Taking a customer list and source code when you quit is trade secret infringement under Section 6 of Thailand's Trade Secrets Act, if the information meets Section 3: not generally known, valuable because secret, and protected by appropriate measures. This is for business owners and legal teams who learn that an interim injunction is available (Section 8) and that a PDPC notification within 72 hours must also be assessed.
- A trade secret needs three things: not generally known, valuable because secret, and protected by appropriate measures (Section 3).
- Disclosing, taking or using it without consent, contrary to honest trade practices including breach of contract, is infringement (Section 6).
- An interim injunction can be sought before suit (Section 8); claims expire 3 years after discovery, 10 years at most (Section 10).
- Accounts left open after an employee leaves expose both a computer crime offence and a gap under the PDPC security notification.
- If personal data was taken, assess the breach and notify the PDPC Office within 72 hours of awareness unless there is no risk (PDPA s.37(4)).
Picture a distribution company whose sales manager hands in his resignation. A month later, several long-standing customers start receiving quotes from a competitor. IT pulls the logs and finds that two days before he resigned, his account downloaded the full customer list from the CRM, with customer-specific pricing.
Management's first question is "can we sue?" Two other questions come first: is this data a trade secret in law, and what does the company itself owe, as the controller of its customers' personal data?
This article sets four Thai laws side by side: the Trade Secrets Act B.E. 2545 (2002), the Computer-Related Crime Act B.E. 2550 (2007), the Personal Data Protection Act B.E. 2562 (2019) with its notifications, and the Copyright Act B.E. 2537 (1994) for source code. It ends with an exit checklist that HR and IT can run together.
Is a customer list a trade secret under Thai law?
It can be, but not automatically. Section 3 of the Trade Secrets Act defines "trade information" widely enough to cover customer lists and source code, because it includes compilations and programs.
It shall also include formulas, patterns, compilations or assembled works, programs, methods, techniques, or processes.
To become a "trade secret", that information must then pass three tests in the next definition of the same section.
trade information not yet publicly known or not yet accessible by persons who are normally connected with the information. The commercial values of which derive from its secrecy and that the controller of the trade secrets has taken appropriate measures to maintain the secrecy.
Companies most often lose on the last test, "appropriate measures to maintain the secrecy". If the customer list lives in a spreadsheet passed around a company-wide chat group, anyone can download it and nobody was ever told it is confidential, it is hard to argue that the company has treated it as a secret all along.
Names that anyone can find in a directory or on customers' own websites may fail the first test as well. What usually has a better chance is the information the company built up itself: negotiated prices per customer, order histories, the real decision-makers and their buying cycles.
What counts as infringing a trade secret?
Disclosing, taking or using it without consent, in a manner contrary to honest trade practices, by someone who knows or should know that. Section 6 puts it this way:
The infringement of trade secret rights under this Act are the act of disclosure, deprivation or usage of trade secrets without the consent of the owner in a manner contrary to honest trade practices. In so doing, the infringer must be aware of or has reasonable cause to be aware that such act is contrary to honest trade practices.
Acts contrary to honest trade practices under paragraph one shall include breach of contract, infringement or inducement to infringe confidentiality, bribery, coercion, fraud, theft, receiving of stolen property or espionage through electronics or other means.
Because breach of contract is listed expressly, employment contracts and confidentiality agreements carry real weight. They are the evidence that the employee knew the information was not his to take.
Section 7 lists acts that are not infringement, including independent discovery through one's own skill and reverse engineering of a product obtained in good faith, unless the parties expressly agreed otherwise. General know-how an employee carries away in his head is therefore a different matter from files he downloads on the way out.
What can the company ask a court for, and how fast must it move?
The quickest tool is an interim injunction, which Section 8 paragraph two allows before the main action is filed. The precondition is clear evidence.
Where there is clear evidence that an infringement of trade secrets has been committed or is imminent, the affected or imminently to be affected controller of trade secrets has the following remedies: (1) Petition the court for an interim injunction, temporarily to stop the infringement of trade secrets; and,
- A permanent injunction and damages under Section 8(2), with a request that the court order destruction or confiscation of the tools used in the infringement under Section 11.
- Damages may include an account of the infringer's profits under Section 13(1), and where there is clear evidence of wilful or malicious infringement that destroyed the secrecy, punitive damages of up to twice the base award under Section 13(3).
- Mediation: before using Section 8, the parties may agree to refer the dispute to the Trade Secrets Board under Section 9.
