You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

December 28, 2012

Company Directors Face Civil and Criminal Liability for Software Piracy

Bangkok Post, Corporate Counsellor Column

Company directors can be held liable for software copyright violations in their businesses, even if they are unaware that software piracy is taking place at their companies, according to Thai copyright law.

The Thai Copyright Act of 1994 states that if a juristic person (a company) commits copyright infringement, all directors or managers are jointly liable for the offense. This means that if a company is sued as a first defendant, its authorized directors may also be attached as additional defendants in the case.

Software piracy, which is the copying of software without permission from the copyright holder, continues to occur among businesses in Thailand at an alarming rate. According to the Global Software Piracy Study of International Data Corporation (IDC), Thailand’s software piracy rate was 72% in 2011, with the commercial value of pirated software at up to US$852 million.

Under current copyright law in Thailand, companies, directors, and senior managers found responsible for violations face fines of up to THB 800,000 and/or jail terms of up to four years, plus liability for the actual cost of the software as civil damages. These are extremely serious consequences that no one would want to face, so it is essential for company directors to understand their responsibilities and take action to prevent software piracy.

Downloading and Installation by Employees and Contractors

Liability for copyright infringement may be imposed on an individual who is not a direct, primary participant in the infringement. The doctrine of vicarious liability exists for the employee-employer relationship, and applies to imposing liability on the employer when an employee, acting within the scope of his or her employment, has infringed on a copyright.

Therefore, an employee who loads and installs pirated software onto his or her office computer or laptop to assist in his or her work may create liability for the employer. A director can be vicariously liable for an employee’s copyright infringement, even if the employer has told the employee directly not to engage in the activity. The law requires directors to have more than just good intentions; directors must be proactive and ensure their place of business is compliant with the law.

In addition, company directors can be liable if an outside contractor commits copyright infringement while working for the company. For example, a company that hires a computer consultant who installs pirated software on the company’s system, or who uses pirated software in performing tasks for the company, may incur liability for infringement.

Again, responsibility is with the company and its directors to ensure the software being used is properly licensed.

Increased Punishments on the Horizon

The present Thai Copyright Act B.E. 2537 is now 18 years old and is being updated, with new amendments likely to be enacted soon. At least two provisions entail more stringent liability of a copyright infringer, including the company and its directors. Under the proposed amendments, the court may order the infringer to pay damages to the copyright owner up to two times the actual damages caused by the infringement. In addition, any articles produced by copyright infringement can be ordered confiscated or destroyed by the court at the expense of the infringer.

Education as a Preventive Measure

As a preventive measure, company directors should ensure that the company adopts a statement of policy that prohibits software piracy and actively informs all employees of the policy. Employees should be told precisely what is and is not permissible under copyright law.

A company should create a written anti-piracy policy and enforce it by taking disciplinary action for violations. Education should be thorough and should extend to all employees involved in the purchase, use, and distribution of software. There should be follow-up explanations and actual software-use checkups.

Software Due Diligence

Company directors have tools at their disposal to ensure that their companies are compliant with software licensing terms. For example, companies can conduct periodic audits to ensure that all programs in use at the company are authorized copies, and that all software is used in an authorized manner. Moreover, companies can adopt and implement a Software Asset Management (SAM) policy that is helpful not only in preventing inadvertent piracy, but also in maximizing a company’s software investment.

If software piracy is uncovered through auditing, it should be swiftly terminated. If the violations are intentional, strict disciplinary measures should be applied. The company should take a strong stand that is clear to anyone inside or outside the organization.

If the policy is visibly policed and vigorously enforced, unauthorized use will likely be reduced, which will minimize any possible damages to the copyright owner and any corresponding monetary award against the company. Moreover, rigorous enforcement of a policy against piracy can help to reduce any personal liability of company officers and managers for acts committed by employees.

By being proactive in combating piracy within the company, directors can save themselves from serious expense, business disruption, and embarrassment resulting from being criminally prosecuted for software violations. Ignoring liability for software copyright violations is a serious mistake that can and should be avoided.

