Protection of Privacy and Confidentiality

The legal grounds for the protection of privacy are recognised under Section 32 of the Constitutional Law and Sections 420 of the Civil and Commercial Code under the principles of tort law. In addition, Thailand has enacted a specific legislative framework, namely the Personal Data Protection Act, which will be addressed in further detail in 4. Data Protection.

With respect to confidentiality, there is no specific legal framework enacted exclusively for this purpose. Rather, the protection of confidentiality finds its basis, in part, in offences prescribed under Sections 322 to 325 of the Criminal Code and under the principles of tort law pursuant to Section 420 of the Civil and Commercial Code. In specific areas, statutory protection is further provided under specialised legislation, such as the Trade Secrets Act, as well as sector-specific regulatory frameworks applicable to professions that may lawfully obtain confidential information – eg, accountants, lawyers and medical practitioners.

Furthermore, confidentiality is commonly protected through contractual arrangements, for example non-disclosure agreements, which allow the contracting parties to agree upon and define the scope of information to be treated as confidential. A breach of such obligations may give rise to contractual liability under Thai law.

Establishing a Case for Violation of Privacy and Confidentiality

The establishment of a case for violation of privacy or confidentiality depends on the specific legal grounds relied upon by the claimant, which may differ according to the applicable law. However, a common requirement across all legal bases is that the claimant must demonstrate that the information or interest in question falls within the scope of “privacy” or “confidentiality” as defined under the law, or, in some cases, the agreements relied upon.

Subsequently, it must be established that the act in question constitutes a tortious act or a criminal offence, or otherwise amounts to a violation as prescribed by the relevant law, thereby giving rise to legal liability.

Remedies Available

The remedies available include claims for damages under tort law and on a contractual basis. In addition, civil injunctive relief may be sought, including court orders temporarily restraining the defendant from repeating or continuing the alleged infringing, wrongful, or contractual breach complained of. Such relief may include injunctions issued prior to publication or broadcast, subject to the conditions prescribed by the law.

In this regard, the claimant must adduce evidence demonstrating an imminent risk of disclosure, for example evidence of conduct giving rise to a credible risk of infringement of privacy or leakage of confidential information, engagement with media organisations, and may apply for urgent or emergency injunctive relief where appropriate.

Range of Awards

As to the range of awards, there is no fixed statutory threshold. The quantum of damages is determined on a case-by-case basis, having regard to factors such as the nature and sensitivity of the information, the scope and duration of the disclosure, the fame or reputation of the injured party, and the surrounding circumstances and severity of the violation. Courts will generally assess damages by reference to the actual damage suffered.

Deadlines for Bringing an Action

• Civil Action (Tort Law): Under Section 448 of the Civil and Commercial Code, the claimant must bring an action within one year from the date on which the claimant became aware of the tortious act and knew the person liable to pay compensation, or within ten years from the date on which the tortious act was committed.
• Civil Action (Contractual Basis): Thai law does not prescribe a specific limitation period for claims arising from a non-disclosure agreement. Accordingly, the general prescription period of ten years from the date on which the right of claim may be exercised applies under Section 193/30 of the Civil and Commercial Code.
• Criminal Action: The prescription period for an offence relating to confidentiality according to Sections 322 to 325 of the Criminal Code is five years from the date on which the offence was committed. However, where the offence is a compoundable offence, the injured person must lodge a complaint within three months from the date on which they become aware of the offence and know the identity of the offender; failing which, the right to prosecute shall be barred by prescription.

Defences to the Claim

The common defences applicable to both civil and criminal actions include, in particular, arguments that the action or information in question does not fall within the legally protected scope of “privacy” or “confidentiality”, that no wrongful act giving rise to civil liability or conduct constituting a criminal offence has occurred, and that the claimant has failed to establish that any legally cognisable damage or loss has been suffered as a result.

In criminal proceedings, the accused may also rely on the defence that there was no intention to commit the alleged offence. 

