (Computer Crime Act of 2017 (“CCA”), s.5). Likewise, perpetrators who access computer data without authorisation also face up to two years’ imprisonment and/or a maximum fine of THB 40,000 (CCA, s.7).
Unauthorised access or security breaches against computer data or systems used to maintain national, public, and economic security, as well as infrastructure serving the interest of the public, are punishable by imprisonment for a maximum term of seven years, as well as a maximum fine of THB 140,000. Furthermore, if the crime results in damages to the computer data or system, the offender will be liable to a maximum prison term of 10 years and a fine up to THB 200,000 (CCA, s.12).
Denial-of-service attacks
An offender who blocks, defers, obstructs, or interferes with a computer system belonging to another person that causes it to fail to perform its normal function will be liable to a maximum prison sentence of five years and/or a maximum fine of THB 100,000 (CCA, s.10). If the offence results in damages to the other person(s) or their property, the offender will also face a maximum prison term of 10 years and a maximum fine of THB 200,000 (CCA, s.12/1).
Phishing
Whoever deceitfully inputs data into a computer system that is wholly or partly distorted, forged, or false in a manner that may likely cause damages to the public (except in cases that involve defamation) faces a maximum prison sentence of five years and/or a maximum fine of THB 100,000. If the offence is committed against a private person, the offender will be liable to imprisonment not exceeding three years and/or a fine of up to THB 60,000. It should be noted that phishing is considered a compoundable offence (CCA, s.14/1).
In addition, a service provider that cooperates, consents, or tacitly supports phishing activities by allowing the use of a computer system under their control will also be subject to the same penalties mentioned above.
Infection of IT systems with malware (including ransomware, spyware, worms, trojans and viruses)
Those found to have wrongfully damaged, destroyed, revised, modified, or made additions to data that belong to another person shall be liable to imprisonment for a term not exceeding five years and/or a fine of up to THB 100,000 (CCA, s.9).
Blocking, deferring, obstructing, or interfering with a computer system that belongs to another person that causes it to fail to perform regular functions is punishable by imprisonment for up to five years and/or a maximum fine of THB 100,000 (CCA, s.10).
Distribution, sale or offering for sale of hardware, software or other tools used to commit cybercrime
Disposing or distributing hardware, software, or other tools that were used to commit offences under the CCA is punishable by a maximum prison sentence of two years and/or a fine of up to THB 40,000 (CCA, s.13). Additionally, the offender responsible for disposing or distributing such tools will face greater penalties if they are found to have been aware of the intention to use the distributed tools for committing criminal acts under the CCA.
Possession or use of hardware, software or other tools used to commit cybercrime
Failing to obey a court order calling for the destruction of data or software may result in criminal penalties deemed appropriate by authorities under s.14 and s.16 of the CCA (CCA, s.16/2), depending on the damages caused.
Moreover, officials may issue an order to surrender data or equipment used to store them. Those who fail to comply with such order will be liable to a fine not exceeding THB 200,000 on top of a daily fine capped at THB 5,000 until they comply with the order (CCA, s.18(5) and s.27).
Identity theft or identity fraud (e.g. in connection with access devices)
Committing identity theft is classified as cheating and fraud in Thailand, and offenders are subject to imprisonment not exceeding five years and/or a fine of up to THB 100,000 (Criminal Code, s.342(1).
Additionally, those illegally using an electronic or digital identification card belonging to another person will face imprisonment up to five years and/or a fine not exceeding THB 100,000 (Criminal Code, s.269/5). Notably, such an act is viewed as a cause of damage to the data of another person (CCA, s.9).
Electronic theft (e.g. breach of confidence by a current or former employee, or criminal copyright infringement)
This is considered a crime that carries the same penalties specified under the Criminal Code. Current or former employees who steal digital property or breach confidence are liable to a prison term not exceeding six months and/or a fine of up to THB 10,000 (Criminal Code, s.323).
Additionally, anyone found to have taken advantage of their position to steal another person’s secret, discovery, or invention to benefit themselves faces a prison term of up to six months and/or a fine not exceeding THB 20,000 (Criminal Code, s.324). The offender may also be subject to criminal infringement under the Copyright Act (2015) and Trade Secret Act (2002).
Unsolicited penetration testing (i.e. the exploitation of an IT system without the permission of its owner to determine its vulnerabilities and weak points)
Currently, there are no specific laws surrounding penetration testing and whether it constitutes ethical hacking.
Penetration testing is a simulated cyber-attack on a designated computer system for the purpose of evaluating its security and is performed on a contractual basis with permission from the computer system’s owner. According to CCA, s.7, unsolicited access to a computer system or data, or doing so beyond the permission granted by the owner, is considered an offence.
