You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 5, 2017

Thailand: Amendments to Computer Crimes Act

Subscribe to Updates

On December 16, 2016, Thailand’s National Legislative Assembly passed draft amendments to the 2007 Computer Crimes Act (the “Act”). When it takes effect, the new Act will broaden the powers and reach of the Ministry of Digital Economy and Society. Competent officials under the Act may carry out investigations or confiscations if the crime (falling under the Computer Crimes Act or other criminal offenses) was committed using computer systems, computer data, or equipment for storing computer data. The Act will also extend the powers of inquiry officials by granting them power to instruct competent officials under the Act without the need for a court order and to carry out any investigation or confiscation process, as listed in the Act.

The following is a brief snapshot of the amendments made to the Act:

  • Among the committees appointed under the new Act, a Computer Data Screening Committee will have the power to permit officials to request a court order to block or destroy any data which is contrary to the stability or good morals of the people, even if the data does not violate any criminal laws.
  • The Ministry’s powers have been expanded to include offences or acts which relate to “national security, public safety, national economic stability, or the infrastructure for public benefit,” including hacking into systems relating to these broad criteria.
  • Crimes relating to the importation of forged data into a computer system now include the requirement of dishonesty and deceit, and separate penalties have been set for offenses against individuals.
  • Of particular interest to companies, the new Act will also criminalize the sending of emails or data which cannot be unsubscribed by the recipient and which disturbs the recipient. This can be read as criminalizing spam, which has never previously been included in the Act. However, the definition and criteria for “disturbs” is not stipulated and will be set out in ministerial regulations.
  • A service provider may prevent themselves from being deemed criminally liable for crimes committed by an individual using their service by restraining the dissemination of computer data. Importantly, however, the relevant details of these terms will be set out later in regulations to be passed by the Ministry.
  • Furthermore, the new Act maintains the previous Act’s requirement to retain general traffic data for not less than 90 days, while the period within which a service provider may be ordered to store traffic data has been extended from one year to two in special cases. But the Act now gives service providers the right to appeal such an order.

The Act is now awaiting royal endorsement and is expected to come into effect later this year.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

