ThailandAct on Computer Crime, unauthorized access and interception
Act on Computer Crime B.E. 2550 (2007), Sections 5 to 8
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Audit expectation
- none
What it requires
- Do not access a Thai computer system or computer data protected by a security measure not intended for your use.
- Do not disclose another person's security measures, or intercept another person's computer data by electronic or any other means, in a manner likely to cause injury or that is not for public benefit.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 5 (unauthorized access to a protected computer system) carries imprisonment not exceeding six months or a fine not exceeding Baht 10,000, or both. Section 6 (illegal disclosure of another's security measures) carries imprisonment not exceeding one year or a fine not exceeding Baht 20,000, or both. Section 7 (unauthorized access to protected computer data) carries imprisonment not exceeding two years or a fine not exceeding Baht 40,000, or both. Section 8 (illegal interception of computer data) carries imprisonment not exceeding three years or a fine not exceeding Baht 60,000, or both, the highest of the four tiers.
Penalty structure
Four separate fine tiers rather than one uniform cap: Section 5 (unauthorized access to a computer system) caps at Baht 10,000; Section 6 (illegal disclosure of security measures) at Baht 20,000; Section 7 (unauthorized access to computer data) at Baht 40,000; Section 8 (illegal interception of computer data) at Baht 60,000, the highest tier. Each section also carries a term of imprisonment as an alternative or additional penalty.
- Rule
- Fixed only
- As of
- Currency
- THB
- Fixed cap
- 60,000
What it makes you log
Logging duty
Sections 5 to 8 punish unlawful access to a protected computer system, disclosure of another person's access measures, access to protected computer data and interception of computer data (English as in the pinpoint above). They impose no duty to create, keep, produce or review a log or record. Section 26, outside the cited sections, requires a service provider to keep computer traffic data for not less than 90 days from the date the data enters the system (an official may order it kept for up to two years in a special case) and to keep subscriber identification data for not less than 90 days after the service ends; the controller adds it to the traffic-data retention table. Section 17 is the Act's own clause for an offence committed outside the Kingdom: it applies where the offender is a Thai person and the foreign government or the injured party asks for punishment, or the offender is an alien and the Thai Government or a Thai person is the injured party and asks for punishment.
- Kind
- None
- As of
What this law does
Section 5 punishes illegally accessing a computer system that has specific security measures not intended for the accessor's use. Section 7 punishes the same act against computer data.
Section 6 punishes knowing another person's security measures and illegally disclosing them in a manner likely to cause injury, and Section 8 punishes illegally intercepting, by electronic or any other means, computer data of another person transmitting in a computer system where that data is not for public benefit or available to others.
The Act's own Section 2 sets commencement at thirty days after publication in the Government Gazette; the Act was published in the Government Gazette on , thirty days before its commencement.
The amending Act (No. 2) B.E. 2560 (2017), published in the Government Gazette on and commencing 120 days later, left the wording and penalties of Sections 5 to 8 unchanged; its changes reach other matters, including updating the administering ministry's name to the Ministry of Digital Economy and Society.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .