Computer Crime Law Thailand And The Points To Know
Summarise this blog
Key Takeaways
- The Thai computer crime act applies to everyone operating online in Thailand, and it sets criminal penalties, not civil ones.
- The spam provision is the one marketers meet most: an advertising message with no easy way to opt out carries a fine of up to 200,000 baht.
- A platform or page admin who allows unlawful content to stand carries the same penalty as the person who posted it, unless notice and takedown is followed.
- Publishing an edited image that damages someone carries up to 3 years and a fine of up to 200,000 baht, and both apply, not one or the other.
- Several rules people file under this Act sit in other statutes: the Child Protection Act, the Copyright Act and the Criminal Code.
- Running marketing lawfully means reading this Act alongside the PDPA, because the two cover different halves of the same activity.
Social platforms are now part of ordinary daily life. People post, share, comment and forward at speed, rarely pausing over whether a particular action crosses a legal line, and the penalties behind those lines are heavier than most expect: custodial terms as well as fines.
The Act on Computer-Related Offences was written to apply to everyone operating online in Thailand. Individuals, content creators, brand owners and the teams running their marketing all sit inside it.
Knowing what it covers lets a brand market with confidence rather than caution, and it shows where the real exposure sits, which is rarely where people assume.
Table of Contents
What Is The Thailand Computer Crime Act
Its full name is the Act on Computer-Related Offences. It sets out which actions taken on a computer system or online amount to a criminal offence in Thailand, and it attaches a specific penalty to each one.
Thailand has enacted it twice. The first version came in 2007, written for how people used the network at the time. The version in force today is the 2017 amendment, effective from 24 May 2017, which brought the drafting up to date with how social platforms actually work: spam, altered images, and where responsibility falls for a page admin or a hosting provider.
How The Act Is Structured
The 2017 Act divides into two main parts.
- Chapter 1, offences relating to computers (sections 5 to 17). The part that concerns the public and anyone marketing online directly. It defines the conduct: unauthorised access, interception of data, entering false data, altering images, and sending messages that cause nuisance.
- Chapter 2, competent officials (sections 18 to 31). The scope of the powers state officials hold to investigate, examine and bring proceedings against an offender.
The Penalties Under The Thailand Computer Crime Act
The penalties divide along the same line the Act does: offences against systems and data, and offences involving what gets published.
Offences Against Systems And Data, Sections 5 To 13
Accessing another party’s computer system without authorisation, such as taking over someone’s account, carries up to 6 months, or a fine up to 10,000 baht, or both.
Learning an access measure and passing it on, such as posting a password to someone else’s system where others can see it, carries up to 1 year, or a fine of up to 20,000 baht, or both.
Accessing another party’s computer data without authorisation, such as opening private files or a protected database, carries up to 2 years, or a fine up to 40,000 baht, or both.
Intercepting another party’s data in transit, such as capturing credentials sent across a shared network, carries up to 3 years, or a fine up to 60,000 baht, or both.
Damaging another party’s data, by deleting or altering it without permission, carries up to 5 years, or a fine up to 100,000 baht, or both.
Obstructing a computer system so it cannot work normally, such as flooding a site with requests in a DDoS attack until it goes down, carries up to 5 years, or a fine of up to 100,000 baht, or both.
Sending data or email that causes nuisance, such as advertising email or SMS with no easy way for the recipient to refuse further contact, carries a fine of up to 200,000 baht.
Offences against systems that matter nationally are treated more seriously, and they split in two. Where a section 9 or section 10 offence is committed against a system relating to national security, public safety, economic security or public infrastructure, the penalty is 1 to 7 years and a fine of 20,000 to 140,000 baht. Where it is committed in a way likely to cause damage to that system, it rises to 1 to 10 years and a fine of 20,000 to 200,000 baht. If such an act endangers another person or their property, the penalty is up to 10 years and a fine up to 200,000 baht. If it causes a death, it is 5 to 20 years and a fine of 100,000 to 400,000 baht.
