Thailand’s Computer Crime Act B.E. 2550, enacted in 2007 and substantially amended in 2017, criminalizes a wide range of online conduct and carries penalties running from small fines up to twenty years in prison for offenses that cause a death. It covers traditional hacking, but its most-used provisions target online content: “false” or “distorted” information, material deemed to threaten national security, pornography, and anything that promotes offenses against the monarchy. It applies to anyone using the internet in Thailand, and in defined circumstances it reaches offenders abroad.
What the Act Prohibits
Section 14 is the provision most ordinary users run into. It covers five categories of online content, each punishable by up to five years in prison, a fine of up to 100,000 Baht, or both:1United Nations Office on Drugs and Crime. Sections 14-15
- Uploading false or distorted data that could cause public harm, where the conduct does not amount to criminal defamation under the Penal Code.
- Posting false data likely to undermine national security, public safety, economic stability, or critical infrastructure, or to cause public panic.
- Posting content that constitutes or promotes offenses against the security of the Kingdom, including offenses against the monarchy, or acts of terrorism.
- Entering pornographic material into a computer system in a way that makes it accessible to the general public.
- Knowingly forwarding or disseminating any of the above.
When a Section 14(1) offense targets a specific person rather than the public at large, the maximum penalty drops to three years in prison or a fine of up to 60,000 Baht, and the offense becomes compoundable, meaning the parties can settle and drop charges.1United Nations Office on Drugs and Crime. Sections 14-15
The categories are broad. Terms like “false,” “distorted,” and “likely to cause public anxiety” are vague enough to reach political commentary, satire, and criticism, and in practice Section 14 is applied well beyond what most people would call cybercrime.
Hacking and Technical Offenses
Sections 5 through 13 cover what most people recognize as cybercrime. Accessing a computer system that has security measures in place without authorization carries up to six months in prison or a fine of up to 10,000 Baht.2International Commission of Jurists. Act on Computer Crime B.E. 2550 (2007) Obtaining someone else’s security credentials or intercepting data in transit escalates the offense. Introducing malware or code that damages another person’s data falls under more serious provisions.
Disrupting a computer system so that it fails to operate normally, including through denial-of-service attacks, is punishable by up to five years in prison or a fine of up to 100,000 Baht. Sending email or data that conceals its source and disrupts someone’s normal computer use is punishable by a fine of up to 100,000 Baht; that spam offense carries no prison term on its own.3King Mongkut’s University of Technology North Bangkok. Computer Crime Act B.E. 2550
Heavier Penalties for Attacks on National Security Systems
Section 12 is the penalty multiplier that turns a minor hacking charge into a major felony. When any technical offense under Sections 5 through 8 or Section 13 targets a system connected to national security, public safety, economic security, or critical public infrastructure, the penalties jump sharply:4United Nations Office on Drugs and Crime. Section 12
- Unauthorized access to such a system: one to seven years in prison and a fine of 20,000 to 140,000 Baht.
- If the access causes damage to the system’s data: one to ten years and a fine of 20,000 to 200,000 Baht.
- Disruption or interference under Sections 9 or 10: three to fifteen years and a fine of 60,000 to 300,000 Baht.
- If the offense results in death without intent to kill: five to twenty years and a fine of 100,000 to 400,000 Baht.
Note the shift from “or” to “and.” For basic offenses, courts choose between prison and a fine. For national security offenses, offenders face both. The law does not precisely define which systems qualify, which gives prosecutors meaningful discretion.
How the Act Reaches Speech About the Monarchy
The Computer Crime Act’s practical impact is most significant, and most criticized internationally, in cases involving the monarchy. Section 14(3) prohibits online content that constitutes an offense against the security of the Kingdom. Prosecutors routinely pair it with Section 112 of the Penal Code, Thailand’s lèse-majesté law, which criminalizes defaming, insulting, or threatening the monarchy and carries three to fifteen years per offense.