Any other activity that adversely affects or threatens the security, confidentiality, integrity or availability of any IT system, infrastructure, communications network, device or data
Those privy to security measures who disclose information that may likely cause damage to another person may face imprisonment for up to one year and/or a fine not exceeding THB 20,000 (CCA, s.6). Moreover, those who use digital tools to intercept the transmission of another person’s private data may be subject to a prison term not exceeding three years and/or a fine of up to THB 60,000 (CCA, s.8).
Sending data or emails to any other person using a fake or concealed identity that hinders the use of their computer is punishable by a fine of up to THB 100,000 (CCA, s.11). Additionally, a person who sends out unsolicited emails or data in a manner that causes annoyance to the recipient, particularly when the sender does not provide ways or acknowledge requests to stop receiving emails, may be liable to a fine not exceeding THB 200,000. If such acts are done against public interest or security, the offender may also be subject to s.12 of the CCA.
Those who input false data that may cause harm to public security, cause widespread anxiety, or are otherwise considered integral to activities defined by the Criminal Code as terrorism or threats to national security may face imprisonment of up to five years and/or a maximum fine of THB 100,000 (CCA, s.14(2), (3)). Furthermore, service providers found to have directly or indirectly collaborated with offenders shall be liable to the same penalties above (CCA, s.15).
Regarding personal data, the Personal Data Protection Act (2019) (“PDPA”) prohibits the collection, use, or disclosure of personal data without consent.
1.2 Do any of the above-mentioned offences have extraterritorial application?
Yes. However, they are subject to certain conditions under the Criminal Code whereby the nationality of an offender, and whether extradition treaties exist between Thailand and other corresponding jurisdictions, are taken into consideration.
1.3 Are there any factors that might mitigate any penalty or otherwise constitute an exception to any of the above-mentioned offences (e.g. where the offence involves “ethical hacking”, with no intent to cause damage or make a financial gain)?
Service providers found to have directly or indirectly provided consent or support in carrying offences under s.14 (see the question 1.1) will be exempt from incurring penalties under s.15 of the CCA, provided they can prove that they have complied with the Ministerial Notification; in particular, by notifying the relevant authorities of such incidents and stopping the use of their computer systems to commit offences.
2.1 Applicable Laws: Please cite any Applicable Laws in your jurisdiction applicable to cybersecurity, including laws applicable to the monitoring, detection, prevention, mitigation and management of Incidents. This may include, for example, data protection and e-privacy laws, trade secret protection laws, data breach notification laws, confidentiality laws, and information security laws, among others.
Primary regulations that apply to cybersecurity in Thailand include:
2.2 Critical or essential infrastructure and services: Are there any cybersecurity requirements under Applicable Laws (in addition to those outlined above) applicable specifically to critical infrastructure, operators of essential services, or similar, in your jurisdiction?
The Critical Information Infrastructure defined under the CSA includes operations important to national, military, and economic security, as well as public order. The Organisation of Critical Information Infrastructure (“CIIO”) shall provide assistance to prevent, cope with, and mitigate risks from cyber threats, particularly those targeting or affecting Critical Information Infrastructure.
CIIOs are businesses that have been tasked with providing services in the following aspects:
The NCC is authorised to appoint the coordinating agency for the CIIO to coordinate, monitor, cope with, and resolve cyber threats prescribed by law related to the Critical Information Infrastructure Supervising or Regulating Organisation (“SRO”) (CSA, s.50). In this regard, the SRO is responsible for reviewing the minimum cybersecurity standard of the CIIO and notifying the CIIO if it does not comply with the prescribed cybersecurity standards.
If there is a significant cyber threat to a system that belongs to a CIIO, the CIIO must report to the Office of the NCC (“NCC Office”) and the SRO, and continue monitoring the threat.
2.3 Security measures: Are organisations required under Applicable Laws to take measures to monitor, detect, prevent, or mitigate Incidents? If so, please describe what measures are required to be taken.
CSA
The CIIO must conduct a risk assessment on maintaining cybersecurity and periodically submit a summary report to the NCC Office. They must also establish a mechanism or process to monitor cyber threats or cybersecurity incidents relevant to its Critical Information Infrastructure (CSA, s.54, s.56).
PDPA
According to the PDPA, a data controller/processor is required to take security measures to monitor, detect, prevent, or mitigate any unauthorised or unlawful losses, access to, use, alteration, correction, or disclosure of personal data. In the event of a data breach, the data controller of a CIIO must notify the Office of the Personal Data Protection Committee (“PDPA Office”) within 72 hours of becoming aware of the incident.
