You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 12, 2021

Thai Court Rules That Regulation Restraining Internet Access Violates Right to Free Expression

In a politically charged climate and in the face of governmental efforts to curb unrestrained publication of what it calls “fake news”, the Thai Civil Court, in a ruling of significant importance, has upheld the constitutionally recognized right to freedom of expression in all mediums of communication, including the internet. Specifically, on August 6, 2021, the court issued an order prohibiting the Prime Minister from enforcing the Regulation Issued under Section 9 of the Emergency Decree on Public Administration in Emergency Situations B.E. 2548 (2005) (No. 29) (Regulation 29), which was issued on July 29, 2021, under Section 9 of the Emergency Decree on Public Administration in Emergency Situations B.E. 2548 (2005).

Under Regulation 29 it is prohibited for any person to present or disseminate content that:

  • is distorted information which causes misunderstanding of the emergency situation to the extent of affecting the security of the state, public order, or good morals of the people of Thailand; or
  • may instigate fear among the people.

Significantly, Regulation 29 allows the National Broadcasting and Telecommunications Commission (NBTC) to identify the IP address and other information of the owner of content said to violate the regulation. It also empowers the NBTC to order Internet Service Providers (ISPs) to provide such information and to cease providing internet services for the IP address. Violation of Regulation 29 and failure by ISP providers to comply with orders issued by the NBTC both carry punishment including fines and imprisonment.

While Regulation 29 is said to be an attempt by the Thai Government to address “fake news” relating to the COVID-19 pandemic in Thailand, the regulation has been widely criticized as broadly empowering the government to control all forms of information in the public sphere, including intervention with essential media functions. This is exacerbated by the use of ambiguous language prohibiting content “that may instigate fear among the people” and which is not limited to false or distorted information. The immediate effect of Regulation 29 was a jointly filed lawsuit by online press and human rights organizations seeking revocation of Regulation 29.

On August 6, 2021, the Civil Court issued an emergency order prohibiting the Prime Minister from enforcing Regulation 29. In its decision, the court ruled that a prohibition relating to “content that may instigate fear among the people” is ambiguous and may lead to an unnecessarily broad interpretation affecting freedoms of expression and the press guaranteed by the Constitution. In addition, the court ruled that the regulation placed a disproportionate burden on the people to interpret and comply with the law.

Moreover, the court ruled that access to internet services is an important communication channel for society, a fact that is particularly important while Thailand is employing Covid-19 lockdown measures. The court confirmed that regulations requiring ISPs to cease providing internet services for owners of content violating Regulation 29 results in an impermissible blockage of communication channels and is unconstitutional.

Although this order is neither a final judgment nor a binding precedent, it represents an uncommon position of the courts and it is most likely that other courts would reach similar conclusions should further regulations seek to impinge on recognized constitutional freedoms of expression. As confirmation of this result, the Thai government issued a regulation effective August 9, 2021, canceling Regulation 29. While there may be future efforts to restrict or otherwise control online content, including through the exercise of power under the Computer Crimes Act B.E 2550 (2007), the courts stand poised as a scale through which control and restraint mechanisms shall be balanced.