- Limitation: no action after 3 years from knowing of the infringement and the infringer, and never more than 10 years from the infringement, under Section 10.
- Criminal liability: disclosing another's trade secret to the public so that it ceases to be secret, with malicious intent to damage the business, carries up to 1 year's imprisonment, a fine of up to 200,000 baht, or both, under Section 33; it is a compoundable offence under Section 37.
Note that the criminal offence in Section 33 is limited to malicious public disclosure. When a departing employee quietly uses a customer list to win business for a new employer, the main tools are civil, under Sections 8 to 13, and they depend on evidence the company collected before anything went wrong.
When does the Computer-Related Crime Act apply?
Most clearly when someone gets into a system or data with access that is not theirs, for example logging in after leaving the company. Section 5 covers illegal access to a computer system; Section 7 covers illegal access to computer data.
Whoever illegally accesses to a computer data that has specific security measures which are not intended for his/her use, shall be liable to an imprisonment for a term not exceeding two years, or a fine not exceeding Forty Thousand Baht or both.
Read the phrase "not intended for his/her use" slowly. Whether a current employee who downloads data with his own password, within the rights the company gave him, falls under Section 7 depends on the facts of each case. Using an old account after leaving, or a colleague's password, sits much closer to the wording of Sections 5 and 7.
Another common pattern is deleting work on the way out. Section 9 penalises illegally damaging, deleting, altering or adding to another person's computer data, with up to 5 years' imprisonment, a fine of up to 100,000 baht, or both. Section 5 carries up to 6 months, up to 10,000 baht, or both.
If the data meets Section 3, taking it without consent and in breach of contract falls under Section 6. Whether Section 7 of the Computer Crime Act applies depends on whether he exceeded the access the company granted. On the PDPA side, a breach assessment is needed.
Access was not intended for someone who has left, close to the wording of Sections 5 and 7. The company also failed to de-register the user under Clause 4(6)(b) of the PDPC security notification.
Illegally damaging, deleting or altering another person's computer data, in whole or in part.
Section 9 of the Copyright Act vests copyright in an employee's work in the employee unless otherwise agreed in writing. Trade secret protection for the code is a separate question under Sections 3 and 6.
Section 7(4) exempts reverse engineering of a product obtained in good faith, unless the parties expressly agreed otherwise.
Who owns the copyright in source code an employee writes?
Unless agreed in writing, the employee who wrote it. This surprises many companies. A computer program is a literary work under the definitions in Section 4 of the Copyright Act, and Section 9 sets the rule for employees' work:
Copyright in the work created by the author in the course of employment vests in the author unless it has been otherwise agreed in writing, provided that the employer is entitled to communicate such work to the public in accordance with the purpose of the employment.
The fix belongs on the day the employment contract is signed, not the day someone resigns: a written agreement that copyright in work created in the course of employment belongs to the company. See the employee copyright guide. Protecting code as a trade secret is a separate layer that works alongside it; see the guide to protecting trade secrets.
If the data taken is personal data, what does the company owe?
The company is the victim and the data controller at the same time. A customer list with names, phone numbers and email addresses is personal data, and the PDPA does not suspend the controller's duties just because the wrongdoer was its own employee.
The PDPC's 2022 Notification on breach notification defines a personal data breach broadly enough to cover deliberate acts and acts without authority.
a breach of security measures resulting in the loss of, access to, use of, alteration of, correction of, or disclosure of personal data without authority or unlawfully, whether arising from intent, wilfulness, negligence, an act without authority or unlawful act, a computer-related offence, a cyber threat, an error, defect or accident, or any other cause.
Where the definition is met, Section 37(4) of the PDPA requires notice to the Office of the Personal Data Protection Committee without delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people's rights and freedoms. If the risk is high, the affected customers must also be told, with the remedial measures.
notify the Office of any Personal Data breach without delay and, where feasible, within 72 hours after having become aware of it, unless such Personal Data breach is unlikely to result in a risk to the rights and freedoms of the Persons.
In practice the 72 hours run from when the company becomes aware, which may be the moment IT sees the download log, not when counsel decides whether to sue. The two workstreams have to run in parallel. The first hours are laid out in The first 72 hours after a breach and the 72-hour notification guide.
That notification speaks to employees directly. Clause 4(6) requires user access management including de-registration, and defined user responsibilities that cover surreptitious copying.
The determination of user responsibilities in order to prevent access, use, alteration, correction, deletion or disclosure of personal data without authority or unlawfully, including cases of acts beyond the assigned role and duties, as well as the surreptitious copying of personal data without authority or unlawfully, and the theft of equipment used to store or process personal data.
