Database

Browse Database

THAILAND

Since June 2007, as amended in January 2017

Pillar Domestic data policies  |  Sub-pillar Requirement to allow the government to access personal data collected
Computer-Related Crime Act B.E. 2550 (พรบ. ว่าด้วยการกระทำความผิดทางคอมพิวเตอร์ พ.ศ. 2550)
Section 18 of the Computer-Related Crime Act allows the government to access user-related or traffic data without a court order and compel ISPs to decode programmed data.
Coverage Horizontal

THAILAND

Since April 2019

Pillar Domestic data policies  |  Sub-pillar Requirement to allow the government to access personal data collected
National Intelligence Act, 2019 (พระราชบัญญัติข่าวกรองแห่งชาติ พ.ศ. 2562)
The National Intelligence Act 2019 gives the power to the National Intelligence Agency to perform duties related to activities on intelligence operations, civil security safeguards, and monitoring situations that affect national security (Section 4). Section 6 of the Act provides the National Intelligence Agency with the power to order public agencies or any person to submit the information or document that impacts national security within the specified period. If it is necessary to acquire the information, the agency is allowed to take action by adopting electronic, scientific, telecommunication devices, or other technology tools to obtain such information. Certain activities can be done without filing a motion to the court and are deemed in good faith for the public or national security.
Coverage Horizontal

THAILAND

Since December 1994, as amended in January 2015

Pillar Intermediary liability  |  Sub-pillar Safe harbour for intermediaries for copyright infringement
Copyright Act, 1994 (พระราชบัญญัติลิขสิทธิ์ พ.ศ. 2537)
The Copyright Act establishes a safe harbour regime for intermediaries for copyright infringements. Although Thailand has not signed the WIPO Copyright Treaty, in 2015, two copyright amendment laws were approved: the Copyright Act (No. 2) and Copyright Act (No. 3). These two laws implemented many of the key provisions of the WIPO Copyright Treaty. Copyright “safe harbour” protection for intermediaries such as cloud service providers is contained in the 2015 amendments to copyright laws. The provisions exempt Internet intermediaries from liability in broad circumstances provided that they did not control, initiate, or order the infringement. The intermediary is shielded from liability for content until they receive a court order ordering them to remove it.
Coverage Internet intermediaries
Sources

THAILAND

Since June 2007, last amended in January 2017
Since July 2017

Pillar Intermediary liability  |  Sub-pillar Safe harbour for intermediaries for any activity other than copyright infringement
Computer-Related Crime Act B.E. 2550 (พรบ. ว่าด้วยการกระทำความผิดทางคอมพิวเตอร์ พ.ศ. 2550)

Notification of the Ministry of Digital Economy and Society regarding Procedures, Computer Data Dissemination and Transmission of the Computer Data, 2017
The Computer-Related Crime Act and the Notification of the Ministry of Digital Economy and Society (MDES) establish a safe harbour regime for intermediaries beyond copyright infringement. According to Section 15 of the Computer-Related Crime Act, service providers are not liable of for for the content published if they remove computer data once it has received a notification from the Minister of Digital Economy and Society (MDES) to discontinue the dissemination of these. In addition, the Notification includes the 'Notice and Take Down' procedure to remove the offence's content and the intermediary's liability. This notification allows an individual to submit their notices of online offence to the police or competent officers. After the service provider receives the notification from the Ministry, the competent officer, or court order, they must remove or stop the dissemination of certain content immediately within the given period.
Coverage Internet Service Providers (ISPs)

