What Is Thailand's Computer Crime Act? A Plain-English Guide for Businesses (With the Penalty Table)
What is Thailand's Computer Crime Act and how does it differ from PDPA? Sections 5-16, the full penalty table, the §26 log retention duty and a real case.
What Is Thailand's Computer Crime Act? A Plain-English Guide for Businesses (With the Penalty Table)
A common assumption in compliance conversations is some version of this: "The Computer Crime Act and PDPA are basically the same law, right?" Or: "We're already PDPA-compliant, so we're covered on the Computer Crime Act too, right?" Neither is true. They're two separate statutes, they regulate completely different things, and each carries its own distinct set of penalties.
The mix-up isn't really surprising. Both laws have "computer" or digital data in their name, both rolled out around the time Thailand started talking about "cyber law" as its own category, and to anyone who doesn't work in legal full-time, the enforcing agencies sound close enough to blur together. But the Computer Crime Act (พ.ร.บ.คอมพิวเตอร์), officially the Act on Computer-Related Offenses B.E. 2550 (2007), is a criminal statute about offenses committed through computers. PDPA is a personal data protection law. Different purpose, different set of obligations for your organization.
The next question is usually: "So what does my business actually have to do under this law?" Short answer: almost nothing proactive — except one requirement, which we'll walk through in detail below, and which happens to be the part most businesses overlook.
What Is the Computer Crime Act, and Where Did It Come From
Its full name is the Act on Computer-Related Offenses B.E. 2550 (พระราชบัญญัติว่าด้วยการกระทำความผิดเกี่ยวกับคอมพิวเตอร์ พ.ศ. 2550). King Bhumibol Adulyadej gave royal assent on 10 June 2007, it was published in the Royal Gazette on 18 June 2007, and it actually took effect on 18 July 2007 — 30 days after publication, as Section 2 of the act itself specifies.
A decade later, the law got exactly one major revision: the Act on Computer-Related Offenses (No. 2) B.E. 2560 (2017), published in the Royal Gazette on 24 January 2017 and effective 120 days after that, on 24 May 2017. That amendment added the nuisance-message offense, sharpened the penalties for offenses against critical infrastructure, and tightened the wording of Section 14 to make clear it's about computer-facilitated fraud, not general defamation — more on that in the table below.
In plain terms: this law is nearly twenty years old, has been amended exactly once, and is still the primary statute used to prosecute people for hacking systems, releasing malware, running DDoS attacks, or posting false information through a computer.
What the Law Actually Covers
The act splits into two main chapters. Chapter 1 (Sections 5 through 17/2) defines the offenses and penalties — what counts as a violation and how much it costs. Chapter 2 (Sections 18 through 30) gives investigating officers their powers, like seizing devices or data, and sets out a duty for "service providers" to retain traffic data — which gets its own section below, since it's the part businesses most need to know.
The offenses in Chapter 1 fall into four broad groups: unauthorized access to systems or data (Sections 5–8), damaging or disrupting systems — malware and DDoS (Sections 9–10), sending data or spam that conceals its source or causes a nuisance (Section 11), and importing false information or doctored images that damage someone (Sections 14 and 16). On top of that, Section 12 raises the penalty whenever any of the above is committed against systems tied to national security or public infrastructure, and Section 13 goes after anyone who sells or distributes hacking tools built specifically to commit those offenses.
The table below runs through the main sections businesses and individuals should know, in order:
| Section | Offense (summary) | Penalty |
|---|
| Section 5 | Unauthorized access to a computer system protected by access-control measures | Up to 6 months imprisonment or a fine up to 10,000 baht, or both |
| Section 6 | Learning another's access-control measure and unlawfully disclosing it in a way likely to cause damage | Up to 1 year imprisonment or a fine up to 20,000 baht, or both |
| Section 7 | Unauthorized access to computer data protected by access-control measures | Up to 2 years imprisonment or a fine up to 40,000 baht, or both |
| Section 8 | Unlawfully intercepting another's computer data while in transit | Up to 3 years imprisonment or a fine up to 60,000 baht, or both |
| Section 9 | Unlawfully damaging, destroying, altering, or changing another's data | Up to 5 years imprisonment or a fine up to 100,000 baht, or both |
| Section 10 | Unlawfully suspending, delaying, or disrupting the normal operation of another's computer system | Up to 5 years imprisonment or a fine up to 100,000 baht, or both |
| Section 11, para. 1 | Sending data/email with a concealed or falsified source that disturbs normal use | Fine up to 100,000 baht |
| Section 11, para. 2 | Sending data/email that causes a nuisance without an easy opt-out | Fine up to 200,000 baht |
| Section 12 | Section 5–11 offenses committed against systems/data tied to national security, public safety, the economy, or infrastructure | 1–7 years imprisonment and a fine of 20,000–140,000 baht as a baseline; 1–10 years and a fine of 20,000–200,000 baht if it causes damage; 3–15 years and a fine of 60,000–300,000 baht if committed against a critical system under Sections 9 or 10; and 5–20 years imprisonment with a fine of 100,000–400,000 baht if it results in death |
| Section 13 | Selling or distributing tools built specifically to commit Section 5–11 offenses | Up to 1 year imprisonment or a fine up to 20,000 baht (rising to up to 2 years / 40,000 baht if the tool is used for a Section 12 offense) |
| Section 14(1) | Dishonestly or fraudulently importing false or distorted data in a way likely to cause damage | Up to 5 years imprisonment or a fine up to 100,000 baht (reduced to up to 3 years / 60,000 baht and compoundable if directed at a specific individual) |
| Section 16 | Importing doctored or manipulated images of another person that damage their reputation or cause humiliation | Up to 3 years imprisonment and a fine up to 200,000 baht (compoundable) |
Section 14(1) tends to get called "online defamation" in everyday conversation, but the statute itself specifies the act has to be done "dishonestly or through deception" — an element that's genuinely different from ordinary defamation under the Criminal Code. In other words, the law deliberately sets itself apart from standard defamation cases by focusing on importing false data to deceive, rather than simply damaging someone's reputation. In practice, though, this section still gets charged alongside defamation fairly often in cases involving social-media posts.