Specific Protections for the Media/Freedom of Expression and Reporting in the Public Interest

In general, a person’s freedom to express opinions, make speeches, write, print, publish, and otherwise communicate ideas is protected under Section 34 of the Constitutional Law. In addition, a media professional’s right to present news or express opinions in accordance with professional ethics is protected under Section 35 of the Constitutional Law.

Thai law also provides specific protections for mass media activities where the use or disclosure of information is carried out in accordance with professional ethics or in the public interest. In addition, fair criticism or comment on matters that are legitimately subject to public interest or public scrutiny is also protected. These principles are discussed in greater detail in 2. Defamation and 4. Data Protection.

Distinctions Between Civil and Criminal Proceedings

• Civil proceedings are compensatory and preventive in nature. The injured party initiates the action, with the primary focus on claiming damages and seeking remedies to prevent further harm.
• Criminal proceedings are punitive in nature and are aimed at punishment. Prosecution may be initiated by the injured party or by the public prosecutor.
• Parallel proceedings: Civil and criminal proceedings may be pursued concurrently in respect of the same facts. However, in adjudicating a civil case, the court shall be bound by the facts as they appear in the judgment in the criminal case.

Private or Anonymised Court Proceedings

Thai court proceedings are generally conducted in open court, reflecting the fundamental principles of transparency and public justice. Nevertheless, where privacy or confidentiality concerns arise, the parties may apply to the court for protective measures, including: (i) the redaction of names or identifying details in judgments or court records; (ii) restrictions on access to certain documents or evidence; and (iii) orders prohibiting or limiting the publication or disclosure of sensitive information.

To establish grounds to bring proceedings, the following jurisdictional principles apply:

• Civil Proceedings: Under Section 4 of the Civil Procedure Code, an action may be brought before the court in whose jurisdiction the defendant has domicile, or before the court in whose jurisdiction the cause of action arose.
• Criminal Proceedings: Under Section 22 of the Criminal Procedure Code, an offence may be instituted before any court within whose jurisdiction the offence was committed, or is alleged or reasonably believed to have been committed.

Legal costs and attorneys’ fees in Thai court proceedings are awarded at the discretion of the court and are subject to statutory limits. In determining attorneys’ fees, the court will consider the complexity of the case, the time spent, and the work performed by counsel, provided that the amount awarded does not exceed the prescribed maximum rates.

In addition, the court may order the unsuccessful party to reimburse litigation expenses incurred by the other party in such amount as the court deems appropriate, taking into account the expenses actually incurred, as well as the nature and manner in which the proceedings were conducted by the parties.

However, in practice, the amounts recoverable for legal costs and expenses are generally modest and do not reflect the actual legal fees or costs incurred by the successful party.

First, Thai law does not recognise a distinct, standalone cause of action for invasion of privacy. Instead, privacy claims are pursued under general legal principles, such as tort law, contract law, and specific statutory regimes. As a result, Thai courts are afforded relatively broad discretion in assessing liability on a case-by-case basis, taking into account the nature of the conduct, the interests involved, and considerations of fairness and public interest.

Secondly, confidentiality or non-disclosure agreements are, in principle, enforceable under Thai law. However, their scope, duration, and restrictions must be reasonable and proportionate. Such contractual provisions are subject to statutory controls, including the law on unfair contractual terms, and may be limited or declared unenforceable where they are excessive, overly restrictive, or contrary to public policy.

Finally, statutory limits also apply to the collection, use, and disclosure of personal data and sensitive personal data. For example, Section 4 of the Personal Data Protection Act sets clear legal boundaries on how privacy may be regulated in practice.

The pursuit of defamation claims in Thailand is governed by Sections 326 to 333 of the Criminal Code, which criminalise the act of imputing facts to another person before a third party in a manner likely to impair that person’s reputation, expose them to contempt, or cause them to be hated.

Thai law further provides for aggravated defamation where the defamatory act is committed by means of publication, including dissemination through documents, images, audio-visual media, broadcasting, or other forms of public communication. In such cases, enhanced criminal liability may arise, reflecting the wider impact of the defamatory conduct.