THAILAND

Since June 2007, last amended in January 2017

Pillar Intermediary liability  |  Sub-pillar User identity requirement
Commission of Computer-Related Offences Act, 2007 (พรบ. ว่าด้วยการกระทำความผิดทางคอมพิวเตอร์ พ.ศ. 2550)
According to Art. 26 of the Commission of Computer-Related Offences Act (commonly known as the Computer Crimes Act or CCA), all service providers are required to record users' computer traffic data and store it for 90 days, with the possibility of extending the retention period up to a year if ordered by authorities. In 2019, it was reported that the Thai government requested all coffee shops, including small operators, to retain traffic data of customers using their Wifi for 90 days and to provide that information upon request. This request includes keeping a 'log file' of customers' computer traffic data, including their IP address, full name, ID card number, or passport details. As defined in Art. 3 of the CCA, "Computer Traffic Data", encompasses information related to the communication of a computer system, such as the origin, source, terminal, route, time, date, size, duration, type of service, and other relevant communication details.
Coverage Services sector

THAILAND

Since May 2014

Pillar Intermediary liability  |  Sub-pillar Monitoring requirement
Notification of the NCPO No. 18/2557 (2014) regarding Public Information Dissemination (ประกาศคณะรักษาความสงบแห่งชาติ ฉบับที่ ๑๘/๒๕๕๗ เรื่อง การเผยแพร่ข้อมูลข่าวสารต่อสาธารณะ)
According to the National Council of Peace and Order (NCPO) Notification No. 18/2557 (2014), all types of media services, including both public and private providers in satellite, cable TV, digital TV, and community radio, service providers, newspapers, must monitor their content to prohibit broadcasting or disseminating the following information:
- A criticism of the performance of the NCPO and related persons;
- A confidential information of the state agency;
- An information that creates misunderstanding and inciting conflicts in the Kingdom;
- Threatening to harm any person that could create fear among the public.
Coverage Media services

THAILAND

Reported in 2022, last reported in 2023

Pillar Content access  |  Sub-pillar Blocking or filtering of commercial web content
Blocking and filtering of commercial web content
In October 2020, the Ministry of Digital Economy and Society (MDES) issued an order requiring internet service providers (ISPs) and mobile service providers to block four internet protocol (IP) addresses associated with Telegram, a messaging app widely used by protesters. Although the government has not publicly disclosed the total number of URLs blocked through court orders, the MDES reported that during the first nine months of 2022, it obtained court orders to block approximately 4,735 URLs, including 1,816 URLs containing allegedly offensive content about the monarchy.
Websites have also been blocked on grounds of national security, for gambling content, for alleged violations of intellectual property rights, and for hosting unauthorised virtual private network (VPN) services. In addition to blocking and filtering, content removal reportedly continues under tight government control.
Coverage Horizontal

THAILAND

Since November 1999

Pillar Content access  |  Sub-pillar Restrictions on online advertising
Foreign Business Act, B.E. 2542 (1999) (พระราชบัญญัติการประกอบธุรกิจของคน. ต างด าว พ.ศ. ๒๕๔๒)
List 3 of the Foreign Business Act includes industries in which "Thai nationals are not yet ready to compete with foreigners". These are open to foreign investors provided they receive a licence from the Director-General of the Department of Business Development of the Ministry of Commerce and approval from the Foreign Business Committee. A wide range of businesses are covered under List 3, including advertising businesses. A foreign company can engage in List 3 activities if Thai nationals hold a majority of the limited company’s shares. Any company with a majority of foreign shareholders (more than 50%) cannot engage in List 3 activities unless it receives an exception from the Ministry of Commerce under its Foreign Business License application.
Coverage Advertising sector

THAILAND

Since June 2013
Since August 2013

Pillar Content access  |  Sub-pillar Licensing schemes for digital services and applications
Notification of the National Broadcasting and Telecommunications Commission regarding Criteria, Procedures and Conditions for Digital Television Services Licensing, 2013

Notification of the National Broadcasting and Telecommunications Commission regarding Criteria, Procedures and Condition for Digital Television Services Auction, 2013
According to the Notification of the National Broadcasting and Telecommunications Commission regarding Criteria, Procedures, and Conditions for Digital Television Services Licensing 2013, any person who wishes to operate a digital television program must obtain a digital television license by qualifying and paying the fee. In addition, after receiving the license, a person shall be entered into the process of digital television channel auction as prescribed in the NBTC Notification 2013 regarding the auction.
Coverage Digital TV