November 14, 2025
Interest in data center land acquisition has increased significantly over the past year, with a notable rise in inquiries from investors seeking to establish digital infrastructure in Thailand. Although the sector is still in its early stages, this emerging wave of development represents a significant shift in Thailand’s technology infrastructure landscape, driven primarily by multinational technology companies and operators looking to expand their regional presence. Project Development The data center sector in Thailand is attracting a diverse range of international investors, though with clear geographic patterns. Most investors are from China, Singapore, and Japan, with some additional interest from countries outside Asia, including the United States and Europe. This investor base consists primarily of multinational tech companies and operators seeking to establish new facilities rather than acquire existing assets. Data center business activities are also a sector promoted by Thailand’s Board of Investment (BOI), which offers investors both tax and nontax privileges as well as exemptions to foreign investment and land-ownership restrictions. Projects currently underway are still largely in the land acquisition and construction phase. Unlike more mature markets where many facilities are operational and generating revenue, the predominant focus in Thailand remains on securing suitable land and beginning the building process. This means that while interest is high and land assembly is accelerating, the sector as a whole has not yet reached the operational phase that will ultimately drive licensing applications and full regulatory compliance. The licensing process itself remains at an early stage, as most projects must first complete their facilities before applying for the specific licenses required from the telecommunications authority. Once the facilities are built, the next critical step will be obtaining these telecommunications licenses, which are mandatory for data center operations. Legal and Regulatory Considerations The complexity of data center development in Thailand requires
Read More
November 12, 2025
Thailand’s Customs Department has announced the cancellation of the longstanding de minimis exemption, which waives import duties on goods valued at THB 1,500 or less, as of January 1, 2026. This policy shift will directly impact e-commerce, logistics, and retail sectors, and will have wide-ranging implications for any company involved in cross-border trade with Thailand. Background Under current regulations, imported goods with a customs value (cost, insurance, and freight, or “CIF”) of THB 1,500 or less are exempt from import duties. This has been a cornerstone of the cross-border e-commerce model, allowing for the duty-free import of millions of small parcels. Under the new policy effective January 1, 2026, all imported goods, regardless of value, will be subject to assessment for import duties upon entry into Thailand. The stated rationale for this change is to create fair competition for Thai small and medium-sized enterprises (SMEs), which must pay VAT and other costs on their goods, putting them at a price disadvantage against foreign sellers who utilize the de minimis loophole. Business Implications This policy change will create new costs, compliance burdens, and operational challenges. For foreign e-commerce sellers and platforms: The most direct impact will be the addition of import duties to low-value items. Assuming the costs are passed on to the consumer, the higher prices and potentially more complex or slower customs clearance processes could lead to increased cart abandonment and reduced consumer demand. Businesses should review their pricing models and develop a clear strategy for calculating, declaring, and paying these new duties. For logistics providers and customs brokers: The administrative burden will be considerable. Carriers that previously handled millions of nondutiable parcels will now be required to process them for duty assessment and collection. This may necessitate new IT systems and streamlined processes to avoid delays at
Read More
November 7, 2025
Thailand and the United States signed a memorandum of understanding (MOU) titled “Cooperation to Diversify Global Critical Minerals Supply Chains and Promote Investments” on October 26, 2025, signaling a new strategic alignment aimed at developing Thailand’s mineral sector, particularly in rare earth elements (REEs). The MOU has implications for investments in technology, manufacturing, and other related sectors. This update outlines the key provisions of the MOU and the potential opportunities and legal navigating points for businesses. Objectives The primary driver of this agreement is the US initiative to diversify global supply chains for critical minerals and reduce reliance on current market leaders, particularly China. For Thailand, it represents a major opportunity to attract high-tech investment and develop its downstream processing industries. The cooperation is set to focus on five main areas: Technical knowledge: Exchange of technical expertise and international best practices to strengthen Thailand’s mining and processing sector. Joint cooperation: Establishing workshops, seminars, and scientific collaboration to boost innovation. Regulatory practice: Promoting good governance and streamlining regulatory and licensing procedures. Information sharing: Sharing data on potential projects and global market prices. Full-value chain: The MOU covers the entire mineral lifecycle, from exploration and extraction to processing, refining, and recycling. “First Opportunity to Invest” Clause The most debated provision within the MOU states that “participants expect to have the first opportunity to invest . . . in critical minerals assets that may be sold in Thailand.” Business implications: This clause is widely interpreted as granting US companies a first look or preferential access to investment opportunities in Thailand’s critical minerals sector. This could be a significant advantage for US-based or affiliated companies in mining, technology, and energy seeking to secure a foothold in a developing REE supply chain. Thai government position: Thai officials, including the prime minister, have publicly clarified
Read More
October 31, 2025
On September 29, 2025, Thailand’s Office of the Personal Data Protection Committee (PDPC Office) published its Regulations on the Review and Certification of Binding Corporate Rules B.E. 2568 (2025) (the Regulations). The Regulations provide clarity on the PDPC Office’s approach to reviewing and certifying binding corporate rules (BCRs) under Section 29 of the Personal Data Protection Act B.E. 2562 (2019) (PDPA), and aim to facilitate international data transfers within a group of undertakings or enterprises (a “corporate group”). In conjunction with this development, the PDPC Office also approved BCRs for two companies operating in Thailand on September 30, 2025. This milestone represents the first concrete progress since the PDPC’s Notification on Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country pursuant to Section 29 of the PDPA B.E. 2566 (2023) came into effect in March 2024. Some key features of the Regulations are set out below. Categorization of BCRs BCRs are classified into two types: (1) BCRs for Controllers (BCR-C) and (2) BCRs for Processors (BCR-P). The category must be clearly specified when submitting the BCRs to the PDPC Office. Documentation Requirement The applicant must prepare and submit the application (a standard template may be provided by the PDPC Office in the future) along with supporting documents for review and certification in the Thai language. If the supporting documents are in a foreign language, a certified Thai translation should be provided. The translation must be notarized by a notary public or qualified person. Supporting documents may include, among others, a binding instrument such as an intra-group agreement, or a list of entities subject to the BCRs. Expedited Process Requirement Organizations with existing BCR approvals under the EU or UK GDPR, or from countries announced by the PDPC under Section 28, may apply through an
Read More