1. Introduction

Digital Protection Rights Recognition in Thailand refers to the legal recognition and protection of individuals' rights in the digital environment, particularly concerning personal information, privacy, online identity, electronic communications, digital transactions, electronic records, and protection against unlawful digital activities.

The rapid expansion of Thailand's digital economy has created new legal challenges involving:

Unauthorised collection and disclosure of personal information.

Online identity theft and impersonation.

Digital surveillance and unlawful monitoring.

Publication of private photographs and confidential information.

Cyber harassment and online reputational damage.

Misuse of biometric and sensitive personal information.

Unlawful processing of personal data by digital platforms.

Consumer protection in electronic transactions.

Unauthorised access to digital accounts and databases.

Liability of digital platforms and technology service providers.

Thailand recognises digital protection through constitutional guarantees, civil liability principles, personal data protection legislation, electronic transaction legislation, consumer protection law, and computer-related crime legislation.

An important distinction is that Thailand does not recognise every digital interest as an independent property right. Instead, many digital protection claims are resolved through established rights relating to privacy, personality, confidentiality, contractual obligations, and civil liability.

2. Constitutional Foundation of Digital Protection Rights

The Constitution of the Kingdom of Thailand B.E. 2560 (2017) provides an important foundation for protecting individuals against unlawful interference with their private lives.

A. Section 32 – Right to Privacy

Section 32 protects the rights of individuals concerning their personal status, dignity, reputation, and privacy.

Its relevance to digital protection includes:

Protection against unlawful disclosure of private information.

Protection against unauthorised publication of intimate photographs.

Protection against invasive digital surveillance.

Recognition of personal dignity in online environments.

Protection against interference with private communications.

B. Section 25 – Recognition of Fundamental Rights

Section 25 establishes constitutional protection for rights and liberties recognised under the Constitution and applicable laws.

It provides a broader foundation for individuals seeking protection against unlawful digital conduct.

C. Section 26 – Constitutional Restrictions

Restrictions on fundamental rights must satisfy constitutional requirements, including legality, necessity, and proportionality.

This is relevant where government authorities collect, monitor, or process personal information.

D. Section 36 – Freedom of Communication

Section 36 protects the freedom of communication by lawful means and provides safeguards against state interference with communications, subject to legally recognised exceptions.

It is particularly relevant to electronic communications, digital correspondence, and telecommunications privacy.

3. Personal Data Protection Act B.E. 2562 (2019)

Principal legislation

The Personal Data Protection Act B.E. 2562 (2019) (PDPA) is the principal legislation governing personal data protection in Thailand.

Its principal purpose is to protect individuals from unlawful collection, use, and disclosure of personal information.

The substantive provisions became enforceable in 2022.

A. Section 19 – Consent

Section 19 establishes consent as an important legal basis for processing personal data.

Consent must satisfy the applicable legal requirements and must not be obtained through misleading or unfair practices.

B. Section 20 – Consent of Minors

This section establishes requirements concerning consent for processing personal information of minors, including circumstances requiring parental or legal representative consent.

C. Section 23 – Privacy Information

Data controllers must provide relevant information to data subjects concerning the collection of personal information.

This promotes transparency and accountability.

D. Section 24 – Lawful Processing

Section 24 establishes circumstances in which personal data may be collected without consent, subject to the statutory conditions.

Examples include certain contractual, legal, legitimate-interest, and public-interest grounds.

E. Section 26 – Sensitive Personal Data

Section 26 provides additional protection for sensitive personal data, including:

Racial and ethnic information.

Political opinions.

Religious and philosophical beliefs.

Health information.

Disability information.

Genetic information.

Biometric information.

Sexual behaviour information.

Processing generally requires explicit consent unless a statutory exception applies.

F. Section 30 – Right of Access

Data subjects have the right to access their personal data and obtain copies, subject to the statutory conditions.

G. Section 31 – Right to Data Portability

Individuals may request personal data in a readable or commonly usable format and, where applicable, request its transfer to another data controller.

H. Section 32 – Right to Object

Individuals may object to certain forms of personal data processing.

I. Section 33 – Right to Erasure

Individuals may request deletion or destruction of personal data where the statutory conditions are satisfied.

J. Section 34 – Right to Restrict Processing

Individuals may request restrictions on the processing of their personal data in circumstances established by law.

