How to Keep Logs Under Thailand's Computer Crime Act B.E. 2560 (Complete Guide) — Log Management & ICT Spec
A practical guide to Thailand's Computer Crime Act B.E. 2560: who must keep logs, what to store, the ICT Spec standard, and log systems from ฿4,000/month.
Log Retention Under Thailand's Computer Crime Act B.E. 2560
What Is Log Retention, and Why Does the Law Require It?
Log retention (Log Management) is the systematic recording and storage of computer traffic data. It is a legal obligation for service providers that fall within the applicable definitions and requirements under the Computer-Related Crime Act B.E. 2550 (2007), as amended by the Act (No. 2) B.E. 2560 (2017) (พ.ร.บ. คอมฯ).
Failure to comply carries a fine of up to ฿500,000.
Who Has to Keep Logs Under the Computer Crime Act?
Under the law, the term "service provider" covers a much wider range of organizations than most people assume, and article 5 of the Ministry of Digital Economy and Society's 2021 notification sets which types must retain logs. Examples:
- Internet service providers (ISPs) — TRUE, AIS, 3BB, and other carriers
- Corporate and institutional networks — annex A of the notification gives government agencies, companies and educational institutions as examples, but it does not settle whether an organization that offers internet access only to its own staff must keep logs. Ask a lawyer
- Hotels, restaurants, and cafes that offer Wi-Fi — listed in annex A of the notification, but annex B gives restaurants and businesses that offer internet only as a side service a different option (see the FAQ below)
- Hosting providers — web servers, mail servers, internet data centers
- Internet cafes and online gaming shops
💡 In short: each organization should first assess whether it falls within the applicable “service provider” category and requirements.
What Data Actually Needs to Be Logged?
Section 3 defines computer traffic data as data about a communication between computer systems that shows its source, origin, destination, route, time, date, volume, duration, type of service or other related information. What each type of provider actually has to keep is itemized in annex B of the notification. Common examples:
- User information — user ID, IP address
- Session timing — date and time the connection started and ended
- Source and destination — the origin and endpoint of the communication
- Service type — the kind of service used
Key Log Sources
| Log Source | Example Data |
|---|
| Firewall | Source/destination IP, port, protocol, action (allow/deny) |
| Active Directory | Login/logout events, failed logins, group policy changes |
| Microsoft 365 | Email activity, file access, admin actions |
| Network Devices | Switch/router traffic, DHCP logs, DNS queries |
| Cloud Services | AWS CloudTrail, Azure Activity Log, GCP Audit Log |
| Endpoint Security | Antivirus events, EDR alerts, USB activity |
How Long Do You Have to Keep Logs?
The Computer Crime Act sets these retention periods:
- Minimum 90 days — covered service providers must retain logs for at least 90 days under the applicable Act and notifications
- Up to 2 years — only when a competent official orders a specific provider to keep logs longer than 90 days as a special case for that provider; it is not a period every provider has to keep
⚠️ Note: many organizations choose to retain logs for 365 days as a safety margin and to support retrospective investigations.
What Is the ICT Spec Standard?
ICT Spec is the informal name for two related documents. มศอ. 4003.1-2560 is a standard from NECTEC, Thailand's National Electronics and Computer Technology Center, with general requirements for computer traffic-data retention systems. The document that sorts log storage devices into three types, rated by EPS (events per second), is the MDES price and spec schedule; What Is ICT Spec? explains the difference:
| Type | EPS | Best Suited For | zcrLog ICT Appliance Price |
|---|
| Type 1 | 1,000 EPS | SMEs, small offices | ฿50,000 (one-time) |
| Type 2 | 7,000 EPS | Mid-sized organizations | ฿400,000 (one-time) |
| Type 3 | 20,000 EPS | Large enterprises, government agencies | ฿850,000 (one-time) |
The prices above are for the zcrLog ICT Appliance — ICT1/ICT2/ICT3, each built to the EPS spec of its matching tier. Prices include VAT. One-time hardware cost, no monthly fee (annual maintenance is billed separately from year 2).