A Real Case: When One Post Becomes a Court Case
A documented case from Thai Lawyers for Human Rights: a vendor in Nan province posted a warning in a community Facebook group on 25 January 2020, saying three travelers had tested positive for "H3N2 virus from Wuhan, China" at Chiang Mai airport — right as COVID-19 was starting to make headlines. She testified that she'd copied the text from someone she believed was a credible official, without independently checking the facts first.
She was prosecuted under Section 14(2) of the act. The Criminal Court, Ratchadaphisek division, handed down its verdict on 19 April 2022: 12 months' imprisonment, reduced to 8 months for cooperating during the trial, with bail granted pending appeal at 50,000 baht.
Worth being precise here: this was a first-instance verdict under appeal at the time it was reported, not a final ruling — we don't have confirmation of how the appeal turned out, so we're only reporting what's actually been verified. What the case does make clear is that this law isn't just text on paper. Sharing unverified information, even without malicious intent, can genuinely lead to prosecution.
Section 26: The One Thing This Law Actually Tells Businesses to Do
If you've made it through the table above, you'll notice almost everything in this law is about defining "what you can't do" and "what it costs you if you do it anyway" — it's a criminal statute aimed at wrongdoers, not an operational framework telling organizations what to prepare in advance.
There's exactly one exception: Section 26, in Chapter 2, which requires every "service provider" to retain computer traffic data for no less than 90 days from the date it enters the system. In a necessary or special case, an officer may order a specific provider to retain it longer than 90 days — but never more than 2 years in total — and that's a case-by-case order issued by an officer, not something an organization can decide to extend on its own. Providers also have to retain enough subscriber-identification data to identify each user for at least 90 days after the service ends. A provider that doesn't comply faces a fine of up to 500,000 baht (no imprisonment).
So who actually counts as a "service provider"? The law defines two categories. The first is anyone providing others with internet access or a way to communicate through a computer system — whether under their own name or on someone else's behalf — which covers ISPs, internet cafés, and even a coffee shop handing out free wifi to customers. The second is anyone storing computer data for someone else's benefit, like web hosting providers, cloud storage, or email systems. The finer detail of what each category of provider has to do specifically is left to a ministerial regulation, and one does already exist (a 2021 regulation from the Ministry of Digital Economy and Society) — but the technical specifics of that regulation are really a separate topic worth reading on their own.
If your organization falls under this definition, the question you need to be able to answer is: if an officer asks for logs covering the period the law requires, can you pull them within minutes — not days? This is exactly where log storage split across individual servers, with no centralized system, tends to fall apart, because the data is too scattered to find when you actually need it. It's exactly the gap zcrLog's log retention is built to close — centralized storage, retention that runs from the 90-day baseline up to two years, and fast retrieval when you actually need to pull something up.
What's Changed Between 2023 and 2025
A couple of related laws on tech crime have come out in the past few years, but to be upfront: neither one actually amends the Computer Crime Act itself. They're separate statutes running alongside it.
The first is the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes B.E. 2566 (2023), issued 9 March 2023 and effective 17 March 2023. It created the "mule account" offense — opening or lending out a bank account or phone number knowing, or having reason to know, it'll be used for tech-enabled crime — punishable by up to 3 years imprisonment and/or a fine up to 300,000 baht, and it gives banks and telecom providers the authority to freeze suspicious accounts or SIM cards.
The second is (No. 2) B.E. 2568 (2025), which amends that 2023 decree — not the Computer Crime Act — effective from mid-April 2025. It expands joint liability to banks, telecom providers, and social media/online platforms, who now share responsibility for a victim's losses unless they can prove they followed the required preventive measures.
To be clear: based on everything we could verify, there's been no amendment to the Computer Crime Act's actual text between 2023 and 2026. What's changed is the surrounding tech-crime legislation — focused on mule accounts and shared liability for banks and platforms — not the offenses or penalties in the table above.