Selling or distributing a tool built to commit these offences, such as a packaged hacking tool or a virus written to break into someone else’s system, carries up to 1 year, or a fine up to 20,000 baht, or both. Where the tool is made to attack a security system it rises to 2 years, or a fine up to 40,000 baht, or both. Where the tool is then actually used to commit an offence, the person who sold or distributed it faces a higher penalty again.
Offenses Involving Published Content, Sections 14 To 17
Entering false or distorted data dishonestly or deceptively, in a way likely to damage the public, carries up to 5 years, or a fine up to 100,000 baht, or both. The same penalty applies to data affecting national security or public morals, and to obscene material made available where the public can reach it.
Where that false data is aimed at an individual rather than the public, and does not amount to defamation under the Criminal Code, the penalty drops to 3 years, or a fine up to 60,000 baht, or both, and the offence becomes compoundable, meaning the parties can settle it.
Service providers such as social platforms and hosting companies carry the same penalty as the offender where they cooperate with, consent to or connive in unlawful content on their system. They are excused where they can show they followed the notice and takedown process the Ministry has prescribed for receiving a report and removing the content.
Publishing an edited, added-to or otherwise altered image of another person in a way that damages their reputation or exposes them to contempt, a deepfake among other things, carries up to 3 years and a fine up to 200,000 baht. Both apply, not one or the other. It is a compoundable offence, and it is a part of the Act many people are unaware of.
An offence under this Act committed outside Thailand is still punishable inside it. That holds whether the offender is a Thai or a foreign national, where the act affects the Thai government, Thai nationals or systems in Thailand.
Thailand Computer Crime Act 13 Sections, In Plain Terms
So that online marketing does not run into a penalty under this Act, here is the summary that circulates most widely in Thailand: 13 practical points, drawn from the 2017 Act and from the laws sitting alongside it, so that people using social platforms and brands operating online can steer around the conduct more easily. Several of the points are governed by another statute, and each of those says which.
- Posting a shop plug in the comments under someone else’s Facebook or Instagram content without permission is treated as causing nuisance, and carries a fine of up to 200,000 baht.
- SMS marketing and advertising messages have to carry an easy way to refuse or stop them. Without one it is spam, and the fine reaches 200,000 baht.
- Marketing email with no convenient unsubscribe falls under the same provision, and carries the same fine of up to 200,000 baht.
- Liking a post is generally not treated as entering data into a computer system, so it does not by itself fall under this Act. Content concerning the monarchy is dealt with separately, under section 112 of the Criminal Code, which sits outside this Act.
- Sharing is republishing. Share false data, or content that damages a third party or affects national security, and the person sharing can carry the same liability as the original poster.
- A platform, social network or hosting provider that allows unlawful content to stand on its system carries the same penalty as the offender, and is excused where it operates the notice and takedown process the law prescribes.
- A page admin or system operator who opens a post to comments and leaves unlawful ones in place is in the same position, and is likewise excused on proof that publication was suspended and the content removed.
- Posting obscene material where the public can reach it carries up to 5 years, or a fine up to 100,000 baht.
- Content featuring children and young people should conceal the face, other than where the coverage is genuinely honouring them. This one is governed by the Child Protection Act B.E. 2546, section 27.
- Content about someone who has died must not damage their reputation, and surviving relatives may bring a complaint. This falls under section 327 of the Criminal Code.
- Publishing an edited or altered image of a person in a way that damages them carries up to 3 years and a fine up to 200,000 baht.
- Abusing someone in writing is defamation, and is dealt with under the ordinary criminal law rather than this Act. The 2017 amendment removed it deliberately, so it sits under sections 326 and 328 of the Criminal Code.
- Using text, music, images or video without a licence is an offence under the Copyright Act B.E. 2537. Reposting a greeting card or a new year graphic is not an issue while it stays non-commercial.
The 5 Risks Marketers And Brand Owners Meet Most
With the Act understood, five points account for most of the exposure a marketing team or a brand owner actually carries, because they are the ones people walk into most often.
