The NCSA CCTV guidelines are two Thai-language documents: a general book of 163 pages and a second book of 112 pages for cameras that use AI. The foreword says they are non-binding suggestions. This guide helps owners, executives, administrators and buyers decide which book and which chapter to read first, and how the guidelines differ from the PDPA.
- NCSA issued two CCTV guidelines, version 1.0.0 dated 29 September 2026: a general book of 163 pages and an AI book of 112 pages.
- The foreword itself says they are preliminary suggestions without binding force and cannot replace law, contracts or other binding rules.
- Ordinary cameras follow the general book; AI-enabled cameras use it as the baseline and add the AI book.
- Levels B/E/H set how strict the controls should be. They are neither a legal classification nor a critical-infrastructure (CII) designation.
- A shop owner should start with Chapter 1, sections 2.1, 2.3 and 3.1, and Appendix B of the general book.
In late September 2026 the National Cyber Security Agency (NCSA) put out two CCTV guidelines at once. The first covers camera systems in general and runs to 163 pages. The second covers cameras that use AI and runs to 112 pages. Both are version 1.0.0, dated 29 September 2026 (B.E. 2569).
Anyone opening them for the first time asks the same three things. Do I need to read both? I run a small shop, do I have to follow every item? And if I don't, am I breaking the law? This article is a map that answers those questions from the two documents themselves, not from press summaries.
What a workplace must do under the PDPA when it installs cameras, such as signs, retention periods and handing footage to police, is already covered in our article on CCTV in the workplace. This one does not repeat that. It looks at the security of the system itself: passwords, remote access, updates, contractors and procurement.
What legal status do the two NCSA CCTV guidelines have?
They are suggestions, not law. The foreword of both books uses the same wording, and says plainly that the guidelines cannot stand in for any law, notification, rule or contract that is in force.
ทั้งนี้ แนวปฏิบัติทั้งสองฉบับนี้เป็นเพียงข้อเสนอแนะเบื้องต้นให้กับผู้ที่เกี่ยวข้อง ไม่มีสภาพบังคับใช้ ไม่สามารถใช้แทนกฎหมาย ประกาศ หลักเกณฑ์ สัญญา หรือข้อกำหนดอื่นที่มีผลใช้บังคับSection 1.2 of the general book repeats the point under the heading 'status of this document' and adds a priority rule: an organisation that is subject to a specific law or requirement should follow that first.
หากองค์กรอยู่ภายใต้กฎหมาย ประกาศ หลักเกณฑ์ สัญญา หรือข้อกำหนดเฉพาะให้ถือปฏิบัติตามข้อกำหนดดังกล่าวเป็นลำดับแรกIn plain terms, skipping this guideline is not an offence under the guideline. But if another law, a contract or a tender condition covers the same ground, that instrument applies. In practice, documents like this tend to be copied into tender specifications and acceptance tests, which is how they can acquire contractual force. That last point is our own observation, not something the document says.
| General book (TCSG) | AI-enabled CCTV book | |
|---|---|---|
| Length | 163 pages | 112 pages |
| Use it when | Any CCTV system, networked or cloud-based or not | The cameras or the back-end software have AI features such as detection, tracking or face recognition |
| Role | The central framework and security baseline | Adds AI-specific risks and controls on top of the general book |
| Where the level is set | Section 2.1 (four dimensions) | Section 3.1 (three dimensions plus impact amplifiers) |
| Seven-step quick start | Section 3.1 | Section 4.1 |
| Checklists | Appendix A (before handover), Appendix B (periodic self-check) | Appendix A (before handover), Appendix B (periodic self-check) |
Do you need to read both books?
Without AI in the system, the general book is enough. With AI, read the two together, because the general book says in its reading guide that AI systems should use its controls as the base first.