RELATED INSIGHTS​ 

September 30, 2026
On September 15, 2026, Vietnam’s Ministry of Finance (MOF) released for public consultation a draft circular on reporting and information disclosure in the pilot crypto asset market. The draft implements Resolution No. 05/2025/NQ-CP on the Pilot Implementation of the Crypto Asset Market in Vietnam and provides further detail on how licensed crypto asset service providers (“CASPs”) will be supervised once the market becomes operational. The draft indicates a data-intensive supervisory model, with licensed CASPs serving as the first line of market oversight. Public Disclosure Requirements The draft imposes detailed public disclosure requirements on CASPs, aimed primarily at market transparency. CASPs and crypto asset issuers must make disclosures in both Vietnamese and English, retain reported and disclosed information for at least 10 years, and keep information published on their websites accessible for at least five years. For CASPs, disclosure obligations arise both periodically and when specific events occur. A CASP must announce any crypto asset to be admitted to trading on its website at least seven days before trading begins and publish periodic financial statements. Certain extraordinary events and information requested by the MOF must generally be disclosed within 24 hours. CASPs must also provide ongoing market information. During trading hours, they must publish key trading data, including prices and volumes, daily highs and lows, average prices, the three best bid and offer levels, and transactions by foreign investors. By 9:00 a.m. each trading day, they must publish specified information on the previous day’s trading activity. Regulatory Reporting Requirements Separate from public disclosure, the draft requires CASPs to provide regulators with detailed information enabling ongoing supervision of their operations and the market. For market activity, CASPs must report decisions to admit or remove a crypto asset from trading within 24 hours, submit previous-day trading data to the State Securities Commission
September 24, 2026
Vietnam is implementing and developing a broad package of regulatory reforms that could reshape how IP, data, digital platforms, and product authenticity are regulated and enforced. Several of the key measures have been led by the Ministry of Public Security in its legislative and administrative capacity, as part of a broader government effort. The core reform package consists of four key legal instruments: proposed amendments to the Criminal Code, a proposed new Data Security Law, a draft Decree on Product Identification, Authentication and Traceability, and the newly enacted Decree No. 330/2026/ND-CP. These instruments include rules on criminal enforcement, data security, electronic identification, product identification and traceability, administrative violations, and cybersecurity sanctions. Combined, these measures will affect copyright enforcement, industrial property rights, trade secrets, AI training data, product provenance, online takedowns, valuation of counterfeit goods and electronic evidence. It is worth noting that, in addition to strengthening criminal penalties for IP crimes, Vietnam’s emerging regulatory framework increasingly treats infringement, data misuse, product authentication, and platform-enabled violations as interconnected regulatory and enforcement challenges. For rights holders and foreign investors, this could mean stronger tools against counterfeiting and online infringement, but also more compliance obligations around data, traceability, AI, platform controls and government-facing reporting. Expansion of Criminal IP Enforcement Proposed amendments to Article 225 of the Criminal Code would expand criminal copyright exposure beyond reproduction and distribution to cover large-scale commercial public performance and online communication of works, phonograms and video recordings. This is important because piracy is increasingly about streaming, unauthorized communication, and platform access models rather than physical copying. Aggravated copyright infringement could be subject to up to 10 years in prison for individuals and fines of up to VND 6 billion (about USD 228,300) for commercial legal entities. The amended Article 226 would expand criminal industrial property liability beyond
September 17, 2026
Thailand’s Office of the Consumer Protection Board (OCPB) has released for public comment a draft bill to amend the Consumer Protection Act B.E. 2522 (1979), the country’s foundational consumer protection legislation. The draft amendment aims to modernize the nearly five-decade-old framework to address the rapid growth of digital commerce, online advertising, influencer marketing, and new business models. The public consultation period is open until October 10, 2026. Expanded Definitions Covering Digital Commerce The draft significantly broadens several core definitions to capture modern commercial activities: “Consumer” is expanded to include natural persons and nonprofit juristic persons who purchase or receive services, including those solicited by businesses and end users who do not directly pay for the goods or services. “Business operator” now explicitly covers advertising business operators and hired advertising persons, such as influencers and content creators. “Advertising media” is expanded to include digital platforms, social media, and social media user accounts. “Label” now encompasses electronic labels—symbols, codes, or other electronic formats displaying product information. Influencer and Advertising Disclosure Requirements In addition to these expanded definitions, “hired advertising person for selling goods or services” is a new definition covering influencers, content creators, live streamers, affiliate marketers, and virtual online media operators who receive monetary compensation or other benefits for advertising goods or services. Hired advertising persons—including influencers and content creators—must disclose to consumers that content is advertising and reveal their relationship with the business owner. Disclosure is required when the business owner employs the advertiser, pays or provides other benefits for the advertisement, or provides free or discounted products or services. These requirements apply where consumers would not otherwise know that the business has a connection to the person presenting the content. Labeling Requirements for Importers The draft introduces a clearer labeling obligation for importers of label-controlled goods, who must
September 11, 2026
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has published a new five-year master plan that will bring significant regulatory changes to the broadcasting and digital media sectors, including formal licensing requirements for internet-based audiovisual services. The Master Plan for Broadcasting and Television, 3rd Edition (B.E. 2569–2573/2026–2030) was published in the Government Gazette on September 1, 2026, and will affect OTT platforms, internet-based audiovisual service providers, and traditional broadcasters. Licensing Reform The NBTC will develop new licensing frameworks ahead of existing digital television license expirations, which are slated to occur between 2028 and 2030. This creates both uncertainty and opportunity for incumbents and new market entrants. New licensing criteria will also be developed for audiovisual services delivered over the internet, meaning previously unregulated internet-based providers may face licensing, fee, and content obligations for the first time. The plan also calls for a new law to govern converged communications services. OTT Regulation and Content Oversight The plan explicitly acknowledges and aims to lessen the regulatory asymmetry between traditional broadcasters—which are subject to licensing, fees, and content regulation—and internet-based services that currently face fewer obligations. The NBTC intends to develop regulatory frameworks to bring internet-based audiovisual services, including OTT platforms, streaming services, and user-generated content platforms, under content, consumer protection, and licensing requirements. Consumer Protection and Digital Rights The NBTC will strengthen its oversight of broadcasting, television, and telecommunications operators to ensure compliance with consumer protection and personal data protection requirements. This includes updating relevant notifications and orders and more strictly enforcing rules against practices that unfairly exploit consumers. These measures may layer NBTC-specific requirements on top of Thailand’s existing Personal Data Protection Act obligations. Stricter enforcement against practices that exploit consumers is a priority, with particular scrutiny on advertising practices. The NBTC will modernize complaint resolution processes, meaning service providers should