In parallel, defamation may also give rise to civil liability under Sections 420 and 423 of the Civil and Commercial Code, which is based on tort principles. Under Section 423, any person who makes or circulates false statements detrimental to another person’s reputation, honour, livelihood, or business prospects may be liable to compensate the injured party for the damage suffered. While falsity is a key element of a claim under Section 423, Section 420 has a broader scope and may apply even where the statement is not false but nonetheless causes harm to another person.

Please refer to 1.2 Privacy Remedies.

Deadlines for Bringing an Action

• The deadlines for bringing defamation claims under tort law, as well as the conditions applicable to defamation offences, which are compoundable offences, are set out in 1.3 Privacy Deadlines and Defences.
• Ordinary defamation offences are barred by a prescription period of five years, whereas defamation committed by means of publication is barred by a prescription period of ten years, in each case counted from the date on which the offence was committed.

Defences to the Claim

Defences to defamation claims are primarily governed by statutory exceptions under the Criminal Code, which also reflect protections for freedom of expression, the media, and reporting in the public interest. In particular:

• Section 329 provides that a person shall not be liable for defamation where opinions or statements are made in good faith:
1. for a legitimate purpose, including self-protection or the protection of a lawful interest in accordance with moral principles;
2. in the capacity of a public official acting in the performance of official duties;
3. by way of fair comment or criticism on a person or matter that is legitimately subject to public interest or public scrutiny; or
4. by way of fair reporting of proceedings conducted openly before the courts or of matters discussed in public meetings.
• Section 330 provides that in cases of defamation, if the accused can prove that the allegedly defamatory statement is true, the accused shall not be subject to punishment.
• Section 331 provides that a party to legal proceedings, or that party’s legal counsel, who expresses opinions or makes statements in the course of judicial proceedings for the benefit of their case, shall not be liable for defamation.

Please refer to 1.4 Privacy Proceedings Forum Choice.

Please refer to 1.5 Privacy Costs.

One notable and relatively distinctive feature of defamation claims in Thailand is the availability of corrective publicity measures as part of the criminal sentencing framework.

Under the Thai Criminal Code, where a judgment is rendered finding the defendant guilty of a defamation offence, the court may order the publication of the judgment, in whole or in part, in one or more newspapers and on one or more occasions, at the defendant’s expense. This mechanism is intended not only to punish the offender but also to restore the reputation of the injured party and to counteract the reputational harm caused by the defamatory publication.

In practice, such orders are particularly relevant in cases involving mass media, public dissemination, or wide public exposure, where the damage to reputation extends beyond the immediate parties. The court may tailor the scope, frequency, and medium of publication to reflect the seriousness of the offence and the extent of the harm suffered.

Harassment claims in Thailand are broadly governed by Section 397 of the Criminal Code, which criminalises any act committed against another person in a manner that constitutes harassment, intimidation, coercion, or causes embarrassment, distress, or annoyance. The law further provides for aggravated liability where such conduct is carried out in a public place or in the presence of the public.

However, the provision is drafted in relatively general terms and does not specifically or comprehensively address modern forms of misconduct such as stalking, sustained campaigns of abusive communications, or unjustifiable surveillance. As a result, protections for clients against such conduct are not expressly delineated and are typically pursued by analogy under general tort principles, or other applicable legislation on a case-by-case basis.

By contrast, in cases involving “sexual” harassment, the position is clearer and more detailed following amendments introduced in December 2025. The Criminal Code now expressly addresses sexual harassment under Sections 284/1, 284/2, 284/3, and 284/4, which adopt a comprehensive definition of “sexual harassment” that expressly encompasses conduct such as stalking, campaigns of abusive communications, and unjustifiable surveillance.

Under these provisions, sexual harassment is defined to include acts committed by physical conduct, verbal expression, sounds, gestures, behaviour, communication, monitoring, persistent following, or any other means, including through computer systems, telecommunications devices, or other electronic devices capable of conveying meaning, where such conduct is sexual in nature and is likely to cause the victim distress, annoyance, embarrassment, humiliation, fear, or a sense of sexual insecurity.

