Cybersecurity law & regulation in Thailand (2026)

Legal framework

Cybersecurity Act B.E. 2562 (2019), administered by the National Cyber Security Committee (NCSC) and National Cyber Security Agency (NCSA); complemented by the Personal Data Protection Act B.E. 2562 (2019) for data-breach duties and sector regulators (e.g. Bank of Thailand) for financial services.

Key points: cybersecurity in Thailand

1. 01Comprehensive law in force

   The Cybersecurity Act B.E. 2562 (2019) was published in the Royal Thai Gazette and took full effect on 24 May 2019, establishing a national framework to protect national security, public order, the economy and critical infrastructure from cyber threats.

   globalcompliancenews.com dig.watch

2. 02Governance: NCSC and NCSA

   The Act creates the National Cyber Security Committee (NCSC), chaired by the Prime Minister, a Cyber Security Supervisory Committee (CSSC), and the National Cyber Security Agency (NCSA) as the operational authority overseeing standards, monitoring and enforcement.

   siam-legal.com dig.watch

3. 03Critical Information Infrastructure obligations

   CII organizations across designated sectors (national security, public services, banking/finance, IT and telecoms, transport and logistics, energy and utilities, public health, and others) must adopt NCSC-approved security measures, run periodic risk assessments/audits, and cooperate with investigations.

   tilleke.com silklegal.com

4. 04CII incident reporting (24 hours)

   A September 2025 NCSC notification (Royal Gazette, 16 Sept 2025) revised the CII sector list and requires CII operators to report significant cybersecurity incidents to both the NCSA and their sector regulator within 24 hours, with fines up to THB 200,000 for unjustified non-reporting.

   silklegal.com tilleke.com

5. 05Personal-data breach notification (PDPA)

   Under the Personal Data Protection Act B.E. 2562 (2019), a data controller must notify the PDPC within 72 hours of becoming aware of a personal-data breach (unless unlikely to risk individuals' rights); in August 2025 the PDPC imposed THB 21.5 million in fines, partly for failures to report breaches.

   iapp.org hoganlovells.com

6. 06Sectoral financial-services rules

   The Bank of Thailand layers cyber/IT-risk requirements on financial institutions, including IT risk-governance criteria (SorNorSor 21/2562), security measures for mobile financial services (Notification No. 4/2568, effective 7 March 2025), and 2025 AI risk-management guidelines.

   bot.or.th tilleke.com

Timeline of decisions

1. 27 Jul 2026Incident
   Thailand's SEC alleges Bitkub concealed cyberattack that led to $50 million hack

   CoinDesk Policy

2. 16 Sept 2025Decision
   NCSC Issues Revised and Expanded CII Organization List in Royal Gazette

   The National Cyber Security Committee published a new CII designation list replacing the 2023 classifications, broadening coverage to reflect technological interdependencies and formally pairing each of the seven CII sectors (national security, essential government services, banking/finance, ICT, transport/logistics, public utilities, and health) with a designated sector regulator.

   Silk Legal

3. 21 Jul 2025Guidance
   NCSA Releases Draft Cybersecurity Act Amendment for Public Consultation

   Thailand's NCSA published proposed amendments to the Cybersecurity Act B.E. 2562, seeking to extend oversight to cloud service providers and data centers hosting CII data, introduce a three-tier cyber-incident classification system, and broaden the definitions of 'cyber threat' and 'cybersecurity'; public comments closed 5 August 2025.

   Tilleke & Gibbins

4. 13 Apr 2025Law
   Emergency Decree on Technological Crimes Amended (No. 2) B.E. 2568

   Published in the Government Gazette on 12 April 2025 and effective the next day, the amendment to the 2023 Emergency Decree narrows the categories of business operators subject to its obligations, reduces some compliance burdens, and formalises coordination mechanisms among banks, telecom providers, and law enforcement to combat online scams.

   Tilleke & Gibbins

5. 18 Jan 2025Law
   NCSC Baseline Cybersecurity Standards Become Mandatory for CII Operators

   Three NCSC notifications published in the Royal Gazette on 18 January 2024 entered into force, requiring all Critical Information Infrastructure Operators (CIIOs) to classify their data/information systems into low, medium, or high risk categories and implement corresponding baseline controls aligned with confidentiality, integrity, and availability objectives.

   Herbert Smith Freehills Kramer

6. 18 Jan 2024Guidance
   NCSC Publishes Three Cybersecurity Standards Notifications in Royal Gazette

   The National Cyber Security Committee gazetted notifications on (1) minimum baseline standards for CIIO data/information systems, (2) security category classification criteria, and (3) related requirements, giving CIIOs a one-year transition period before mandatory compliance on 18 January 2025.

   Tilleke & Gibbins

7. 24 Aug 2021Decision · official
   NCSC Formally Designates Seven CII Sectors and Issues CIIO Compliance Criteria

   The National Cyber Security Committee issued Notification B.E. 2564 designating seven sectors as Critical Information Infrastructure, national security, essential government services, banking and finance, ICT, transportation and logistics, public utilities, and health, and prescribing mandatory cybersecurity readiness plans, incident reporting channels, and responsible officer requirements for CII operators.

   ThaiCERT / NCSA (official)

8. 27 May 2019Law · official
   Cybersecurity Act B.E. 2562 Promulgated, Establishes NCSC, NCSA, ThaiCERT, and CII Regime

   Thailand's landmark Cybersecurity Act was published in the Royal Gazette, creating the National Cyber Security Committee (chaired by the Prime Minister), the National Cyber Security Agency, and ThaiCERT, while establishing the Critical Information Infrastructure protection framework, mandatory incident reporting obligations, and broad government emergency response powers.

   Ministry of Digital Economy and Society (MDES)

9. 24 Jan 2017Law
   Computer Crimes Act No. 2 Amendment Published, Broadening Offenses and Enforcement Powers

   The Amendment Act B.E. 2560 was gazetted on 24 January 2017 (effective 24 May 2017), expanding criminal offenses to cover online fraud, child exploitation material, and content deemed threatening to state stability, while strengthening investigative powers, including data access provisions, and imposing compliance obligations on service providers to cooperate with authorities.

   LawPlus Ltd.

10. 18 Jun 2007Law
    Computer Crime Act B.E. 2550 Enacted, Thailand's First Cybercrime Statute

    Thailand's foundational cybercrime law was published in the Royal Gazette and took effect on 17 July 2007, criminalizing unauthorized computer access, data and system interference, dissemination of illegal content, and related offenses; it remained the primary cybersecurity criminal instrument for a decade before its 2017 amendment.

    Wikipedia — Computer Crime Act (Thailand)

Sources

1. 1.globalcompliancenews.com/2019/04/12/thailand-cybersecurity-act-has-been-passed-20190325/
2. 2.dig.watch/resource/thailands-cyber-security-maintenance-act-of-2019
3. 3.siam-legal.com/cybercrime-law/data-privacy/thailand-national-cyber-security-agency-n
4. 4.tilleke.com/insights/thailand-details-cii-organizations-cybersecurity-duties/
5. 5.silklegal.com/strengthening-thailands-cyber-resilience-new-list-of-critical-informa
6. 6.iapp.org/news/a/thailand-s-pdpc-clarifies-data-breach-notification-requirement
7. 7.hoganlovells.com/en/publications/thailand-ramps-up-data-protection-enforcement
8. 8.bot.or.th/content/dam/bot/fipcs/documents/FPG/2565/EngPDF/25650188.pdf
9. 9.tilleke.com/insights/thailand-issues-ai-risk-management-guidelines-for-financial-