In certain industries, specific requirements may also apply to organisations; for example, telecommunication licensees must obtain protection and security measures pertaining to personal data, both technical and internal management protocols, with aspects suitable with the type of telecommunications services under the TBA.
2.4 Reporting to authorities: Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents (including cyber threat information, such as malware signatures, network vulnerabilities and other technical characteristics identifying a cyber-attack or attack methodology) to a regulatory or other authority in your jurisdiction? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; (b) the regulatory or other authority to which the information is required to be reported; (c) the nature and scope of information that is required to be reported; and (d) whether any defences or exemptions exist by which the organisation might prevent publication of that information.
CSA
The CIIO must report any significant cyber threats on its system to the NCC Office and the SRO (CSA, s.57). However, no criteria or methods for reporting have been issued by Cybersecurity Regulating Committee (“CRC”) at the time of writing.
PDPA
Those handling data have an obligation to notify the PDPA Office of data breaches within 72 hours of becoming aware of the incident, unless the breach poses little risk to the rights and freedoms of those whose data have been unlawfully breached. As such, the person who possesses the data must also notify those affected by the data breach. They must also implement remedial measures prescribed in their data policy without delay.
Other laws
According to the PSA and the Securities and Exchange Act of 1992 (“SEA”), information regarding incidents or potential incidents must be reported by operators, particularly payment service providers and securities companies, to relevant regulators.
2.5 Reporting to affected individuals or third parties: Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents to any affected individuals? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; and (b) the nature and scope of information that is required to be reported.
Please see question 2.4 regarding the PDPA above.
2.6 Responsible authority(ies): Please provide details of the regulator(s) or authority(ies) responsible for the above-mentioned requirements.
Regulators vary by sector; however, the following are considered relevant to the aforementioned requirements:
Law enforcement officers and state attorneys also play important roles in investigations or proceedings surrounding cybercrime offences.
2.7 Penalties: What are the penalties for not complying with the above-mentioned requirements?
A CIIO that fails to report cyber threats (as mentioned in question 2.4) without reasonable cause may be subject to a fine not exceeding THB 200,000.
PDPA
A fine of up to THB 3 million may be imposed on those who hold or collect data and do not comply with the notice requirements highlighted in questions 2.3, 2.4, and 2.5.
Additionally, guidelines for enforcing administrative penalties for failure to comply with the PDPA have been recently announced by the Notification of the PDPA Committee B.E. 2565, issued in June 2022. The imposition of such measures is within the authority of the expert committee, whereby the committee is granted the full authority of an administrative court to the extent applicable. Generally, the expert committee may impose fines and other remedial measures depending on the severity of the violation.
SEA
Securities companies that do not comply with the notice requirements mentioned in questions 2.4 and 2.5 face a fine of up to THB 300,000, together with a daily fine capped at THB 10,000 levied throughout the non-compliance period. Directors, managers, or any other responsible persons may also be liable to imprisonment for a term not exceeding six months and/or a fine of up to THB 200,000, unless it can be proven they were not involved with the offence.
FIBA
Failure to report to the BOT, as mentioned in our response to question 2.4, incurs a fine of up to THB 1 million on top of a daily fine not exceeding THB 10,000 during the non-compliance period.
For e-payment service providers regulated by the BOT, the penalty for not complying with the notice requirement as indicated in our response to question 2.4 is a fine not exceeding THB 1 million or THB 2 million, depending on the type of e-payment service provider in question.
TBA
If a licensee fails to comply with the prescribed requirements or licensing conditions, the NBTC will order them to enact appropriate changes or perform remedial actions within a specified period. Failure to comply with an order issued by the TBA can lead to a minimum administrative daily fine of THB 20,000. The NBTC may also suspend or revoke licences if necessary.
2.8 Enforcement: Please cite any specific examples of enforcement action taken in cases of non-compliance with the above-mentioned requirements.
According to media reports, cyber attackers stole data belonging to 123,000 customers of Kasikorn Bank and Krungthai Bank in August 2018, the first large-scale data leak to have affected local financial institutions. It was reported the leaked information did not consist of financial data, and that both banks had already undergone measures to stop the breach, performed inspections on all related systems, and allowed experts to assess operating systems to ensure they were sufficiently protected. The BOT instructed the banks to tighten their cybersecurity systems, protect customers from the fallout, and inform the affected people. The BOT also ordered both banks to prepare measures for providing assistance in case damages were to arise at a later point.