- Marketing email or SMS with no way out. An advertising message or an email campaign sent without an unsubscribe button, or without any easy route to refuse further contact, is the spam offence. Where the underlying list was built without consent, the PDPA applies on top of it.
- A page admin who stops reading the comments. Unlawful, spam, obscene or abusive comments left standing under a brand’s own advertising, without publication being suspended and the content removed, can put the admin or the page owner in the position of having allowed the offence, and carrying it alongside whoever posted it.
- Licensed images, music and video used without a licence. Pulling an image out of a search result into an ad graphic, or dropping a chart track into a Reels or TikTok clip without buying the commercial rights, is principally a copyright matter. It becomes a Computer Crime Act question where a watermark or rights information is stripped before the file is uploaded.
- Fake reviews and claims that cannot be supported. Manufacturing reviews, or claiming a product does something it does not, falls under section 14 as entering false data.
- Altering an image of a real person for commercial use. Editing a customer’s photograph, or generating a likeness of someone with AI for an advertisement, is section 16 territory where the result exposes that person to embarrassment, contempt or reputational damage.
The PDPA And The Computer Crime Act Work Together
This Act does not operate alone. It runs alongside the Personal Data Protection Act, and in practice a marketing team meets both in the same piece of work.
The distinction is straightforward. The Computer Crime Act penalises conduct on a computer system. The PDPA protects a person’s rights in their own data. Marketing lawfully in Thailand therefore means running a consent management process, publishing a privacy policy that says something concrete, and giving every recipient a way to stop hearing from you whenever they choose. That combination satisfies both.
Marketing Within The Law Starts With A Sound Approach
Marketing that works has to be lawful and well aimed at the same time. Messaging a large list indiscriminately, or reaching for a shortcut that saves a week, tends to cost more than it saves once a fine and the reputational damage are counted.
If you are looking for a partner to plan the approach and run the work properly, Primal is a leading Digital Marketing agency covering digital marketing end to end: SEO, Google Ads management, social media marketing and AI Search services, delivered by specialists who have run these campaigns before. To grow a brand safely and reach the right people, a conversation with our Digital Marketing agency team is the place to start.
Frequently Asked Questions About The Computer Crime Act (FAQs)
| Question | Answer |
|---|---|
| What is the difference between Thailand’s computer crime act 2007 and 2017? | The 2017 amendment brought the drafting into line with how social platforms are actually used. Three changes matter most.
|
| If an account is hacked and the hacker posts something unlawful, is the account holder liable? | No, provided they can show the account was accessed without authorisation at the time. On discovering the breach, recover the account, file a report with the police so there is a record, and say what happened on another channel straight away. |
| Does screenshotting a private chat and posting it publicly breach the Act? | It carries real risk. Where the screenshot reveals a name, a face or anything else identifying someone, and that person suffers damage, contempt or embarrassment as a result, it can fall under the provisions on entering data that damages another person, and it raises a PDPA question about personal data at the same time. |
| How long do proceedings under the Act remain open? | Prescription runs off the maximum custodial term for the section in question, under section 95 of the Criminal Code:
Note: for a compoundable offence, such as an edited image under section 16, the injured person must lodge a complaint within 3 months of learning both of the offence and of who committed it. After that the case is out of time. |
| How do you gather evidence and where do you report an offence? | Three steps.
|
Disclaimer
This article summarises provisions of the Act on Computer-Related Offences and is published for general information. It is not legal advice, and reading it does not create a lawyer and client relationship.
The summary is written from the Act as amended in 2017 and reflects the position at the date of publication. Thai law changes, and penalties, thresholds and enforcement practice can be revised or reinterpreted by the courts. The authoritative text is the Thai-language statute published in the Royal Gazette. Where this English version differs from the Thai text, the Thai text governs.
Individual circumstances vary, and whether a particular action falls inside a provision depends on facts this article cannot anticipate. Before acting on anything here, or if you are dealing with a live matter, take advice from a lawyer qualified in Thailand. Primal accepts no liability for any loss arising from reliance on this article.
Join the discussion - 0 Comment