You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 6, 2019

The Compliance Framework for Online Content in Thailand

Informed Counsel

With the growing power and influence wielded by online content, concerns have been raised in Thailand (as in many other countries) that online channels, which facilitate free and easy exchange of information across a variety of forums, could be used to conduct illegal activities that will incite discontent and conflict within the country. This is especially true of information exchanged and shared through social media and Over-the-Top (OTT) services.    

In a bid to exercise a degree of control over online content, a number of laws and regulations have been prescribed focusing specifically on types of information that should be restricted, or prohibited, from being disseminated online. The following is an overview of Thai laws and regulations relating to online content.

Computer Crimes Act    

The Computer Crimes Act (CCA) is used by the government as a tool to control, restrict, and prohibit the dissemination of specific information by computer. The CCA also authorizes authorities to monitor internet traffic and suppress content that falls within the scope of the following criteria:

  • Distorted, false, or partially false content which is likely to cause damage to the general public with malicious intent.
  • False content which is likely to cause damage to national security, public safety, national economic stability, or infrastructure for the public benefit, or cause panic to the general public.
  • Content that constitutes a criminal offense relating to national security or terrorism, the royal family, or relationships with foreign nations, as prescribed under the Penal Code.
  • Content that constitutes a criminal offense under the laws relating to intellectual property.
  • Content which, by itself, is contrary to Thai public order or good morals.
  • Obscene or pornographic content.
  • Computer data or emails which could be regarded as a disturbance to the recipients, wherein there is no option for them to easily opt out or unsubscribe.

The provisions of the CCA also provide enforcement measures aimed at tackling intellectual infringement through online platforms. These measures provide the possibility of imposing a permanent injunction, which allows for the suspension or blocking of websites that contain content, or disseminate any data, that is deemed to infringe intellectual property. The provisions also allow for the removal of such data from computer systems. 

Child Protection Act     .

The Child Protection Act prohibits the dissemination of any information relating to a child with the intention of causing damage to the mind, reputation, prestige, or any other interests of that child, or which seeks benefit for oneself or others in an unlawful manner.

Copyright Act   

With millions of people spending an increasing proportion of their time online in order to enjoy online content and services, several types of infringing digital content (e.g., movies, songs, or games) can easily be illegally disseminated and consumed through online platforms, increasing the risk of copyright infringements. Notably, an amendment to the Copyright Act that came into force in 2015 provides alternative relief for copyright infringement in the form of a preliminary injunction, allowing the injured parties to have infringing content removed from the internet.

NCPO Orders   

In addition to these attempts to curb widespread distribution of unregulated online content, Thailand’s interim government, the National Council for Peace and Order (NCPO), has attempted to exert additional controls over digital rights by imposing extensive prohibitions on the dissemination and broadcasting of information via various forms of media.   

These NCPO orders empower authorities to prohibit the dissemination and broadcasting of any information that falls within the confines of the following criteria:

  • False content that could cause defamation or have a negative impact on the royal family.
  • News or information that could be harmful to national security.
  • Criticism of the NCPO’s operation which is provided in bad faith, or any false information that could impair the NCPO’s credibility.
  • Voices, photos, and videos relating to the confidential operation of government agencies.
  • Information which could cause controversy or polarization within the country.
  • Information that invites people, or leads to the assembly of people, in order to oppose NPCO officials, or people associated with the NCPO.
  • A threat to commit an act of violence against other people, or which causes panic or fear among the general public.

On top of these extensive restrictions, the NCPO orders also further prohibit individuals and media from inviting academics, or former civil servants, for interviews or to express opinions that are deemed to be in a manner that could exacerbate conflicts, or which distort information and cause confusion amongst the public.

Moving Forward   

The extensive restrictions and prohibitions cited above have not been initiated without concerns being raised in some quarters, and there is consternation that the drive to enforce the law could also result in a reduction in individual rights to freedom of expression.    

Therefore, finding a balance and suitable resolutions for these issues appears to be a crucial challenge for Thailand’s regulatory authorities, and ultimately, the country’s next government, which will come to power after the widely anticipated elections are held in March 2019. In the meantime, and whatever the outcome, it is imperative that both individuals and corporations understand the laws relating to online content, and exercise caution when engaging in any online transactions or businesses, in order to mitigate their exposure to potential penalties that may be imposed for transgressions.