3.1 Are organisations permitted to use any of the following measures to protect their IT systems in your jurisdiction (including to detect and deflect Incidents on their IT systems): (i) beacons (i.e. imperceptible, remotely hosted graphics inserted into content to trigger a contact with a remote server that will reveal the IP address of a computer that is viewing such content); (ii) honeypots (i.e. digital traps designed to trick cyber threat actors into taking action against a synthetic network, thereby allowing an organisation to detect and counteract attempts to attack its network without causing any damage to the organisation’s real network or data); or (iii) sinkholes (i.e. measures to re-direct malicious traffic away from an organisation’s own IP addresses and servers, commonly used to prevent DDoS attacks)?
There are no regulations preventing the use of such measures in Thailand.
3.2 Are organisations permitted to monitor or intercept electronic communications on their networks (e.g. email and internet usage of employees) in order to prevent or mitigate the impact of cyber-attacks?
Under the PDPA, an email address can be considered personal data given that it can be used to indicate a person’s identity within a network. For purposes of facilitating an organisation’s operations, they may be entitled to access employee emails and internet usage (if necessary) by obtaining consent from them. The rationale behind this could be that such organisations benefit from preventing and monitoring any suspicious activities that may clash with their security measures.
3.3 Does your jurisdiction restrict the import or export of technology (e.g. encryption software and hardware) designed to prevent or mitigate the impact of cyber attacks?
There are currently no specific restrictions related to the import or export of technology. However, certain items may be subject to import-export restrictions of dual-use items.
4.1 Do legal requirements and/or market practice with respect to information security vary across different business sectors in your jurisdiction? Please include details of any common deviations from the strict legal requirements under Applicable Laws.
S.50 of the TBA provides the legal framework for the implementation of data protection and security measures. This framework covers technical and internal aspects regarding data security that are appropriate for each type of telecommunications services. Personal data protection and security measures must be implemented on a technical level based on the following requirements: (i) updating the encryption system for personal data at least every three months; and (ii) updating the level of security measures to comply with rapid changes in technological innovation.
4.2 Excluding the requirements outlined at 2.2 in relation to the operation of essential services and critical infrastructure, are there any specific legal requirements in relation to cybersecurity applicable to organisations in specific sectors (e.g. financial services, health care, or telecommunications)?
Telecommunication service provider
The TBA requires telecommunication service providers to comply with technology information management and policies for personal data protection, as well as uphold rights to privacy and freedom in communication under the TBA. The NBTC sometimes imposes specific provisions concerning cybersecurity to each telecommunication service provider.
Financial service provider
Financial service providers must comply with the Notifications of the BOT regarding digital security measures and risk management.
Under the Payment Systems Act, e-payment service providers also need to follow the BOT’s legal framework surrounding Business Continuity Management and Risk Assessments, specifically with regard to having a contingency plan or backup policy system to ensure service continuity, as well as safety policies and measures for the information systems used.
Other service providers
Other service providers may, at the discretion of regulators, comply with the governing legal framework to protect personal data. An example of this can be illustrated with insurance companies following the standard of the Office of Insurance Commission (“OIC”), or financial institutions complying with the Credit Information Business Operation Act of 2002.
5.1 In what circumstances, if any, might a failure by a company (whether listed or private) to prevent, mitigate, manage or respond to an Incident amount to a breach of directors’ or officers’ duties in your jurisdiction?
Generally, if a data breach occurs under the supervision of an assigned Data Protection Officer, they must report the incident to the responsible persons within the organisation. If the director or any other responsible person fails to prevent, mitigate, manage, or respond to an incident, resulting in the organisation violating any regulations, the person will be held liable for the punishment of such offences. This legal aspect was the grounds for the CSA (s.77) and PDPA (s.81).
5.2 Are companies (whether listed or private) required under Applicable Laws to: (a) designate a CISO (or equivalent); (b) establish a written Incident response plan or policy; (c) conduct periodic cyber risk assessments, including for third party vendors; and (d) perform penetration tests or vulnerability assessments?
The CSA does not prescribe requirements for a Chief Information Security Officer (“CISO”). However, under the Notifications of the BOT, financial institutions that face high cybersecurity risks must appoint a CISO. Moreover, the CSA requires a CIIO to provide a cybersecurity policy, which covers risk assessments and response protocols for data breaches.
The CIIO must also provide a policy for implementing risk assessment for cybersecurity, including an examination from a cybersecurity standpoint by an information security auditor, internal auditor, or external independent auditor at least once a year (CSA, s.54). Moreover, the CSA (s.56) states that a CIIO must take part in organisational readiness assessments for dealing with potential incidents.