When both statutes are charged together, the penalties compound: a defendant convicted under Section 14 and Section 112 is punished under each law separately. The Act has also served as the primary legal tool for blocking online content about the monarchy. By 2020, Thai courts had issued orders to block more than 13,500 URLs on lèse-majesté grounds, across platforms including Facebook, YouTube, and Twitter.
Individuals have been charged after authorities examined their phones during unrelated arrests and found content deemed critical of the monarchy. International human rights organizations have repeatedly called for reform of Section 14(3), arguing that it overlaps with Penal Code provisions and enables disproportionate punishment for online speech.
When the Act Reaches Conduct Outside Thailand
Section 17 extends the Act beyond Thailand’s borders. A Thai citizen who commits a computer crime abroad can be prosecuted at home if the foreign government or the injured party files a complaint. A non-Thai who commits an offense abroad that injures the Thai government or a Thai person is subject to the same rule.5United Nations Office on Drugs and Crime. Section 17
A foreign writer publishing about the Thai monarchy from outside Thailand could, in principle, face prosecution if they later entered the country. Enforcement depends on the individual case, but the jurisdictional claim itself is deliberately broad.
Platform and Service Provider Obligations
Section 15 makes platform operators and service providers criminally liable if they intentionally support or consent to the posting of prohibited content on systems they control. A provider found to have done so faces the same penalties as the person who posted the material.1United Nations Office on Drugs and Crime. Sections 14-15 A hosting company or social media platform that ignores a takedown request can be treated as a co-offender.
A ministerial regulation issued in December 2022 set specific removal timelines. Content classified under Section 14(2) or 14(3) as threatening national security or relating to terrorism must come down within 24 hours. False or distorted data under Section 14(1) must be removed within seven days. Missing those deadlines creates a presumption of cooperation with the offense, exposing the provider to up to five years in prison and fines of up to 100,000 Baht, and the National Broadcasting and Telecommunications Commission can revoke the provider’s operating license.
Separately, every service provider must retain two categories of records. Traffic data, including connection logs, timestamps, services used, and routing information, must be kept for at least 90 days from the date of access, extendable by a competent official up to one year for a specific investigation.2International Commission of Jurists. Act on Computer Crime B.E. 2550 (2007) User identification data, sufficient to identify the person using the service, must be kept from the start of service and for at least 90 days after the service ends. Failing to comply with either requirement is punishable by a fine of up to 500,000 Baht.
“Service provider” is read broadly. A small business, café offering Wi-Fi, or co-working space that provides internet access to others falls within the definition and carries these obligations.
Content Blocking and How to Challenge It
Section 20 requires a court order to block content. A competent official, with the Minister’s approval, must petition a court with supporting evidence that the content is contrary to public order and morals or constitutes a criminal offense under the Act. If the court agrees, it orders the content blocked or suppressed by whatever technical means it considers appropriate.2International Commission of Jurists. Act on Computer Crime B.E. 2550 (2007) The 2017 amendment reinforced that judicial-review requirement.
Service providers, platform operators, and affected users can appeal a takedown to the Permanent Secretary of the Ministry of Digital Economy and Society within 30 days. Appeals do not pause the takedown; the content stays down while the appeal is pending. Decisions can also be challenged in the Administrative Court, though those proceedings can take years.
Practical Notes for Travelers, Expats, and VPN Users
Using a VPN is not itself illegal in Thailand. Businesses use them for secure communications, and personal use for privacy is common. The legal risk arises when a VPN is used to circumvent government content blocks or to commit offenses under the Act. A VPN does not create immunity: platform cooperation, metadata, account information, and physical device searches can all expose a user’s identity regardless of how a connection is routed.
The Act applies to anyone using a computer system in Thailand, regardless of nationality or residency status. Posting on social media, sharing news articles, and forwarding messages all fall within its scope if the content meets Section 14’s criteria. Any material posted, shared, or stored on a device brought into Thailand is potentially subject to scrutiny. Prosecutions under Section 14 are routine, and foreign nationals are not exempt.