Please refer to 1.2 Privacy Remedies.

Deadlines for Bringing an Action

• Please refer to 1.3 Privacy Deadlines and Defences regarding the deadlines for bringing a tort claim.
• Harassment claims are barred by a prescription period of one year from the date on which the offence was committed.
• Sexual harassment claims are barred by a prescription period of five years from the date on which the offence was committed. Certain sexual harassment offences are compoundable; please see 1.3 Privacy Deadlines and Defences regarding the conditions applicable to the pursuit of compoundable offences.

Defences to the Claim

In both civil and criminal proceedings, common defences include the existence of consent on the part of the claimant, as well as the absence of intent, negligence, or wilful conduct on the part of the defendant, on the basis that the alleged conduct does not in fact constitute harassment.

Please refer to 1.4 Privacy Proceedings Forum Choice regarding the distinctions between civil and criminal proceedings and the grounds for bringing proceedings.

With respect to private court proceedings, although hearings are generally conducted in open court, the court has the authority to order persons who are not directly involved in the case to leave the courtroom. In practice, the court often exercises this discretion in sensitive matters, such as harassment cases.

Please refer to 1.5 Privacy Costs.

Thailand provides legal and regulatory grounds for the protection of data rights primarily under the Personal Data Protection Act (PDPA), which came into full force and effect on 1 June 2022. The PDPA is largely modelled on the General Data Protection Regulation (GDPR) of the European Union and adopts similar core principles of personal data protection.

The objective of the PDPA is to safeguard personal data by regulating its collection, use, disclosure, and retention. In particular, the legislation seeks to prevent unauthorised access, hacking, and misuse of personal data, as well as infringements of privacy committed for improper purposes, including coercion or the pursuit of unlawful benefits, whether directed at the data subject or at persons responsible for controlling or processing such data.

Given that the PDPA is a relatively new piece of legislation, the Personal Data Protection Committee (PDPC) has, over time, issued a number of subordinate regulations and notifications to provide further guidance and clarification. These measures are intended to assist organisations in understanding their statutory obligations and to reduce the risk of non-compliance arising from practices that are inconsistent with the requirements of the PDPA.

The remedies available under the PDPA include civil liability, administrative fines, criminal fines, and criminal sanctions.

Regarding the range of awards for civil liability and injunctive relief, please see 1.2 Privacy Remedies.

In addition, the PDPA empowers the court to order a personal data controller or personal data processor to pay punitive damages in addition to the actual damages awarded, in such amount as the court deems appropriate, but not exceeding twice the amount of the actual damages, taking into account the relevant circumstances, including the severity of the damage suffered by the data subject.

Deadlines for Bringing an Action

Civil action

A civil claim is barred by prescription upon the lapse of three years from the date on which the injured person becomes aware of the damage and knows the identity of the personal data controller or personal data processor liable for such damage, or upon the lapse of ten years from the date on which the personal data breach occurred.

Criminal action

Please refer to 1.3 Privacy Deadlines and Defences.

Administrative action

Under the PDPA, the expert committee has the authority to consider and impose an administrative fine through two channels: (i) where a claimant has lodged a complaint with the committee concerning an alleged violation of the PDPA, or (ii) where the committee identifies the violation on its own initiative. However, the PDPA does not stipulate any specific deadline for proceeding under either of these two channels.

Following the issuance of an administrative fine, if the person subject to the fine fails to make payment, a competent official shall proceed with enforcement of the administrative order.

Where there is no official responsible for enforcement, or where enforcement of the fine order cannot be carried out, the committee has the authority to file a claim with the administrative court to compel payment of the administrative fine in accordance with the administrative order, provided that enforcement action is undertaken within ten years from the date on which such administrative order becomes final.