ระบบ CCTV ทั่วไปให้ใช้แนวปฏิบัติฉบับนี้เป็นหลัก สำหรับระบบที่มีความสามารถด้าน AI ให้ใช้มาตรการของแนวปฏิบัติฉบับนี้เป็นค่าตั้งต้นด้านความมั่นคงปลอดภัย และพิจารณาความเสี่ยงและมาตรการเพิ่มเติมตามลักษณะการใช้งานและระดับผลกระทบดังอธิบายในแนวปฏิบัติฉบับที่สองSection 5.2.3 of the general book answers the question capability by capability. The table below condenses it in our words.
| Kind of system | General book | AI book |
|---|---|---|
| Plain viewing and recording | Main reference | Not needed |
| Networked or cloud-connected, no AI | Main reference | Not needed |
| Basic motion detection without AI | Main reference | Consider, depending on how it really works |
| AI that detects, classifies or tracks people, vehicles or objects | Baseline | Use in addition |
| AI licence-plate reading | Baseline | Use in addition |
| Face recognition or biometric processing | Baseline | Use in addition |
| AI results linked to other databases or triggering automatic actions | Baseline | Use in addition, with oversight scaled to impact |
One caution is easy to miss. AI features often arrive bundled with a camera or with software you bought, and the general book warns that owning a feature does not mean you should switch it on.
การมีฟังก์ชัน AI อยู่ในกล้อง ระบบบริหารจัดการวิดีโอ บริการคลาวด์ หรือผลิตภัณฑ์ที่จัดซื้อมา มิได้หมายความว่าองค์กรควรเปิดใช้งานฟังก์ชันดังกล่าวโดยอัตโนมัติFor what the AI book digs into, see our article on face recognition and biometric data in CCTV.
Who are you, and where should you start reading?
Each book opens with a reader table grouped by role, saying what to read as the main material and what to read in addition. The table below merges the two books and rewords them; the section and chapter numbers match the originals.
| You are | General book: main reading | General book: also read | If the system has AI (AI book) |
|---|---|---|---|
| A homeowner with cameras for your own household | Sections 3.1 and 5.1 | Section 2.3 where relevant, and section 3.2.1.7 | Chapters 1–2, sections 3.1 and 4.1 |
| A shop owner or other small business | Chapter 1, sections 2.1, 2.3, 3.1, Appendix B | Sections 3.2.1, 3.4, 5.1 | Chapters 1–3, section 4.1, Appendix B |
| An executive or board member | Chapters 1–2, section 3.1, Chapter 4 | Sections 3.5–3.8, Chapter 5, Appendix B | Chapter 1, section 3.1, Chapter 5 |
| A system administrator or control-room operator | Sections 3.3–3.8, Appendix B | Sections 2.3, 2.4, Chapter 5 | Sections 3.4–3.6, 3.8–3.10, 4.5, Appendix B |
| An installer or system integrator (SI) | Chapter 3, section 4.2, Appendix A | Sections 2.1–2.3, 4.1 | Chapter 4, section 5.2, Appendix A |
| Procurement or an assessor | Chapter 4, Appendices A and D | Sections 2.1–2.3, 3.2.5, Appendix B | Chapter 5, Appendix A |
| A manufacturer or reseller | Sections 3.2.5, 4.1 | Sections 3.3–3.5, 3.7 | Chapter 2, sections 3.4, 3.7, Chapters 4–5 |
| Owner of an old system considering an upgrade | Sections 3.7, 3.1, 2.1 | Sections 3.2.2–3.2.5, 3.5 | Sections 3.1, 3.8, Chapter 4 |
A row for people who handle legal and privacy matters exists only in the AI book, which points them to sections 3.2–3.3 and Chapter 6. If you are in that role and using the general book, sections 2.2 and 2.3 look like the natural start. That is our suggestion; the general book's table has no such row.
The books also note that one person or organisation can hold several roles, for example a shop owner who runs the system and buys it too. In that case read the parts for every role you hold.
If you only have half an hour
- Read section 3.1 of the general book, the seven-step quick start. It is the one page you can act on immediately.
- Read section 2.1 to see whether your system is likely B, E or H (the steps are in our article on levels B/E/H).
- Open Appendix B, the periodic self-assessment, and tick off what you already satisfy.
- If an installer or service provider is involved, send them section 3.1 and Appendix A and ask for answers before you accept the handover.
Does a home user need to read the guidelines or the PDPA?