Computer Crime Act vs. PDPA: What's the Real Difference
A lot of people assume the split between these two laws is "criminal vs. civil," but that's not quite accurate — PDPA carries criminal penalties of its own. Section 79 of PDPA sets imprisonment of up to 6 months (up to 1 year for unlawfully using sensitive data) and a fine of 500,000 to 1,000,000 baht for a data controller who discloses personal data in a way likely to cause damage, defamation, or humiliation. Section 80 sets a similar penalty for an official who discloses data they learned through their duties. So the real distinction isn't "criminal vs. civil" — it's about scope and the type of obligation each law imposes.
The Computer Crime Act governs offenses committed through or against computer systems. It protects the integrity of systems and data, gives officers investigative powers, and has exactly one duty that requires businesses to act proactively: Section 26's log retention, covered above. PDPA, on the other hand, is a personal data protection law — it gives data subjects rights over their own data and imposes ongoing operational obligations on any organization that collects, uses, or discloses personal data: consent and lawful basis, data-subject rights, breach-notification obligations, and so on.
Here's the difference in a concrete example. An employee hacks into a competitor's server to steal customer data — that's purely a Computer Crime Act offense. It doesn't matter if that employee's company has done everything right under PDPA, because this is an individual's wrongdoing. Flip it around: a company that keeps its Section 26 logs perfectly under the Computer Crime Act can still violate PDPA if it collects customer data without a lawful basis, or fails to report a data breach in time. The two laws run in parallel — neither one covers the other — which is why most businesses need to handle both at once. If you haven't checked whether your organization has PDPA fully covered, What Is PDPA? The 8 Things Your Organization Needs to Do walks through every requirement, including which parts a security tool can genuinely help with and which it can't.
Curious which of zcr's packages fits your organization's size? Check out our plans and pricing.
Where Security Tools Can Help (and Where They Can't)
Worth being direct about this from the start: the Computer Crime Act isn't an operational framework like PDPA, with 8 items you can work through one by one. Most of this law is about the criminal liability of the person who commits the offense — there's no checklist you can buy a product to satisfy and call the whole law "covered." Anyone claiming their tool makes you "compliant" with the entire Computer Crime Act is overselling it.
The one genuinely proactive duty a business has — if it qualifies as a "service provider" under Section 3's definition — is Section 26's traffic-data retention requirement, covered above. And this is exactly where a security tool can help in a real, verifiable way, not just as a marketing line.
zcrLog helps with three things tied directly to Section 26. First, centralized retention of computer traffic data for the full period the law requires, without having to manage it server by server. Second, fast retrieval of historical data, whether you're within the 90-day minimum or the extended window up to 2 years under an officer's order. Third, keeping logs tamper-evident so they can't be altered after the fact — which matters a great deal if that data ever needs to serve as evidence. Want the deeper technical detail on retaining logs correctly under this law? Read the full guide to log retention under the Computer Crime Act.
Everything else in the law — unauthorized access, malware, DDoS, importing false data, doctored images — comes down to the criminal liability of whoever commits the act. No security product "prevents" an employee or an outsider from breaking these laws with 100% certainty. What tools like zcrSIEM or zcrWAF actually do is reduce the odds an attack succeeds and help you detect it faster when it happens — real security-operations value, just not the same thing as "complying with this law" in the checklist sense.
We're being this direct because we think any organization researching this law should know upfront where a tool's help actually ends, instead of expecting one product purchase to close out every legal risk.
The Computer Crime Act isn't as complicated as it looks once you separate the offenses you need to make sure you — or your employees — never commit, from the one duty you actually need to prepare for in advance: Section 26. Most businesses that misread this law end up focused on the wrong thing, worrying about penalties for offenses they were never going to commit anyway, while overlooking the log-retention duty that's a real, binding obligation if they qualify as a service provider under the law's definition.
Sources
- Computer-Related Crime Act B.E. 2550 (2007) — official English translation, Ministry of Digital Economy and Society, accessed 2026-09-15. Confirms the royal assent date, Government Gazette publication date, effective date, Section 26's retention requirements (including the 2-year extension cap introduced by the 2017 amendment), and the service-provider definition.
- Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes B.E. 2566 (2023), Ministry of Digital Economy and Society, accessed 2026-09-15. Confirms the mule-account offense, its penalties, and the decree's issue/effective dates.
- 8 เดือน คดี พ.ร.บ.คอมฯ ม.14(2) แม่ค้า จ.น่าน, Thai Lawyers for Human Rights, accessed 2026-09-15. Source for the Nan province court case described above — defendant, charge, court, verdict, and bail amount.
- Personal Data Protection Act: Criminal Liability — Sections 79-81, Thailand Law Library, accessed 2026-09-15. Source for the PDPA Section 79/80 penalty figures cited for comparison.
Get in Touch
Not sure whether your organization falls under Section 26, or want to talk through what your log retention needs to cover? Our team offers a free consultation.