Clause 4(6)(b) covers registering and de-registering users, reviewing access rights, and removing or adjusting them. Clause 4(6)(d) requires audit trails of access, alteration and deletion. Clause 5 paragraph two deems a breach to trigger a review of the security measures, unless the breach carries no risk.
Insider leaks are not only file downloads. Staff pasting customer data into outside AI tools is the same pathway; see Staff paste customer data into ChatGPT: four laws.
Exit checklist: what to do, and in what order
This sequence is built to produce two things at once: evidence of "appropriate measures" under Section 3 of the Trade Secrets Act, and compliance with the PDPC security notification.
- Day one of employment (before anything happens)Sign a written confidentiality agreement and a copyright assignment, label key data as confidential, and grant access on a need-to-know basis.Trade Secrets s.3, s.6 · Copyright s.9 · PDPC Clause 4(6)(a)
- The day the resignation arrivesList the systems and data the employee can reach, cut access not needed for remaining work, and remind them in writing of continuing confidentiality duties.PDPC Clause 4(6)(b), (c)
- During the notice periodReview download, export and forwarding logs, and preserve copies of the logs unaltered as evidence.PDPC Clause 4(6)(d)
- Last working dayClose every account, including cloud services and apps registered with the company email, rotate shared passwords, and collect devices and storage media.PDPC Clause 4(6)(b) · Computer Crime s.5, s.7
- 1 to 7 days after departureCheck the logs again. If personal data left with the employee, assess the risk immediately, because the 72 hours run from awareness.PDPA s.37(4) · Breach Notification Clause 3
- When misuse is foundGather evidence, consider an interim injunction (available before suit), and track the 3-year limitation from knowing the infringer.Trade Secrets s.8, s.10
- After the matter closesReview the security measures and record what was changed.PDPC Clause 5, paragraph two
The step most often missed is account closure, because accounts are spread across many systems and nobody holds the full list. AIPDPA maps its security controls to the PDPC standard so you can track which are in place, and its breach register counts down 72 hours from awareness with a decision helper on who must be notified, with a person confirming every decision. See the demo account.
Frequently asked questions
Is a customer list always a trade secret in Thailand?
No. Under Section 3 of the Trade Secrets Act B.E. 2545 (2002), the information must not be generally known or accessible in the trade, must have commercial value because it is secret, and the company must have taken appropriate measures to keep it secret. A list drawn from public sources, or one anyone in the company could download, is hard to defend.
An ex-employee took customer data. Do we have to notify the PDPC?
You have to assess it. The definition of a personal data breach in Clause 3 of the 2022 breach notification covers unauthorised access, use or disclosure arising from intent. If the definition is met and there is a risk to the customers, notify the PDPC Office within 72 hours of becoming aware under Section 37(4) of the PDPA.
Can we get a court order to stop the use before filing a lawsuit?
Yes. Section 8 of the Trade Secrets Act lets the controller of a trade secret petition the court for an interim injunction where there is clear evidence of infringement, and Section 8 paragraph two allows that petition before the main action for an injunction and damages.
What offence is it if a former employee logs in with an old account?
It may fall under Section 5 (illegal access to a computer system) and Section 7 (illegal access to computer data) of the Computer-Related Crime Act, because the access measures were no longer intended for someone who has left. The company should also have revoked access on the last day under Clause 4(6)(b) of the PDPC security notification.
Does the company own the copyright in code its employees write?
Under Section 9 of the Copyright Act B.E. 2537 (1994), copyright in work created in the course of employment vests in the employee unless otherwise agreed in writing; the employer may communicate the work to the public in line with the purpose of employment. Put a written agreement in place from day one.
Law and sources
- Trade Secrets Act B.E. 2545 (2002), as amended up to Act No. 2 B.E. 2558 (2015) — Section 3 · 6 · 7 · 8 · 9 · 10 · 11 · 13 · 33 · 37
- Computer-Related Crime Act B.E. 2550 (2007), as amended — Section 5 · 7 · 9
- PDPC Notification on Security Measures of Data Controllers B.E. 2565 (2022) — Clause 4 (6) (b) (c) (d) · Clause 5
- PDPC Notification on Criteria and Procedures for Personal Data Breach Notification B.E. 2565 (2022) — Clause 3
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (4)
- Copyright Act B.E. 2537 (1994) — Section 9
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)