Cybersecurity articles
Cybersecurity articles are 11 AIPDPA pieces that quote Thai law word for word and say what organisations must do. They suit DPOs, legal teams and business owners, who get answers with the legal text and links to read further.
Cybersecurity
CybersecurityViewing CCTV on your phone: fix factory passwords and P2P first
A camera you can watch from outside the building is a camera with a way in from outside. The NCSA 2026 guideline says to close the factory-password gap, govern P2P and segment the network. This article compares realistic options for homes and shops.
CybersecurityWho can open CCTV footage, and who opened it when?
The NCSA's 2026 guideline asks you to answer who can reach what, what they can do and what proof exists. This article also explains why the Computer Crime Act does not tell every CCTV system to keep logs.
CybersecurityRepair, compensate or replace an old CCTV system?
The NCSA's 2026 guideline says age alone should not decide it, and that images and credentials left on a recorder must be dealt with before it goes in the bin.
CybersecurityIs your CCTV system level B, E or H? How to rate it
The NCSA guideline has the system owner rate impact on four dimensions, not look at shop size or site type. Hypothetical examples for a coffee shop, a factory and a condominium, with a warning that the level is not a CII classification.
CybersecurityTwo NCSA CCTV guidelines: which one to read first
One runs to 163 pages, the other to 112, and neither is binding. Still, installers, buyers and auditors may start using them as benchmarks. Here is where a shop owner, an executive, an administrator or an AI user should open each one.
CybersecurityBuying CCTV for an organisation: contract and acceptance
Chapter 4 of the 2026 NCSA guideline is not binding, but it tells buyers to write testable requirements, ask for matching evidence and accept the system before going live. Here is the list, ready to use.
CybersecurityIs Your Company Critical Information Infrastructure?
Nobody becomes a critical information infrastructure organisation by self-assessment. But once you are one, the duties come with fixed deadlines, and some of them flow down to the IT contractors who work for you.
CybersecurityOne Security Checklist for Both PDPC and NCSA Rules
The PDPC's 2022 security notification and the NCSA's 2023 minimum standard speak different dialects, but they ask for the same things more often than you would think. This article lines them up topic by topic and merges them into one checklist.
CybersecurityRansomware Has Hit: What Three Thai Laws Require, and in What Order
Every file is locked and a ransom note is on the screen. Who needs to know first? The PDPA says the PDPC Office. The Cybersecurity Act adds a separate report for some organisations. The Computer-Related Crime Act makes the company a victim of a crime. Here is how the three fit together, and how far backups really help.
CybersecurityClassifying systems step by step under Thailand's 2023 security classification standard
Before you know which controls a system needs, you have to rate it low, medium or high. The 2023 notification of Thailand's National Cybersecurity Committee gives the full method in dense legal language. Here it is step by step, with four example systems.
CybersecurityDoing IT work for critical infrastructure: what to prepare before you sign
Thailand's Cybersecurity Act puts the duties on critical infrastructure operators, not their vendors. The requirements still reach you, through the contract, remote access rules, training and recovery plans. How heavy they get depends on the level of the system you touch.
Topic index
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)