Those handling consumer data under the PDPA must provide adequate security measures for personal data protection as required by the PDPA Office.
5.3 Are companies (whether listed or private) subject to any specific disclosure requirements (other than those mentioned in section 2) in relation to cybersecurity risks or Incidents (e.g. to listing authorities, the market or otherwise in their annual reports)?
The SEC requires securities firms to file annual reports to the SEC detailing their IT management and the occurrence of any incidents. Financial institutions and e-payment service providers must also create a report about their services and make them available for inspection by the BOT. The BOT can order financial institutions and e-payment service providers to give any information related to its services, including incident information.
6.1 Please provide details of any civil or other private actions that may be brought in relation to any Incident and the elements of that action that would need to be met.
Even though cybercrimes under various Acts face criminal liabilities, affected people can claim civil “damages” under the premise of a wrongful act (tort) for both wilful and negligent acts under s.420 of the Civil and Commercial Code (“CCC”).
In addition, civil actions for compensation, including punitive damages, against those who hold customer data for breaches under the PDPA can be brought before the court (PDPA, s.74).
6.2 Please cite any specific examples of published civil or other private actions that have been brought in your jurisdiction in relation to Incidents.
As mentioned in question 6.1, there are a limited number of civil suits involving cybersecurity in Thailand that have been made available to the public for review.
6.3 Is there any potential liability in tort (or equivalent legal theory) in relation to failure to prevent an Incident (e.g. negligence)?
Yes; please see our comments under question 6.1.
7.1 Are organisations permitted to take out insurance against Incidents in your jurisdiction?
Yes, the OIC allows insurance companies to sell “cyber insurance” policies to customers. The coverage of the policies mainly includes the theft of funds (i.e., money stolen on the internet executed by identity theft, phishing), cyber extortion, cyberbullying, online shopping scams, business interruption losses caused by security breaches, malware, ransomware, data recovery costs due to cyber-attacks, costs related to incident report and investigation, and subject to respective conditions thereto.
However, there are some conditions that the policy will not cover, depending on each insurance company. For instance, “the Company will indemnify the Insured for any loss or damage that the Insured cannot claim from the responsible person from other sources”.
7.2 Are there any regulatory limitations to insurance coverage against specific types of loss, such as business interruption, system failures, cyber extortion, or digital asset restoration? If so, are there any legal limits placed on what the insurance policy can cover?
No, there are currently no regulatory limitations on insurance coverage against incidents as mentioned previously.
However, there are still no specific regulations or restrictions on either allowing or banning insurance policies covering any losses or damages resulting from digital asset transactions in Thailand. As of now, some digital exchange platforms in Thailand secure their companies and their digital assets by using international insurance companies.
7.3 Are organisations allowed to use insurance to pay ransoms?
Yes, subject to the conditions of the relevant insurance policy.
8.1 Please provide details of any investigatory powers of law enforcement or other authorities under Applicable Laws in your jurisdiction (e.g. anti-terrorism laws) that may be relied upon to investigate an Incident.
In order to prevent cybersecurity threats, the NCC may prescribe characteristics of various threats and classify them into: (i) cybersecurity threats that are not serious; (ii) critical cybersecurity threats; and (iii) crisis-level cybersecurity threats (CSA, s.60). In the event of a critical cyber threat, the CRC has the authority to require any relevant person to take charge of the following:
For a critical cybersecurity threat, the CRC also has the authority to assign an official to conduct the following, but only to the extent where it is necessary to prevent a cybersecurity threat:
Certain orders require a court order, while others will not. However, orders must generally be limited to an extent where it is necessary to prevent or handle serious cybersecurity threats.
Other regulators (e.g., the BOT) are also authorised to investigate incidents.
8.2 Are there any requirements under Applicable Laws for organisations to implement backdoors in their IT systems for law enforcement authorities or to provide law enforcement authorities with encryption keys?
Yes. According to the CCA, a service provider is obliged to retain computer traffic data for at least 90 days, but not exceeding two years from the date on which the data is imported into a computer system. In the event service is terminated, the service provider shall keep the users’ data for a minimum of 90 days for service records usage. For the purposes of investigation, with respect to any offence under the CCA, officials are entitled to request from a service provider or relevant persons access to such information.
This chapter has been written by a member of ICLG's international panel of experts, who has been exclusively appointed for this task as a leading professional in their field by Global Legal Group, ICLG's publisher. ICLG's in-house editorial team carefully reviews and edits each chapter, updated annually, and audits each one for originality, relevance and style, including anti-plagiarism and AI-detection tools. This chapter was copy-edited by Jenna Feasey , our in-house editor.