K. Section 35 – Right to Rectification

Data controllers must ensure that personal data is accurate, current, complete, and not misleading.

L. Section 37 – Duties of Data Controllers

Data controllers must implement appropriate security measures, prevent unauthorised access and disclosure, and comply with applicable breach-notification obligations.

These provisions collectively create an enforceable framework for digital protection rights in Thailand.

MDES+1

4. Civil and Commercial Code: Digital Protection Through Tort Liability

The Thai Civil and Commercial Code (CCC) provides an important mechanism for protecting individuals against unlawful digital conduct.

A. Section 420 – General Tort Liability

Section 420 establishes liability where a person, wilfully or negligently and unlawfully, injures another person's life, body, health, liberty, property, or rights.

Digital applications include:

Unauthorised disclosure of private photographs.

Digital identity misuse.

Unlawful publication of confidential information.

Online harassment causing legally recognised injury.

Unauthorised use of personal information.

Digital impersonation causing financial or reputational damage.

B. Section 421 – Abuse of Rights

Section 421 addresses the exercise of rights where the exercise is intended solely to cause injury to another person.

It may be relevant to malicious digital activities and abusive use of online rights.

C. Section 423 – False Information and Reputation

Section 423 addresses the communication or publication of false information that injures another person's reputation, credit, earnings, or prosperity.

It is particularly relevant to online defamation and false digital publications.

D. Section 438 – Assessment of Compensation

Section 438 provides the general framework for judicial assessment of damages in tort cases.

Courts consider the circumstances and seriousness of the wrongful conduct when determining compensation.

E. Section 420 and Injunctive Protection

Civil remedies may include compensation and, where the legal requirements are satisfied, orders requiring the defendant to stop unlawful conduct.

5. Computer-Related Crime Act B.E. 2550 (2007)

The Computer-Related Crime Act, as amended in 2017, addresses unlawful conduct involving computer systems and computer data.

Important provisions include:

The Act complements civil law by providing criminal protection against specified digital offences.

Importantly, not every online insult or defamatory publication constitutes an offence under Section 14. Ordinary defamation is principally addressed under the Criminal Code.

6. Electronic Transactions Act B.E. 2544 (2001)

The Electronic Transactions Act recognises the legal significance of electronic records, electronic communications, and electronic transactions.

Important provisions include:

Section 7: Electronic information cannot be denied legal effect solely because it is in electronic form.

Section 8: Electronic information can satisfy legal writing requirements where statutory conditions are fulfilled.

Section 9: Electronic signatures can satisfy signature requirements when the prescribed conditions are met.

Section 11: Electronic data cannot be denied admissibility in legal proceedings solely because it is electronic.

Section 12: Electronic records can satisfy certain original-document requirements.

Section 13: Electronic offers and acceptances can create legally recognised contracts.

This legislation is important for recognising digital protection rights because individuals must be able to establish ownership, consent, contractual relationships, and unlawful digital conduct through electronic evidence.

7. Six or More Important Case Laws and Judicial Precedents

Important legal qualification: Thailand's reported higher-court jurisprudence specifically concerning the PDPA remains limited. The 2026 legal-practice review reports that there are no publicly available high-court judgments specifically establishing a developed body of PDPA privacy litigation, although a first-instance judgment concerning unlawful personal-data disclosure has been reported. Consequently, the following authorities include direct privacy and digital cases, together with analogous civil precedents. They should not all be described as PDPA judgments.

Chambers+1

Case 1. Supreme Court Judgment No. 4893/2558 (2015)

Subject: Privacy rights and unauthorised publication of intimate information

Facts:

The case concerned the publication of intimate images and information identifying individuals involved in a private sexual relationship.

The media defendants argued that their publication was protected by freedom of expression and journalistic activity.

Legal issue:

Whether media freedom permits the disclosure of intimate information that violates another person's privacy.

Judicial decision:

The Supreme Court recognised that an individual's privacy is a legally protected right and that interference with that right can constitute a wrongful act under Section 420 of the Civil and Commercial Code.

Legal principles:

Privacy is a legally protected individual right.

Media freedom does not provide unlimited authority to disclose intimate information.

Unauthorised identification of individuals in intimate material can constitute a tort.

A person may claim compensation for legally recognised injury.

Relevance to digital protection:

The principles apply to unauthorised online publication of intimate photographs, private videos, personal messages, and other confidential digital material.