RELATED INSIGHTS​ 

July 6, 2026
Vietnam has introduced an official list of high-risk AI systems, triggering more stringent compliance obligations for developers, suppliers, and deployers operating in the country. On June 30, 2026, the prime minister issued Decision No. 33/2026/QD-TTg (Decision 33), which establishes the List of High-Risk AI Systems under the Law on Artificial Intelligence (AI Law) and Decree No. 142/2026/ND-CP (Decree 142). Decision 33 takes effect on August 15, 2026. Decision 33 is significant because only AI systems included on the list will be subject to the heightened compliance obligations applicable to high-risk AI systems under the AI Law and Decree 142. These include, among others, local presence requirements for foreign providers, mandatory conformity assessment before deployment, comprehensive risk management and data quality documentation, and strict liability for damages even when the provider is fully compliant. Decision 33 also specifies the applicable conformity assessment pathway for each listed system, indicating whether the system must undergo mandatory third-party conformity certification before being placed into use, or whether the provider may self-assess conformity or voluntarily engage a registered or recognized conformity assessment body. Which AI Systems Are Covered? Decision 33 identifies high-risk AI systems across six sectors—the key attributes of which are summarized below. Education: AI systems used for automated assessment, learner ranking, behavioral monitoring, or generating educational content from uncontrolled data sources. Ethnic affairs and religion: AI systems used to automatically score, classify, or rank applications for government ethnic policies; approve or reject regulatory applications; suspend benefits on suspicion of fraud; allocate budgets; or infer and classify individuals by ethnicity or religion for administrative purposes. Healthcare: AI-assisted surgical systems and autonomous AI-powered surgical robots. Banking: AI systems that autonomously conduct electronic banking transactions or make credit approval decisions. Judicial proceedings: Certain large-scale biometric identification systems used in public-interest civil proceedings. Transport: Thirty-one categories
July 6, 2026
Indonesia’s regulation on reporting online intellectual property (IP) infringement provides comprehensive procedural guidance for IP rights holders and their licensees in reporting online infringement complaints. Issued in December 2025 by the Ministry of Law as Regulation No. 47 of 2025 regarding Handling of Intellectual Property Infringement Reports in Electronic Systems, this regulation covers all types of IP rights. It also specifies documentation when reporting infringement, and lays out the procedures for examination, verification, and enforcement actions. Submission of Complaints Complainants may submit reports through the online system of the Directorate General of Intellectual Property (DGIP) or in person at the DGIP office. Complaints may also be filed through an authorized proxy. Under the regulation, complainants are required to provide the following information and documents: Personal details of the complainant; Brief description of the protected work or subject matter (i.e., type of IP and name or address of the infringing website, portal, account, or application, or a link to the location of the infringing content); Complete description of the alleged infringement; Certificate of registration or recordal of the relevant IP; Recordal of IP license agreement, if any; and Other supporting evidence. Verification and Examination Process Upon receiving a complaint, the responsible formality officer may request clarification or additional supporting documents. In the latter case, the complainant must then submit the necessary administrative documents within 14 days of the notification date. Once the documentation is deemed complete and sufficient, the case will be formally registered. Subsequently, the DGIP will establish a verification team to handle online IP violations, which will include the Civil Servant Investigator (PPNS), the Ministry of Communication and Digital Affairs, experts with relevant expertise in IP, and representatives from related associations such as AVISI (Indonesian Video Streaming Association). After examining the report, the team will prepare the Minutes
July 6, 2026
Tilleke & Gibbins has contributed the Vietnam chapter to Data Protection & Privacy 2027, a global guide published by Lexology Panoramic that provides comparative insights into data protection and privacy regimes across multiple jurisdictions. The Vietnam chapter offers a comprehensive overview of the country’s data protection framework, addressing both regulatory structure and practical compliance considerations for businesses operating in or engaging with Vietnam. Topics covered include: Law and the regulatory authority: Legislative framework; data protection authority; cooperation with other data protection authorities; breaches of data protection law; judicial review of data protection authority orders Scope: Exempt sectors and institutions; interception of communications and surveillance laws; other laws; personal information formats; extraterritoriality; covered uses of personal information Legitimate processing of personal information: Lawful bases for processing; grounds for legitimate processing; types of personal information Data handling responsibilities of owners of personal information: Transparency; exemptions from transparency obligations; data accuracy; data minimization; data retention; purpose limitation; automated decision-making Security: Security obligations; notification of data breaches; internal controls Accountability: Data protection officer requirements; record-keeping; risk assessment; design of personal information processing systems Registration and notification: Registration requirements; other transparency duties Sharing and cross-border transfers of personal information: Sharing with processors and service providers; restrictions on third-party disclosures; cross-border transfers; further transfers; localization requirements Rights of individuals: Right of access; other statutory rights; compensation Enforcement: Enforcement mechanisms; exemptions, derogations, and restrictions; further exemptions and restrictions Specific data processing: Cookies and similar technologies; electronic communications marketing; targeted advertising; sensitive personal information; profiling; cloud services The chapter concludes with an update on key legal and regulatory developments over the past year and emerging trends in Vietnam’s data protection landscape. The full Vietnam chapter is available as a PDF through the button below. Readers can also gain 30 days of complementary access to the full Data
July 2, 2026
Thailand’s Electronic Transactions Development Agency (ETDA) released a new version of the draft Act on Artificial Intelligence on July 2, 2026, for a public hearing period expected to be approximately 30 days. The draft act adopts a risk-based regulatory approach modeled in part on international frameworks—particularly the EU’s AI Act—while incorporating provisions tailored to Thailand’s regulatory landscape and digital economy objectives. If enacted in its current form, the law would introduce extraterritorial obligations, a tiered risk classification system, strict liability for AI-related damages, and new transparency requirements for AI-generated content. Scope and Extraterritorial Application The draft act applies to AI development, deployment, or any other action affecting people in Thailand, even if the action occurs outside the country. Of note: This extraterritorial reach creates compliance obligations for global AI companies whose systems impact Thai residents or consumers, even if the provider has no physical presence in Thailand. Foreign AI providers serving Thai deployers or users must appoint a local coordinator or authorized representative. Depending on the type of AI system, the representative may need full authority to act on behalf of the provider without any limitation of liability. Certain activities are exempt from the draft act’s oversight, including AI used by natural persons solely for personal or household activities, AI for educational research conducted by higher education institutions with ethics committee approval, research and development activities conducted prior to distribution or service provision, and other AI systems prescribed by royal decree. Risk-Based Classification Framework The draft act establishes a tiered risk classification system with three main categories: Prohibited AI. The act outright prohibits AI systems employing cognitive-behavioral manipulation using subliminal techniques, AI systems causing unfair broad-scale discrimination from processing irrelevant data, and other categories of serious risk as determined by announcement of a forthcoming committee that will be responsible