How to Keep Logs Under Thailand's Computer Crime Act B.E. 2560 (Complete Guide) — Log Management & ICT Spec
A practical guide to Thailand's Computer Crime Act B.E. 2560: who must keep logs, what to store, the ICT Spec standard, and log systems from ฿4,000/month.
Log Retention Under Thailand's Computer Crime Act B.E. 2560
What Is Log Retention, and Why Does the Law Require It?
Log retention (Log Management) is the systematic recording and storage of computer traffic data. It is a legal obligation for service providers that fall within the applicable definitions and requirements under the Computer-Related Crime Act B.E. 2560 (2017) (พ.ร.บ. คอมฯ).
Failure to comply carries a fine of up to ฿500,000, and executives can be held personally liable if they are found to have willfully concealed the identity of an offender.
Who Has to Keep Logs Under the Computer Crime Act?
Under the law, the term "service provider" covers a much wider range of organizations than most people assume:
- Internet service providers (ISPs) — TRUE, AIS, 3BB, and other carriers
- Organizations that provide employees with internet access — companies, government agencies, universities
- Hotels, restaurants, and cafes that offer Wi-Fi
- Hosting providers — web servers, mail servers, internet data centers
- Internet cafes and online gaming shops
💡 In short: each organization should first assess whether it falls within the applicable “service provider” category and requirements.
What Data Actually Needs to Be Logged?
The computer traffic data that must be retained includes:
- User information — user ID, IP address
- Session timing — date and time the connection started and ended
- Source and destination — the origin and endpoint of the communication
- Service type — the kind of service used
Key Log Sources
| Log Source | Example Data |
|---|
| Firewall | Source/destination IP, port, protocol, action (allow/deny) |
| Active Directory | Login/logout events, failed logins, group policy changes |
| Microsoft 365 | Email activity, file access, admin actions |
| Network Devices | Switch/router traffic, DHCP logs, DNS queries |
| Cloud Services | AWS CloudTrail, Azure Activity Log, GCP Audit Log |
| Endpoint Security | Antivirus events, EDR alerts, USB activity |
How Long Do You Have to Keep Logs?
The Computer Crime Act sets these retention periods:
- Minimum 90 days — covered service providers must retain logs for at least 90 days under the applicable Act and notifications
- Up to 2 years — when a competent official specifically orders extended retention
⚠️ Note: many organizations choose to retain logs for 365 days as a safety margin and to support retrospective investigations.
What Is the ICT Spec Standard?
ICT Spec is the informal name for two related documents. มศอ. 4003.1-2560 is a standard from NECTEC, Thailand's National Electronics and Computer Technology Center, with general requirements for computer traffic-data retention systems. The document that sorts log storage devices into three types, rated by EPS (events per second), is the MDES price and spec schedule; What Is ICT Spec? explains the difference:
| Type | EPS | Best Suited For | zcrLog ICT Appliance Price |
|---|
| Type 1 | 1,000 EPS | SMEs, small offices | ฿50,000 (one-time) |
| Type 2 | 7,000 EPS | Mid-sized organizations | ฿400,000 (one-time) |
| Type 3 | 20,000 EPS | Large enterprises, government agencies | ฿850,000 (one-time) |
The prices above are for the zcrLog ICT Appliance — ICT1/ICT2/ICT3, each built to the EPS spec of its matching tier. Prices include VAT. One-time hardware cost, no monthly fee (annual maintenance is billed separately from year 2).
What the ICT Spec Schedule Requires
- Log collection — Syslog from network devices, aggregated from at least 3, 10 or 15 devices for Type 1, 2 and 3
- Integrity — hash integrity with MD5 or SHA-1, or a stronger algorithm
- Backup — backup to external storage
- Retention and certification — compliance with the Computer Crime Act's retention rule and a recognized log-security certification, with มศอ. 4003.1-2560 as one accepted example
- Management — HTTPS, command line interface and SSH
Encryption at rest, RBAC and search speed are not part of that baseline; they are what vendors add on top.
🚀 Ready to bring your log retention into compliance?
See zcrLog, or check pricing plans that fit your organization — starting at just ฿4,000/month.
How to Keep Logs the Right Way
Option 1: On-Premise Appliance
Pros: full control, data stays inside your organization
Cons: you manage it yourself, higher upfront cost, requires a dedicated IT team
Option 2: Cloud/SaaS Service
Pros: fast to deploy, no maintenance burden, low starting cost
Cons: data is hosted in the cloud
Option 3: Dedicated VM (Recommended for Government Agencies)
Pros: clearly isolated resources, well suited to strict compliance requirements
zcrLog — A Log Management System Built for the Computer Crime Act
zcrLog is a compliance log retention platform built specifically for Thai organizations, with these capabilities:
- ✅ ICT Spec–compliant — Type 1, 2, and 3 appliances, plus a virtual appliance option
- ✅ 90-day to 2-year retention — matches the Computer Crime Act's requirements
- ✅ Hash integrity — MD5, SHA-1, SHA-256
- ✅ AES-128 encryption — for data at rest
- ✅ Threat analysis — incident correlation, MITRE ATT&CK mapping and detection rules
- ✅ Multi-source ingestion — firewalls, Active Directory, Microsoft Entra ID, Microsoft 365, AWS CloudTrail, Google Cloud audit logs, EDR
Starting Prices
| Plan | Price | Best For |
|---|
| Cloud SaaS | From ฿4,000/month | General businesses |
| Dedicated VM | From ฿8,000/month | Government agencies |
| On-Premise Appliance | One-time purchase | Organizations that need full control |
🔗 See full pricing → | See zcrLog →
Frequently Asked Questions About Log Retention Under the Computer Crime Act
How long does the Computer Crime Act require logs to be kept?
At least 90 days, and up to 2 years if a competent official orders longer retention as a special case. Many organizations choose to keep logs for one year to support retrospective investigations.
Do cafes and hotels that offer free Wi-Fi have to keep logs?
Yes. They count as a "service provider" under the law's definition, whether or not they charge for internet access.
Does a small company with only a few employees have to keep logs?
The law does not exempt organizations by size. If a company lets employees use its internet connection, first assess whether it falls within the definition of "service provider" and the related notifications, and then determine what log-retention duty applies.
What are the penalties for not keeping logs under the Computer Crime Act?
A fine of up to ฿500,000.
Do I have to buy an ICT Spec appliance, or can I use another system?
The law does not require a specific brand or product. The ICT Spec is a reference baseline that government agencies often use when they procure a log retention system.
Checklist: Log Retention Under the Computer Crime Act
This article was last updated: March 2026
Need advice on log retention? Contact our team →
If you'd rather talk through your own environment, here's how to reach us.
Related articles
Continue with these related guides for the comparison and operating detail:
Related product
See zcrLog for the product scope and the inputs to confirm with your delivery partner
Sources