Importance: This is one of the strongest Thai judicial authorities for recognising privacy as a protected civil right.

Deka+1

Case 2. Prosecutor v. Chiranuch Premchaiporn – Supreme Court Case No. อ.1167/2553 (2015)

Subject: Digital intermediary responsibility and online content

Facts:

Chiranuch Premchaiporn, director of the Prachatai online news platform, faced proceedings concerning allegedly unlawful comments posted by users on the platform's discussion forum.

The prosecution relied on Section 15 of the Computer-Related Crime Act.

Legal issue:

Whether an online intermediary could incur responsibility for unlawful content posted by third parties and retained on its platform.

Judicial outcome:

The Supreme Court proceedings resulted in a conviction and suspended sentence.

Legal principles:

Online intermediaries may face statutory responsibilities.

The duration for which unlawful content remains accessible may become relevant.

Removal of unlawful content after notification can be legally significant.

Digital platform operators must consider their statutory obligations.

Relevance to digital protection:

This decision illustrates the relationship between online content management, intermediary responsibility, freedom of expression, and protection against unlawful digital publications.

Importance: It demonstrates that digital platforms operate within a legal framework rather than enjoying unrestricted immunity for hosted content.

iLaw+1

Case 3. Supreme Court Judgment No. 1808/2561 (2018)

Subject: Concealment of material information and civil liability

Facts:

The dispute concerned a property developer that sold property without properly disclosing material information relating to expropriation.

The purchasers alleged that the omission caused financial injury.

Legal issue:

Whether withholding important information could constitute a wrongful act under Section 420.

Judicial principle:

The Supreme Court recognised that concealing material information in the circumstances of the dispute could give rise to civil liability.

Relevance to digital protection:

Although this was not a data-protection case, its principles are relevant by analogy to digital services that:

Conceal material information about data processing.

Misrepresent the nature of digital services.

Withhold important information from consumers.

Cause financial loss through misleading representations.

Importance: It supports the broader principle that wrongful concealment of material information may create civil liability.

Thai CCC

Case 4. Supreme Court Judgment No. 5374/2561 (2018)

Subject: Property rights, interference, and wrongful conduct

Facts:

The dispute concerned interference with a boundary wall serving a land-allocation development.

The legal question involved the nature of the property interest and the consequences of interference with legally protected rights.

Judicial principle:

The Supreme Court considered the relevant property rights and recognised liability under Section 420 in the circumstances of the dispute.

Relevance to digital protection:

The decision is analogous to disputes involving digital assets and protected interests.

For example:

Unauthorised interference with a digital account.

Destruction of commercially valuable digital information.

Interference with legally protected digital records.

Unlawful obstruction of access to a protected digital resource.

Importance: It illustrates how traditional civil liability principles can extend to interference with legally protected interests, although the judgment itself did not concern digital property.

Thai CCC

Case 5. Supreme Court Judgment No. 4403/2566 (2023)

Subject: Revenge posting, online publication, and digital reputational harm

Facts:

The case involved the publication of sexually explicit material and defamatory content through digital channels.

The proceedings concerned offences under the Criminal Code and Computer-Related Crime Act.

The injured person also sought compensation for humiliation and reputational damage.

Judicial significance:

The proceedings involved separate legal consequences for online defamatory publication and the unlawful dissemination of explicit material.

The civil claim resulted in an award of compensation.

Legal principles:

Digital publication can produce serious personal injury.

Unlawful online dissemination can generate criminal liability.

Digital conduct may also give rise to compensation claims.

The same conduct can engage multiple legal provisions where their individual requirements are satisfied.

Relevance to digital protection:

This case is important for protecting personal dignity, intimate information, and reputation against online abuse.

Importance: It demonstrates the interaction between criminal protection and civil compensation in digital privacy-related disputes.

ThaiLawOnline

Case 6. First-Instance Court Judgment Concerning an Insurance Company (March 2024)

Subject: Unauthorised collection and disclosure of sensitive personal information

Facts:

A reported Thai first-instance judgment concerned the handling of blood-alcohol test results and a photograph associated with an individual's medical examination.

The information was allegedly collected and disclosed without the necessary explicit consent.

Legal issue:

Whether the processing and disclosure of sensitive personal information complied with Section 26 of the PDPA.