THAILAND

Since October 2013

Pillar Content access  |  Sub-pillar Licensing schemes for digital services and applications
Agenda 4.24 Resolutions of the National Telecommunications Commission (NTC)'s meeting No. 38/2013
Cloud computing services typically do not require a telecommunications license. However, when such services utilise a leased line network to connect users to the cloud infrastructure, they are categorised as telecommunications services. Consequently, providers must obtain a Type 1 license, as prescribed by the National Broadcasting and Telecommunications Commission (NBTC) under the Telecommunications Business Act. This requirement is outlined in Agenda 4.24 of the National Telecommunications Commission (NTC) meeting No. 38/2013.
Coverage Cloud computing sector
Sources

THAILAND

Since January 1955, last amended in March 1992
Since November 2012

Pillar Quantitative trade restrictions for ICT goods and online services  |  Sub-pillar Other import restrictions, including non-transparent/discriminatory import procedures
Radio Communication Act (No. 3), 1992 (พรบ. วิทยุคมนาคม (ฉบับที่ 3) พ.ศ. 2535)

Notification of the National Broadcasting and Telecommunications Commission on Criteria and Procedures for Granting A Permit to Manufacture, Import, Sell, or Offer for Sale or Install Receiver, Apparatus or Device Enabled for Receiving or Decoding Signals to Receive Programs of the Subscription Broadcasting Business B.E. 2555 (2012) (ประกาศคณะกรรมการกิจการกระจายเสียง กิจการโทรทัศน์ และกิจการโทรคมนาคมแห่งชาติ เรื่อง หลักเกณฑ์และวิธีการอนุญาตให้ผลิต นำเข้า จำหน่ายหรือมีไว้เพื่อจำหน่ายหรือรับติดตั้ง เครื่องรับเครื่องมือหรืออุปกรณ์ที่สามารถใช้รับหรือแปลงสัญญาณในการรับรายการ ของกิจการกระจายเสียงหรือกิจการโทรทัศน์แบบบอกรับเป็นสมาชิก พ.ศ. ๒๕๕๕)
According to Section 6 of the Radio Communication Act, any persons who wish to import radio communication devices or any ancillary devices into the Kingdom are required to obtain a license. The telecommunications devices required to obtain a license include: radio modems, base stations, cellular repeaters, antennas, FM transmitters, and GPS tracking devices, among others. According to Section 9, the import license is valid for 180 days after issuance, and those who violate the law shall be liable to a fine, imprisonment, or both. The "Notification of the National Broadcasting and Telecommunications Commission on Criteria and Procedures for Granting A Permit to Manufacture, Import, Sell, or Offer for Sale or Install Receiver, Apparatus or Device Enabled for Receiving or Decoding Signals to Receive Programs of the Subscription Broadcasting Business B.E. 2555" includes the requirements that the importers must follow, including fee payment and document preparation.
Coverage Radiocommunication and telecommunications equipment

THAILAND

Since April 2016

Pillar Quantitative trade restrictions for ICT goods and online services  |  Sub-pillar Other import restrictions, including non-transparent/discriminatory import procedures
Notification of the Ministry of Commerce regarding the 3D Printing Machines as a Product Subjected to Import Requirements, 2016 (ประกาศกระทรวงพาณิชย์ เรื่อง กำหนดให้เครื่องพิมพ์สามมิติเป็นสินค้าที่ต้องปฏิบัติตามมาตรการจัดระเบียบในการนำเข้าในราชอาณาจักร)
According to the Ministry of Commerce's Notification regarding 3D Printing Machines as a Product Subjected to Import Requirements 2016, importers of 3D printing machines must be registered with the Department of Foreign Trade under the Ministry of Commerce. In addition, they are also required to notify the importation, possession, disposal, and balance of these products twice a year (in June and December). Moreover, the importers must report this information to the Customs Department.
Coverage 3D printing machines, rapid prototyping machines, and additive manufacturing machines (HS8477, 8479)

