How long must you keep computer traffic data under Thailand's Computer Crime Act? The minimum retention period for computer traffic data is 90 days from the day it enters the computer system, and Section 26 of the Computer Crime Act B.E. 2550 (2007) puts that duty on service providers. Where necessary, an official can order a specific provider to keep it longer, up to 2 years, case by case. The provider must also keep the data needed to identify each user from the start of service until at least 90 days after the service ends. Breaching Section 26 carries a fine of up to 500,000 baht.
A co-working space owner offered free Wi-Fi to members. One day an official asked for two months of usage records to trace someone behind an online offence, but the router kept logs for only seven days and nobody could say who had used which device.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Keep computer traffic data for at least 90 days from the day it enters the computer system.
- An official may order a particular provider to keep it beyond 90 days, up to 2 years, as a one-off special case.
- User identification data must be kept from the start of service until at least 90 days after the service ends.
- Which types of provider are covered, how and from when is set by a ministerial notification in the Royal Gazette.
- Failing to comply with Section 26 can mean a fine of up to 500,000 baht.
How to do it in 7 steps
Work through these 7 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Check whether you are a covered service providerSection 26, paragraph three, leaves it to a ministerial notification to say which types of provider must keep data, how and from when. Read that notification against the services you offer to others.
- Map every way people use your systemsList each access point, such as guest Wi-Fi, VPN, email, websites and apps with user logins, so you know which systems must produce logs.
- Turn on complete, time-synced loggingA good practice is for logs to show who connected, when, from which device or address and to which service, with every system's clock kept in sync.
- Capture user identity from day oneKeep only the user data needed to identify each user from the start of service, and hold it for at least 90 days after the service ends, as Section 26, paragraph two, requires.
- Set retention to at least 90 daysConfigure systems or archive storage to keep traffic data for at least 90 days from entry, and have a way to pause deletion in case an official orders retention of up to 2 years.
- Protect logs from tampering and leaksA good practice is to limit who can read logs, store them away from systems users can reach, and record every time logs are viewed or exported.
- Review and dispose on scheduleLogs often link back to individuals. A good practice is to set review dates, delete logs once they are no longer needed, and record each disposal.
How long must computer traffic data be kept?
At least 90 days from the day the data enters the computer system, under Section 26, paragraph one, of the Computer Crime Act B.E. 2550 (2007). Where necessary, an official may order a particular provider to keep it beyond 90 days but not beyond 2 years, as a one-off order for that provider.
User data needed to identify a user must be kept from the start of service and for at least 90 days after the service ends, under Section 26, paragraph two.
Which service providers must keep traffic data under Section 26?
Section 26, paragraph three, says the duty applies to the types of service provider, in the manner and from the time set by a ministerial notification published in the Royal Gazette. Whether your business is covered is answered by that notification, not by Section 26 alone.
If your business lets other people use the internet or a computer system, such as customer Wi-Fi or an online platform with user logins, a good practice is to check the ministerial notification with a lawyer before you launch the service.
What is the penalty for not keeping traffic logs?
A service provider that fails to comply with Section 26 faces a fine of up to 500,000 baht under the last paragraph of that section. Beyond the fine, missing logs leave a business unable to explain who did what on its systems when an incident happens.
How does Section 15 affect service providers?
Section 15 says a service provider that cooperates in, consents to or knowingly allows an offence under Section 14 on a computer system under its control faces the same penalty as the person who commits that offence.
The Minister issues a notification setting out the procedure for notice, suppressing the spread of computer data and removing it from the system. A provider that proves it followed that notification is not punished, so complete logs help show that you actually followed the procedure.
Common problems and how to fix them
Most organisations slip on the same 4 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ The router or firewall deletes logs automatically after a few days. | ✓ Send logs to central storage and keep them for at least 90 days from entry. Then set a retention rule in AIPDPA with review dates and disposal records, so you can prove the full period was kept. |
| ✗ Logs exist but cannot identify anyone, because everyone shares one Wi-Fi password. | ✓ Section 26, paragraph two, requires data that identifies each user from the start of service. A good practice is individual registration or login, recorded alongside your other measures in AIPDPA's security controls register. |
| ✗ Routine deletion runs even though an official ordered longer retention. | ✓ A Section 26 order can extend retention to 2 years for a specific provider. Record the order, freeze deletion of that data set at once, and give it its own retention rule in AIPDPA so the normal cycle does not wipe it. |
| ✗ Keeping logs forever, just in case. | ✓ Logs often link back to individuals, so keeping them longer than needed raises the stakes in a data leak. A good practice is a clear end date, and AIPDPA's retention rules keep the review schedule and disposal log in one place. |
Set log retention once, and have the evidence ready when asked
AIPDPA puts a security controls register mapped to PDPC guidance, the ETDA framework and NCSA standards next to retention rules, review schedules and disposal logs. See the demo account, no sign-up needed; plans from 2,900 THB a year (no VAT added).
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
How many days of logs does the Thai Computer Crime Act require?
A service provider must keep computer traffic data for at least 90 days from the day it enters the computer system, under Section 26 of the Computer Crime Act B.E. 2550 (2007).
What is the longest an official can order logs to be kept?
Up to 2 years. Section 26 lets an official order a specific provider to keep data beyond 90 days where necessary, as a one-off special case.
What is the fine for not keeping computer traffic data in Thailand?
A service provider that fails to comply with Section 26 can be fined up to 500,000 baht.
How long must user identification data be kept?
From the start of service until at least 90 days after the service ends, under Section 26, paragraph two.
Does a shop offering free customer Wi-Fi have to keep logs?
It depends on whether the business is a type of service provider named in the ministerial notification, because Section 26, paragraph three, leaves the types, method and start date to that notification. If unsure, a good practice is to turn logging on and check with a lawyer.
Is a service provider liable for offences users commit on its system?
Under Section 15, a provider that cooperates in, consents to or knowingly allows a Section 14 offence on its system faces the same penalty as the offender. A provider that proves it followed the ministerial notice-and-removal notification is not punished.
Sources
This guide relies on 2 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Computer Crime Act B.E. 2550 (2007), as amended by Act No. 2 B.E. 2560 (2017), Section 26
- Computer Crime Act B.E. 2550 (2007), as amended by Act No. 2 B.E. 2560 (2017), Section 15
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
PDPC, ETDA and NCSA requirements in one place — do the work once, evidence several standards.
Join the waitlist →Retention rules, review schedules and disposal logs — the Section 37(3) evidence auditors always ask for.
Join the waitlist →News and analysis on tech law as it happens worldwide.
Read the latest →Courses to build PDPA, DPO and AI-governance skills, plus ready-to-use digital toolkits.
See courses & products →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.