Legal significance:

The matter demonstrates the importance of obtaining a valid legal basis for processing sensitive personal information.

It also illustrates the potential consequences of disclosing medical information beyond the purposes for which it was lawfully obtained.

Relevance to digital protection:

The same principles apply to:

Electronic medical records.

Digital insurance databases.

Biometric information.

Health applications.

Online medical platforms.

Unauthorised sharing of sensitive personal records.

Status: This is a first-instance decision, not an established Supreme Court precedent. A publicly verified judgment number or final appellate outcome is not available in the cited legal-practice account.

Chambers and Partners

Case 7. Supreme Court Judgment No. 789/2502 (1959)

Subject: Civil liability and the protection of legally recognised interests

This historical Supreme Court decision is identified in Thai civil-liability research concerning the interpretation and development of tort liability.

Its relevance to digital protection must be treated cautiously.

The broader analytical connection is that digital protection claims may require courts to determine whether the interest allegedly infringed qualifies as a legally protected right and whether the statutory elements of wrongful conduct and damage are established.

It is not a digital privacy or PDPA judgment and should not be cited as direct recognition of digital protection rights.

eThesis Archive

8. Recognition of Specific Digital Protection Rights in Thailand

A. Right to Digital Privacy

Digital privacy protects individuals against unlawful interference with their personal lives through electronic systems.

It includes:

Protection of private digital correspondence.

Protection against unauthorised surveillance.

Protection of personal photographs and videos.

Protection of private social-media communications.

Protection against unlawful tracking.

The constitutional right to privacy and Section 420 of the CCC provide important foundations for civil claims.

B. Right to Personal Data Protection

Under the PDPA, individuals have enforceable rights over personal information processed by data controllers.

These rights include access, correction, deletion, objection, restriction, and portability, subject to statutory requirements.

C. Right to Digital Identity Protection

Digital identity protection concerns unlawful use of another person's:

Name and personal identifiers.

Photographs and likeness.

Biometric information.

Account credentials.

Electronic signatures.

Personal identification documents.

Identity misuse may create liability under the CCC, PDPA, Computer-Related Crime Act, and other applicable legislation.

D. Right to Protection Against Digital Harassment

Individuals may seek legal protection against online conduct involving:

Threatening communications.

Unlawful dissemination of intimate photographs.

Online stalking.

Malicious impersonation.

Unlawful disclosure of confidential information.

The precise remedy depends on the conduct, evidence, and applicable statutory provisions.

E. Right to Digital Financial Protection

Digital financial protection concerns unauthorised transactions, electronic payment fraud, identity theft, and misuse of banking information.

Relevant legal frameworks include:

Civil and Commercial Code.

Personal Data Protection Act.

Electronic Transactions Act.

Computer-Related Crime Act.

Payment Systems Act B.E. 2560 (2017).

Consumer Protection Act B.E. 2522 (1979).

F. Right to Protection of Digital Medical Information

Medical and biometric information receive enhanced protection under Section 26 of the PDPA.

Healthcare institutions, insurance companies, and digital healthcare platforms must comply with applicable requirements when processing sensitive personal data.

G. Right to Protection Against Unlawful Digital Disclosure

Individuals may pursue appropriate remedies where personal information, private communications, or confidential records are disclosed unlawfully.

The legal analysis considers consent, lawful processing grounds, confidentiality obligations, damage, and the conduct of the person responsible.

9. Civil Remedies and Enforcement Mechanisms

Thailand's digital protection framework provides several forms of legal relief.

A. Civil Compensation

Under Section 77 of the PDPA, data controllers and processors may incur civil liability for damage arising from violations of the Act, subject to the statutory conditions and applicable defences.

The court may award punitive damages where the statutory requirements are met. Such damages cannot exceed twice the actual damages.

B. Administrative Enforcement

The Personal Data Protection Committee and relevant expert committees perform regulatory and enforcement functions.

They can exercise statutory powers concerning violations of data protection obligations.

C. Criminal Enforcement

The PDPA establishes criminal liability for specified violations, including certain unlawful uses or disclosures of sensitive personal data.

D. Collective Redress

Thailand's class-action framework can provide collective remedies where multiple individuals suffer damage from related unlawful conduct.

This is particularly important in cases involving:

Large-scale database breaches.

Unauthorised disclosure of customer information.