Exemptions From Data Rights under the PDPA

• Section 4 (Scope exemptions): The PDPA does not apply to certain activities, including:
1. the collection, use, or disclosure of personal data for purely personal or household activities;
2. operations of state authorities relating to national security, public safety, anti-money laundering, forensic work, or cybersecurity;
3. the use or disclosure of personal data solely for mass media, artistic, or literary activities, where carried out in accordance with professional ethics or in the public interest;
4. activities of the House of Representatives, the Senate, the National Assembly, and their committees in the exercise of their constitutional powers;
5. judicial proceedings and the performance of duties by officials in court proceedings, enforcement of judgments, deposits, and criminal justice processes; and
6. activities relating to credit bureau companies and their members under the credit information business law.
• Section 24 (Collection without consent): A personal data controller may collect personal data without the data subject’s consent where necessary, including:
1. for historical documentation, archives in the public interest, or research or statistics with appropriate safeguards;

1. to prevent or suppress danger to life, body, or health;
2. for the performance of a contract to which the data subject is a party, or for steps taken at the data subject’s request prior to entering into a contract;
3. for the performance of a task carried out in the public interest or in the exercise of official authority;
4. for the legitimate interests of the controller or a third party, provided such interests do not override the fundamental rights and freedoms of the data subject; or
5. for compliance with legal obligations of the data controller.

In essence, the PDPA recognises broad functional exemptions and lawful bases that balance personal data protection with public interest, legal necessity, and legitimate operational needs.

Please refer to 1.4 Privacy Proceedings Forum Choice.

Please refer to 1.5 Privacy Costs.

National broadcasters and newspapers in Thailand are generally subject to professional and ethical standards. In principle, mainstream media outlets adhere to journalistic ethics relating to fact-checking, balanced reporting, and the public interest.

However, in practice, competitive pressures and the demand for rapid, high-impact news coverage often result in reporting that prioritises immediacy and public attention. In such circumstances, media reporting may encroach upon individual privacy or rely on sensationalised narratives, particularly in relation to celebrity news, gossip-based reporting, or stories driven by prevailing social trends. These practices have, on occasion, given rise to both civil and criminal proceedings, especially where reporting is alleged to exceed the bounds of fair comment, accuracy, or legitimate public interest.

The five most influential news providers in Thailand may be categorised as follows: television broadcasters – Channel 3 and Thai PBS; newspapers – Bangkok Post and Thairath; and international news provider – BBC News.

Broadcasting and television media in Thailand are primarily regulated by the National Broadcasting and Telecommunications Commission (NBTC). Television and radio operators are required to obtain licences and comply with regulatory conditions relating to content standards, public interest obligations, and professional ethics. The NBTC has statutory powers to supervise operators, investigate complaints, and impose sanctions for non-compliance.

By contrast, newspapers and other publishers are not subject to a dedicated content regulator. They are only required to complete printing registration in accordance with the applicable printing registration legislation, with oversight exercised mainly through general laws, including civil and criminal liability under tort and defamation law, as well as self-regulatory mechanisms within the press sector.

For online media and social media, there is likewise no dedicated content regulator. Legal oversight is instead exercised through general legislation, most notably laws on defamation, privacy, personal data protection, and computer-related offences. In particular, online content may be subject to enforcement under computer crime legislation where it involves unlawful dissemination, false information, or other prohibited conduct.

The effectiveness of regulators in protecting the public, as well as individual privacy and reputation, is subject to practical limitations. As noted in 5.1 Key News Providers, notwithstanding the existence of regulatory supervision over media activities, the commercial and competitive imperatives of news reporting – particularly the need for content to be current, timely, and emotionally engaging – may, in practice, lead to infringements of privacy and reputation. As a result, regulatory mechanisms alone do not fully prevent such issues, and press-related litigation, including civil and criminal claims against media outlets, continues to arise in Thailand.

The said regulations do not expressly provide standalone protections for the media. Rather, such protections are rooted in Section 35 of the Constitutional Law, which recognises that persons engaged in the profession of mass media enjoy the freedom to present information and express opinions in accordance with professional ethics.