Anyone can read the guidelines, and the general book includes a starter route for homeowners (sections 3.1 and 5.1). The PDPA, for its part, contains an exemption for cameras used purely for personal or household purposes.
the collection, use, or disclosure of Personal Data by a Person who collects such Personal Data for personal benefit or household activity of such Person only;
Section 2.2.2 of the general book adds that a person using CCTV for personal or family purposes should look at the scope and exemptions of the data protection law, while use for business or organisational purposes brings further legal duties.
ในกรณีที่บุคคลใช้ CCTV เพื่อประโยชน์ส่วนตนหรือกิจกรรมในครอบครัวเท่านั้น ให้พิจารณาขอบเขตและข้อยกเว้นตามกฎหมายว่าด้วยการคุ้มครองข้อมูลส่วนบุคคลSection 2.3 warns that even within the exemption you are not free to publish footage as you please. Releasing images that harm another person's rights, privacy or reputation may breach other laws, so aim cameras only where needed and avoid private areas of other people, such as a neighbour's windows.
How do the guidelines differ from the law?
They differ in who is bound and what is covered. A statute binds the organisations and systems within its scope; the guidelines help you pick controls. The table sets the instruments that section 2.2.2 of the general book lists next to the status of each.
| Instrument | Status | What the guideline says about it |
|---|---|---|
| The two NCSA guidelines | Suggestions; no binding force | Choose controls by risk across the whole system life, from design to retirement |
| Personal Data Protection Act B.E. 2562 (PDPA) | Law; applies where footage identifies a person, subject to the section 4 exemptions | Purpose and basis, notice, use and disclosure, retention, security, data subject rights, breaches, processors |
| Cybersecurity Act B.E. 2562 | Law; applies to organisations and systems within its scope | The guideline stresses that levels B/E/H are not a CII classification |
| Computer Crime Act B.E. 2550 | Law | The guideline warns against assuming every CCTV system has the same log-keeping duty, form or period |
| NCSA Committee notification on cloud security standards B.E. 2567 | Applies where the organisation or system falls within its scope; the guideline says it took effect on 10 September 2026 | To be considered when footage is stored or processed in the cloud; see our cloud security standard article |
| Sector rules and contracts | As each rule or contract provides | For example finance, energy, health, transport, plus SLAs and exit terms with providers |
The clearest example is PDPA section 37 (1), a legal duty on the data controller to put appropriate security measures in place, which the text says must also meet the minimum standard announced by the Committee.
provide appropriate security measures for preventing the unauthorized or unlawful loss, access to, use, alteration, correction or disclosure of Personal Data
Section 37 (1) does not say that a camera must have its default password changed or its firmware patched within so many days. That is the gap an NCSA guideline fills: it shows what appropriate measures can look like for a camera system. If a dispute or inspection arises, the organisation still has to show that its own measures were appropriate. This is our view; the guideline does not discuss its role in disputes.
'Should' and 'must' are not the same word
In the general book's control tables, the Thai term for 'to be observed' marks the main recommended measure at each level, and the book says that anyone choosing another approach should be able to explain why and show the risk is properly managed. A second term, 'to be considered', marks optional extras depending on context.
Section 1.4 of the AI book is more explicit about three verbs. 'Must' is reserved for requirements binding under law, notifications or contracts; 'should' is for recommended measures based on standards or risk assessment; 'may' is for options. So read the verbs closely. A measure marked as to be observed in a table does not carry the weight of a legal 'must'.
What do levels B, E and H mean in short?
They are three degrees of control strictness: Baseline (B), Enhanced (E) and High-Assurance (H). The system owner assesses impact and risk, then reads the control tables at the matching level. A higher level should include the principles of the one below it and add stricter controls, checks or evidence.
ทั้งนี้ การจัดระดับ B/E/H เป็นวิธีการสำหรับกำหนดความเข้มข้นของมาตรการตามแนวปฏิบัติฉบับนี้ มิใช่การจำแนกสถานะทางกฎหมายขององค์กร และไม่สามารถใช้แทนข้อกำหนดตามกฎหมาย ประกาศ สัญญา หรือข้อกำหนดเฉพาะที่มีผลใช้บังคับSection 2.1.2 adds that the grading is not a classification of critical information infrastructure. Whether an organisation counts as critical information infrastructure is a question under the cybersecurity law, not something that follows from scoring H. See Is your company critical infrastructure?