Digital banking data incidents.

Online platform privacy violations.

Mass misuse of personal information.

10. Liability of Digital Platforms and Technology Companies

Digital businesses operating in Thailand must consider several categories of legal responsibility.

A company cannot automatically avoid liability merely because the harmful conduct occurred through an automated system.

However, liability must be established under the relevant legal provisions rather than presumed from the existence of digital technology.

11. Major Challenges in Recognising Digital Protection Rights

A. Rapid Technological Development

Traditional civil law was developed primarily around physical property, personal relationships, and conventional commercial transactions.

Digital technologies create new questions involving virtual identities, automated decision-making, and personal data.

B. Cross-Border Data Processing

International digital platforms may collect information from individuals in Thailand while processing it abroad.

Section 5 of the PDPA addresses territorial application, including certain foreign data controllers and processors offering goods or services to, or monitoring the behaviour of, individuals in Thailand.

C. Difficulties in Proving Digital Damage

Victims may face difficulties establishing:

The identity of the person responsible.

The source of an unauthorised disclosure.

The extent of personal information exposed.

The relationship between the breach and financial loss.

The existence and extent of legally compensable injury.

D. Artificial Intelligence and Automated Processing

AI systems create additional protection challenges involving profiling, biometric identification, automated decisions, and misuse of personal information.

The PDPA provides a general data-protection framework, but not every AI-related dispute has a dedicated statutory remedy.

E. Limited Judicial Precedents

The limited number of publicly available higher-court PDPA decisions creates uncertainty concerning:

Assessment of privacy damages.

Application of punitive damages.

Liability of data processors.

Collective data breach litigation.

Interpretation of consent.

Compensation for non-economic injury.

This makes administrative enforcement, statutory interpretation, and traditional civil-law principles particularly important.

12. Comparative Legal Analysis

Thailand's digital protection framework can be understood through comparison with other legal systems.

Thailand's framework combines constitutional privacy protection, civil tort remedies, administrative regulation, and criminal enforcement.

Unlike the GDPR, however, Thailand's PDPA operates within its own statutory enforcement and remedial structure.

13. Suggestions for Legal Reform in Thailand

The following reforms could strengthen digital protection rights recognition:

1. Comprehensive digital privacy jurisprudence: Encourage clearer judicial standards for determining privacy violations and compensation.

2. Digital identity protection: Develop stronger safeguards against impersonation, biometric misuse, and identity theft.

3. AI accountability: Establish clearer responsibilities for organisations using automated personal-data processing.

4. Enhanced platform accountability: Improve transparency and complaint-handling requirements for digital intermediaries.

5. Digital evidence standards: Strengthen procedures for preserving electronic evidence and establishing its authenticity.

6. Victim compensation: Improve accessible remedies for individuals affected by large-scale personal-data breaches.

7. Cross-border enforcement: Strengthen cooperation with foreign data-protection authorities.

8. Children's digital rights: Improve safeguards concerning children's personal information and online activities.

14. Conclusion

Civil Law and Digital Protection Rights Recognition in Thailand represents the development of traditional civil rights within the modern digital environment.

The Thai legal framework recognises that individuals require protection not only against physical interference but also against unlawful interference with their privacy, identity, personal information, reputation, and legally protected interests in digital environments.

The most important legal foundations are:

Constitution of Thailand B.E. 2560 (2017).

Personal Data Protection Act B.E. 2562 (2019).

Civil and Commercial Code, particularly Sections 420, 421 and 423.

Computer-Related Crime Act B.E. 2550 (2007), as amended.

Electronic Transactions Act B.E. 2544 (2001).

Consumer Protection Act B.E. 2522 (1979).

The central legal principle is that digital technology does not eliminate an individual's existing civil rights. Where unlawful digital conduct infringes a legally protected interest, Thai law can provide civil, administrative, and criminal remedies, depending on the circumstances.

The principal future challenge is to develop more consistent judicial interpretation of digital rights, particularly in personal-data litigation, artificial intelligence, digital identity, and cross-border information processing.

Research note: The six principal judicial authorities discussed above include direct privacy and digital cases as well as analogous civil precedents. The 2015 privacy judgment and the Chiranuch proceedings are particularly important. The property decisions should be used as general tort-law analogies, not as digital-rights precedents. This distinction is essential for academically accurate legal research.