These protections are further reflected in statutory exemptions applicable to the publication of information made in good faith, for the public interest, and in compliance with professional standards, as mentioned in 2.3 Defamation Deadlines and Defences and 4.3 Data Protection Deadlines and Exemptions.

The complaint mechanism in Thailand operates under a sector-specific framework rather than a single, centralised system. The process and available sanctions depend on the type of media and the applicable law. In summary:

• Broadcast Media (Television and Radio): Under the Broadcasting and Television Business Act, complaints may be lodged by affected persons where a broadcast contains false information or infringes rights, freedoms, honour, reputation, family rights, or personal privacy. Such complaints may be submitted to the National Broadcasting and Telecommunications Commission (NBTC). Upon receipt, the NBTC will review the complaint and forward the matter, together with its opinion, to the relevant professional or occupational regulatory body, for the purpose of taking remedial action and providing appropriate redress to the injured party.
• Print Media and Online Media (Including Social Media): As noted in 5.2 Regulatory Framework, these media are not subject to a content-based statutory regulator. Complaints are therefore primarily addressed through civil and criminal court proceedings, computer-related legislation, and other general legal remedies. Where complaints are pursued on data protection grounds, they are handled through the Personal Data Protection Committee. Potential sanctions may include corrective orders, administrative fines, civil liability, and, where applicable, criminal penalties.

Legal and regulatory mechanisms exist to protect websites and platforms that host user-generated content, primarily under Section 15 of the Computer-Related Crime Act.

Under this provision, a service provider will not be held criminally liable for unlawful computer data posted by users if the provider can demonstrate compliance with the statutory requirements prescribed by law.

These requirements operate through a notice-and-takedown mechanism, whereby service providers must establish procedures for receiving complaints or notifications concerning unlawful content. Upon receipt of a proper complaint together with supporting evidence, the service provider is required to promptly suspend dissemination, remove, or disable access to the unlawful content. The affected user may subsequently contest the takedown in accordance with the prescribed procedure. Where a service provider has implemented and complied with these measures in good faith, it will be exempt from criminal liability arising from user-generated content.

In addition, a provider will not be held criminally liable if it can prove that it had no intention and no knowledge that the content was unlawful, or lacked knowledge of the facts constituting the offence. This framework seeks to strike a balance between protecting online intermediaries and preventing the dissemination of unlawful computer data.

In Thailand, there is currently no specific statutory framework that expressly recognises or provides direct protection against SLAPP-type litigation. Cases that may fall within the characteristics of SLAPPs are addressed under general tort law, defamation law, and the constitutional protection of rights and freedoms.

In practice, responses to SLAPP-type litigation may include counterclaims for false prosecution under Section 175 of the Criminal Code, tort law under Section 420 of the Civil and Commercial Code, as well as claims based on the abuse of rights where a party knowingly commences proceedings without reasonable grounds, constituting an exercise of rights solely to cause damage to another person under Section 421 of the Civil and Commercial Code.

However, the absence of a clear and systematic anti-SLAPP mechanism presents challenges in maintaining an appropriate balance between freedom of expression and public participation on the one hand, and the protection of reputation and the rights of individuals or organisations on the other.

Thailand does not have specific legislation equivalent to the SPEECH Act in the United States that expressly prevents the enforcement of foreign judgments in media or defamation cases.

Under Thai law, foreign court judgments are not recognised or directly enforceable in Thailand. Instead, such judgments may only be relied upon as evidence in a new action commenced before the Thai courts. In such proceedings, the Thai court will re-examine the case on its merits in its entirety and determine the issues independently.

In accordance with Supreme Court jurisprudence, the Thai court will consider, in particular: (i) jurisdiction, namely whether the foreign court that rendered the judgment had proper jurisdiction over the case; and (ii) finality, namely whether the foreign judgment is final and conclusive. In addition, the court will assess whether the foreign judgment is consistent with Thai public order or good morals.