Cybersecurity regulation in Thailand (2026)

The National Cyber Security Committee published a new CII designation list replacing the 2023 classifications, broadening coverage to reflect technological interdependencies and formally pairing each of the seven CII sectors (national security, essential government services, banking/finance, ICT, transport/logistics, public utilities, and health) with a designated sector regulator.

Thailand's NCSA published proposed amendments to the Cybersecurity Act B.E. 2562, seeking to extend oversight to cloud service providers and data centers hosting CII data, introduce a three-tier cyber-incident classification system, and broaden the definitions of 'cyber threat' and 'cybersecurity'; public comments closed 5 August 2025.

Threat actor Babuk was linked to a breach of Ministry of Finance systems in March 2025, exposing government data and underscoring persistent vulnerabilities in Thai public-sector IT infrastructure despite the Cybersecurity Act framework.

Three NCSC notifications published in the Royal Gazette on 18 January 2024 entered into force, requiring all Critical Information Infrastructure Operators (CIIOs) to classify their data/information systems into low, medium, or high risk categories and implement corresponding baseline controls aligned with confidentiality, integrity, and availability objectives.

The Personal Data Protection Committee imposed the statutory maximum fine of THB 7 million on JIB Computer Group Co., Ltd. for failing to appoint a DPO, implementing inadequate security measures that allowed personal data to leak to call-center fraud gangs, and delaying breach notification — marking the first private-sector penalty under the PDPA since full enforcement began in 2022.

The National Cyber Security Committee gazetted notifications on (1) minimum baseline standards for CIIO data/information systems, (2) security category classification criteria, and (3) related requirements, giving CIIOs a one-year transition period before mandatory compliance on 18 January 2025.

Thailand's Personal Data Protection Committee publicly confirmed it was taking enforcement action for the first time since full PDPA implementation, targeting a Thai insurer for non-compliant handling of children's and parents' personal data in marketing activities, signaling the start of active enforcement.

After successive one-year postponements following enactment in May 2019, and following the establishment of the Personal Data Protection Committee in January 2022, the PDPA came into full effect on 1 June 2022, imposing mandatory cybersecurity safeguards, breach notification duties, and DPO appointment requirements on all organizations processing personal data of Thai residents.

The National Cyber Security Committee issued Notification B.E. 2564 designating seven sectors as Critical Information Infrastructure — national security, essential government services, banking and finance, ICT, transportation and logistics, public utilities, and health — and prescribing mandatory cybersecurity readiness plans, incident reporting channels, and responsible officer requirements for CII operators.

Thailand's landmark Cybersecurity Act was published in the Royal Gazette, creating the National Cyber Security Committee (chaired by the Prime Minister), the National Cyber Security Agency, and ThaiCERT, while establishing the Critical Information Infrastructure protection framework, mandatory incident reporting obligations, and broad government emergency response powers.

The Amendment Act B.E. 2560 was gazetted on 24 January 2017 (effective 24 May 2017), expanding criminal offenses to cover online fraud, child exploitation material, and content deemed threatening to state stability, while strengthening investigative powers — including data access provisions — and imposing compliance obligations on service providers to cooperate with authorities.

Thailand's foundational cybercrime law was published in the Royal Gazette and took effect on 17 July 2007, criminalizing unauthorized computer access, data and system interference, dissemination of illegal content, and related offenses; it remained the primary cybersecurity criminal instrument for a decade before its 2017 amendment.