What the ICT Spec Schedule Requires
- Log collection — Syslog from network devices, aggregated from at least 3, 10 or 15 devices for Type 1, 2 and 3
- Integrity — hash integrity with MD5 or SHA-1, or a stronger algorithm
- Backup — backup to external storage
- Retention and certification — compliance with the Computer Crime Act's retention rule and a recognized log-security certification, with มศอ. 4003.1-2560 as one accepted example
- Management — HTTPS, command line interface and SSH
Encryption at rest, RBAC and search speed are not part of that baseline; they are what vendors add on top.
🚀 Ready to bring your log retention into compliance?
See zcrLog, or check pricing plans that fit your organization — starting at just ฿4,000/month.
How to Keep Logs the Right Way
Option 1: On-Premise Appliance
Pros: full control, data stays inside your organization
Cons: you manage it yourself, higher upfront cost, requires a dedicated IT team
Option 2: Cloud/SaaS Service
Pros: fast to deploy, no maintenance burden, low starting cost
Cons: data is hosted in the cloud
Option 3: Dedicated VM (Recommended for Government Agencies)
Pros: clearly isolated resources, well suited to strict compliance requirements
zcrLog — A Log Management System Built for the Computer Crime Act
zcrLog is a compliance log retention platform built specifically for Thai organizations, with these capabilities:
- ✅ ICT Spec–compliant — Type 1, 2, and 3 appliances, plus a virtual appliance option
- ✅ Retention you can set up to 2 years — the Section 26 minimum is 90 days; anything longer is your own choice or an officer's order for a specific provider
- ✅ Hash integrity — MD5, SHA-1, SHA-256
- ✅ AES-128 encryption — for data at rest
- ✅ Threat analysis — incident correlation, MITRE ATT&CK mapping and detection rules
- ✅ Multi-source ingestion — firewalls, Active Directory, Microsoft Entra ID, Microsoft 365, AWS CloudTrail, Google Cloud audit logs, EDR
Starting Prices
| Plan | Price | Best For |
|---|
| Cloud SaaS | From ฿4,000/month | General businesses |
| Dedicated VM | From ฿8,000/month | Government agencies |
| On-Premise Appliance | One-time purchase | Organizations that need full control |
🔗 See full pricing → | See zcrLog →
Frequently Asked Questions About Log Retention Under the Computer Crime Act
How long does the Computer Crime Act require logs to be kept?
At least 90 days, and up to 2 years if a competent official orders longer retention as a special case. Many organizations choose to keep logs for one year to support retrospective investigations.
Do cafes and hotels that offer free Wi-Fi have to keep logs?
It can apply to them. Section 3 counts service users whether they pay or use the connection for free, and Annex A of the notification lists internet access in hotels, rented rooms, and restaurants and beverage shops as examples of access service providers. But annex B (item 3) lets a restaurant, or any business that offers internet only as a side service, choose one of three things: CCTV with a usage record that identifies the customer; a daily record of customers' usage documents that can be checked later; or another way of identifying the customer. The notification does not name hotels in that option, and it does not say whether the option replaces other duties, so take legal advice first.
Does a small company with only a few employees have to keep logs?
Neither the Act nor the 2021 notification sets a size threshold. Whether a company that only gives its own employees internet access counts as a "service provider" is not answered by the notification, so assess that first, with a lawyer, and then determine what log-retention duty applies.
What are the penalties for not keeping logs under the Computer Crime Act?
A fine of up to ฿500,000.
Do I have to buy an ICT Spec appliance, or can I use another system?
The law does not require a specific brand or product. The ICT Spec is a reference baseline that government agencies often use when they procure a log retention system.
Checklist: Log Retention Under the Computer Crime Act
Not every item below is a legal requirement. Section 26 and the 2021 notification set the minimum retention period and require logs to be protected from tampering; ICT Spec is a procurement baseline, and the notification does not name an algorithm such as SHA-256.
This article was last updated: March 2026
Need advice on log retention? Contact our team →
If you'd rather talk through your own environment, here's how to reach us.
Related articles
Continue with these related guides for the comparison and operating detail:
Related product
See zcrLog for the product scope and the inputs to confirm with your delivery partner
Sources