THAILAND

Since August 2006

Pillar Domestic data policies  |  Sub-pillar Minimum period for data retention
Notification of the National Telecommunications Commission regarding Telecommunications Service Users' Rights Concerning Personal Information Rights to Privacy and Freedom of Communication, 2006 (ประกาศ กทช. เรื่อง มาตรการคุ้มครองสิทธิของผู้ใช้บริการโทรคมนาคมเกี่ยวกับข้อมูลส่วนบุคคล สิทธิในความเป็นส่วนตัว และเสรีภาพในการสื่อสารถึงกันโดยทางโทรคมนาคม)
The Notification on Telecommunications Service Users' Rights 2006, issued by the National Telecommunications Commission (NTC), states that licensed telecommunications service providers must retain their users' data for the last three months after the service is terminated (Clause 8). The personal data of telecommunication users includes factual information that can identify the individual user, usage details, subscriber number and behavioural activity in the use of telecommunication services. In case of necessity, the service provider may be required to extend the period of data retention but will not exceed two years.
Coverage Telecommunications sector

THAILAND

Since June 2007, last amended in January 2017
Since August 2007

Pillar Domestic data policies  |  Sub-pillar Minimum period for data retention
Commission of Computer-Related Offences Act, 2007 (พรบ. ว่าด้วยการกระทำความผิดทางคอมพิวเตอร์ พ.ศ. 2550)

Notification of the Ministry of Information and Communications Technology regarding Computer Traffic Data Retention Criterias of Service Providers, 2007 (ประกาศกระทรวงเทคโนโลยีสารสนเทศและการสื่อสาร เรื่อง หลักเกณฑ์การเก็บรักษาข้อมูลจราจรทางคอมพิวเตอร์ของผู้ให้บริการ พ.ศ. 2550)
Section 26 of the Commission of Computer-Related Offences Act 2007 (so-called Computer Crimes Act 2007) (amended 2017) defines 'computer traffic data' as data in relation to the communication of computer system or the origin, time, duration, type of service, or else related to the computer system. The Act requires a service provider to retain computer traffic data for not less than 90 days from the date when the data was entered into the computer system. If necessary, the competent official may order any service provider to retain computer traffic data for a period exceeding 90 days but not exceeding 2 years as a matter of an individually exceptional case and on an ad hoc basis. Also, the service provider shall maintain client data, which is necessary for identifying the client since their first use of service and shall keep such data for not less than 90 days from the ending date of service. Those who fail to comply with this measure shall be liable to a fine not exceeding 500,000 Thai Baht (approx. USD 14,000).
The Notification on Computer Traffic Data Retention Criteria for Service Providers in 2007 provides detailed information regarding this matter. For example, the computer traffic data must be maintained under secured measures using a centralised log server, data archiving, or data hashing (Clause 8). Moreover, the service providers - telecommunication and broadcast carriers, access service providers, host service providers, and content service providers - need to retain the information as the law requires (Clause 5).
Coverage Telecommunication and broadcast carriers, access service providers, host service providers, and content service providers

THAILAND

Since May 2019, entry into force in June 2022

Pillar Domestic data policies  |  Sub-pillar Requirement to perform a Data Protection Impact Assessment (DPIA) or have a data protection officer (DPO)
Personal Data Protection Act, B.E. 2562 (2019) (พระราชบัญญัติคุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562)
The appointment of a Data Protection Officer (DPO) is a mandatory condition under the Personal Data Protection Act (PDPA). Section 41 of the Act specifies that the data controller and data processor shall designate a DPO in the following circumstances: the activities such as collection, use, or disclosure of personal data.
The DPO's duties include advising the data controller and data processor, investigating the performance of the data controller and data processor, coordinating and cooperating with the Office of the Personal Data Protection Committee (PDPC) when there are problems and keeping confidentiality of the personal data (Section 42).
Coverage Horizontal

Report issue     Report new measure