RELATED INSIGHTS​ 

February 10, 2026
Data center and cloud investments are forming a major focus of private-sector investment in Thailand, with tech giants like Amazon, Google, Microsoft, and TikTok, as well as numerous telecom and data center companies, committing significant outlays to data center and cloud development. The country’s Board of Investment (BOI) approved projects worth THB 1.87 trillion in 2025, and THB 746 billion of this was from planned data center investments—by far the largest amount from any single industry. Thailand’s swift rise as a regional data center hub is fueled by surging demand for cloud, AI, and digital services, as well as large-scale investments from global tech firms. The country’s strategic location, competitive power costs, robust fiber infrastructure, expanding IT talent, and supportive government policies—including BOI incentives and streamlined approvals—have made it an attractive destination for scalable and sustainable digital infrastructure investments. The BOI’s proactive approach in updating promoted categories and providing both tax and non-tax incentives further ensures Thailand’s continued growth in this sector. 2025 BOI Changes for Data Centers In the middle of 2025, the BOI responded to the remarkable trend by updating investment‑promotion categories across various sectors (e.g., machinery and electrical equipment, public utilities, digital and innovative industries) to accommodate growing investment in data‑center projects. Before the change, which was detailed in a notification that has applied to investment promotion applications submitted from July 1, 2025, onward, data‑center projects under BOI promotion were granted a single A1 incentive (an eight‑year corporate income‑tax exemption) and subject to one uniform set of conditions. The July 2025 notification restructured promotion for data centers into two categories based on power‑usage efficiency: high‑efficiency data centers and other data centers. Under these rules, qualified high‑efficiency data centers are eligible for an eight‑year corporate income tax (CIT) exemption, while for other data centers this exemption is
February 4, 2026
On November 18, 2025, Vietnam’s Ministry of Finance released for public consultation a draft decree on administrative sanctions in the field of crypto assets and crypto asset markets (the “Draft Decree”), intended to implement Resolution No. 05/2025/NQ-CP dated September 9, 2025, on the pilot crypto asset market in Vietnam (“Resolution 05”). While Resolution 05 sets out who may participate and under what conditions, the Draft Decree addresses a more practical question for market participants, i.e., what happens if those conditions are not met. In doing so, the Draft Decree offers important insight into how Vietnamese regulators intend to supervise, discipline, and ultimately shape the crypto market during the pilot phase. Regulatory Scope and Overall Sanctions Architecture The Draft Decree applies to both domestic and foreign organizations and individuals engaging in crypto-related activities in Vietnam’s market. Covered entities include: (i) crypto asset issuers; (ii) crypto asset service providers, including trading platforms and market operators; (iii) Vietnamese and foreign investors participating in the pilot market; and (iv) other organizations involved in the offering, issuance, or provision of crypto-related services in Vietnam. The breadth of this scope is deliberate. It appears to reflect a regulatory view that cross-border structures, offshore platforms, and indirect participation may not necessarily insulate market actors from compliance obligations once they operate within the pilot framework. For the crypto industry, this may mark a shift from regulatory ambiguity toward a more explicit articulation of jurisdictional reach. At first glance, the Draft Decree’s monetary penalties appear restrained. The maximum fine per administrative violation is capped at VND 200 million (approx. USD 7,700) for organizations and VND 100 million (approx. USD 3,800) for individuals. However, focusing solely on fine levels risks missing the point. The Draft Decree also places great regulatory weight on supplementary sanctions and corrective measures, including: (i)
January 30, 2026
Thailand’s Data Privacy Day 2026, hosted by the Office of the Personal Data Protection Committee (PDPC), underscored the country’s commitment to strengthening personal data protection, advancing regulatory maturity, and preparing organizations for the next phase of PDPA enforcement. The event marked a clear shift from policy-level compliance toward “Privacy in Action,” signaling that operational readiness and real-world implementation are now priorities. The Office of the PDPC also emphasized that data protection is now a national economic enabler that supports digital trust, competitiveness, and sustainable growth, not just a compliance obligation. The following insights summarize the key takeaways from the Data Privacy Day 2026 event. PDPA in Real Life: What Happens to Your Data Today The Office of the PDPC provided concrete data on enforcement trends and real-world compliance issues facing organizations across Thailand. Complaints and trends. The Office of the PDPC’s Personal Data Protection Act (PDPA) Center recorded 2,672 PDPA-related complaints as of January 2026, with the highest volumes involving failure to comply with the data minimization principle, collection without lawful basis, and use and disclosure without lawful basis. Administrative penalties. Several administrative penalties have been imposed on data controllers and data processors across various sectors, including government, healthcare, retail, SMEs and e-commerce, ranging from tens of thousands to several million baht. Most violations stemmed from weak security measures, failure to notify data breaches within the required timeline, absence of a data protection officer (DPO) when required, and noncompliance with governance requirements such as the Record of Processing Activities (ROPA) and data processing agreements with data processors. Case studies. The Office of the PDPC highlighted specific examples of violations: Hospitals misused personal data for purposes beyond their intended scope (e.g., using personal data collected for providing medical services to send birthday cards) Vendors compromised systems due to inadequate password
January 29, 2026
Following the recent enactment of a comprehensive legal framework addressing sexual harassment, Thailand has launched a fast-track judicial process enabling victims of online sexual harassment to obtain court orders suspending and removing obscene content from the internet. On January 26, 2026, the Office of the Judiciary introduced the “Take It Down” procedure through the Court Integral Online Service (CIOS) platform, providing victims with their first direct, expedited pathway to halt the spread of online content that violates the new legal provisions against sexual harassment. This new remedy stems from section 284/4 of the Penal Code, introduced through the Act Amending the Penal Code (No. 30) B.E. 2568, which took effect on December 30, 2025. Under section 284/4, an injured person or a competent official may petition the court to suspend dissemination of violating data and remove the data from computer systems within a court-specified period. The court may also direct system controllers, service providers, or competent authorities to carry out the order and report back within 15 days. Filing through the CIOS Platform The CIOS platform serves as the primary electronic channel for these petitions. Key features include: Individuals can file online without appearing in person and may submit petitions at any time the system is available. Users must complete digital identity verification via the ThaID application to access the CIOS. Petitions under section 284/4 are limited to requests to suspend or remove violating content. Claims for monetary damages must be pursued separately, including via separate proceedings or prefiling mediation. Streamlined Review Process The submission workflow is end-to-end electronic, and the system provides step-by-step guidance. After submission, court staff review the petition before presenting it to a judge for consideration. The court may conduct an online inquiry to obtain additional information, and in-person attendance is required only if deemed