The step-by-step method, with hypothetical examples for a coffee shop, a factory and a condominium, is in our article on levels B/E/H. The short version: the general book tells you to look at impact, not at whether the site is small or large, and a cloud-based system is not placed at any level automatically.
If you start today, what is a sensible order?
Start with the seven items in section 3.1 before reading further. The book calls them a Quick Start for organisations that cannot do the whole chapter at once, and warns that finishing the seven does not replace a risk assessment, especially for systems at levels E and H. The order below is our arrangement of the content of section 3.1.
- TodayList every device (cameras, recorders, apps) and change any default password that is still in placeGeneral book 3.1, item 1
- This weekCheck whether any camera or recorder is reachable directly from the internet; close it if it is not needed and use an approved access routeGeneral book 3.1, item 2
- This weekTurn on multi-factor authentication for admin accounts and remote access where supported; the book makes it 'to be considered' at level B and 'to be observed' at E and HGeneral book 3.1, item 3
- This monthAgree with the installer who follows vulnerability news and who applies updates, and write the name downGeneral book 3.1, items 4 and 7
- This monthWrite down the purpose of each camera, set the retention period and decide how footage is deleted or overwrittenGeneral book 3.1, items 5 and 6
- This quarterAssess your B/E/H level under section 2.1 and open Appendix B to set up the first self-check cycleGeneral book 2.1 · Appendix B
Small businesses without an IT team get a note under the section 3.1 table: the installer or provider should apply the essential security settings before handover, such as changing default credentials, limiting internet access, enabling MFA where supported and setting up updates, then hand the accounts and rights to the owner. If your installer left some of that undone, this note is a good reason to ask them back.
Each step has its own article already, for instance the seven-step quick start for small businesses and the questions to put to a vendor before buying.
The foreword calls them preliminary suggestions without binding force. Liability has to come from a law that actually applies to the business, such as the PDPA.
PDPA section 37 (1) does require appropriate security measures, and customers or buyers often write such guidelines into contracts.
The guideline says B/E/H is not a CII classification and not a classification of the organisation under law.
Section 5.2.2 says having the feature is not a reason to enable it; check purpose, necessity and the impact if the output is wrong.
Frequently asked questions
Are the NCSA CCTV guidelines law?
No. The foreword of both books says they are preliminary suggestions without binding force and cannot replace laws, notifications, rules or contracts that are in force. They also say that an organisation subject to a specific law or requirement should follow that first.
Which book and chapter should a small shop read first?
The reader table in the general book points small businesses to Chapter 1, sections 2.1, 2.3 and 3.1, and Appendix B as main reading, with sections 3.2.1, 3.4 and 5.1 in addition. If the cameras use AI, also open the AI book: Chapters 1–3, section 4.1 and Appendix B.
Are levels B, E and H the same as critical infrastructure (CII) status?
No. Section 2.1.2 of the general book says the grading is not a legal classification of the organisation and not a classification of critical information infrastructure. It only sets how strict the controls should be, and it does not reduce legal duties that already apply.
I use cameras at home. Do the guidelines or the PDPA apply to me?
The guidelines bind no one, but sections 3.1 and 5.1 are written as a starting point for homeowners. PDPA section 4 (1) exempts collection for personal or household activity only, and publishing footage that harms other people may still breach other laws.
Do I need both books if my cameras have AI?
Yes, in practice. The general book is the security baseline and the AI book adds AI-specific risks and measures. Section 5.2.3 of the general book has a table showing which AI capabilities call for the second book.
Law and sources
- Thailand CCTV Security Guidelines (TCSG), version 1.0.0, NCSA (guidance, not law) — Clause 1.2 · Clause 2.1 · Clause 2.2.2 · Clause 2.3 · Clause 3.1 · Clause 5.2
- Thailand AI-Enabled CCTV Security Guidelines, version 1.0.0, NCSA (guidance, not law) — Clause 1.4 · Clause 3.1
- Personal Data Protection Act B.E. 2562 (2019) — Section 4 (1) · Section 37 (1)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)