Thailand Recording Laws: One-Party Consent, PDPA, and Penalties (2026)

Quick Answer: Is Thailand a One-Party Consent Country?

Thailand is generally treated as a one-party consent jurisdiction in legal practice, meaning a participant in a conversation may record it without the other party's knowledge. No Thai statute expressly criminalizes a person from recording a conversation in which they are participating. However, that practitioner consensus sits alongside significant legal complexity: the Personal Data Protection Act B.E. 2562 (2019) classifies voice recordings as personal data and requires a lawful basis (usually consent) for their collection, and the 2017 Constitution protects communication secrecy under Section 36.

The practical rule is this. Recording a call or conversation you are part of is not criminally prohibited, but sharing that recording without consent can trigger PDPA liability, Criminal Code Section 323 (professional secrets), or criminal defamation under Section 326. Recording a conversation you are not part of is a separate matter: intercepting communications between other parties violates Section 36 of the Constitution and potentially Section 8 of the Computer Crime Act.

For participants, the safest posture is to inform the other party that recording is occurring, or to document a clear legitimate interest. This article explains each layer of the framework in detail.

---

This article addresses recording law in Thailand under the Constitution of the Kingdom of Thailand B.E. 2560 (2017), the Criminal Code B.E. 2499 (1956), the Criminal Procedure Code, the Personal Data Protection Act B.E. 2562 (2019), the Computer-Related Crime Act B.E. 2550 (2007, amended 2017), and the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes No. 2 B.E. 2568 (2025). It does not constitute legal advice. Readers with specific legal questions should consult a Thai-licensed attorney.

---

Constitutional Privacy Protections

The Constitution of the Kingdom of Thailand B.E. 2560 (2017) establishes the foundation for all recording and privacy law in Thailand. Two sections matter most.

Section 32: Right to Privacy

Section 32 states that every person enjoys the right to privacy, dignity, reputation, and family. It goes further: any act that violates or affects these rights, or any exploitation of personal information "by any means whatsoever," is prohibited unless authorized by a law enacted specifically for the public interest.

This is broad language. It does not mention recordings specifically, but courts have interpreted it to cover audio recording, video surveillance, and the collection of personal data. The phrase "by any means whatsoever" is the operative clause that pulls recording activity into constitutional territory.

The practical effect is that recording someone without a lawful basis can be framed as a constitutional violation. However, Section 32 is not self-executing in the way a criminal statute is. You cannot be arrested solely for violating Section 32. Instead, it provides the legal foundation that other laws build on.

Section 36: Liberty of Communication

Section 36 protects the liberty of communication by any means. Censorship, detention, or disclosure of information communicated between persons is prohibited. So is "any commission of an act carried out to know or obtain information communicated between persons."

The exception: a court order, or grounds prescribed by law.

This section is the closest Thailand comes to a constitutional wiretapping prohibition. Intercepting a phone call, reading private messages, or recording a conversation between two other people all fall within its scope. But again, enforcement runs through other statutes.

---

Criminal Code Sections 322-325: Disclosure of Secrets

The Criminal Code B.E. 2499 (1956) contains four sections that address the disclosure of private information. These are not recording laws in the strict sense, but they criminalize conduct that often accompanies unauthorized recording.

Section 322: Opening Private Correspondence

Anyone who breaks open, takes away, or intercepts sealed letters, telegrams, or documents belonging to another person, with the intent to learn or disclose their contents, faces imprisonment of up to six months, a fine of up to THB 1,000, or both. The act must be "likely to cause injury" to qualify.

While Section 322 was written with physical mail in mind, Thai legal scholars have argued it extends to electronic communications by analogy. Courts have not uniformly adopted this interpretation, which is one reason the legal landscape remains unclear. The THB 1,000 maximum fine reflects the statute's 1956 enactment and has not been legislatively updated; in practice, PDPA administrative fines and Computer Crime Act penalties are the more significant financial exposure.

Section 323: Professional Confidentiality

This section targets professionals who learn secrets through their work. Doctors, pharmacists, midwives, lawyers, auditors, and priests who disclose private information acquired through their professional duties can face the same penalties as Section 322: up to six months in prison, a fine of up to THB 1,000, or both.

The relevance to recording is indirect but real. A doctor who records a patient consultation and shares it, or a lawyer who records a client and leaks the recording, would face liability under Section 323 in addition to any privacy claims.

Section 324: Trade and Industrial Secrets

Section 324 covers anyone who, through a duty or position of trust, learns a trade secret, scientific discovery, or industrial invention and then discloses or uses it for personal benefit or for the benefit of another person. The penalties mirror Sections 322 and 323.

This section matters for workplace recordings. An employee who records proprietary business discussions and shares them with a competitor could face prosecution under Section 324.

Section 325: Unauthorized Commercial Disclosure

Section 325 extends the professional-secrets liability of Section 323 to former officials and employees who disclose secrets acquired during their service for personal commercial benefit. Penalties are the same as the other sections in this cluster. Together, Sections 322 through 325 create overlapping exposure for anyone who records and then monetizes or distributes private information.

---

Criminal Procedure Code: Sections 226 and 226/1

These two sections of the Criminal Procedure Code determine whether recordings can be used as evidence in Thai criminal courts. They are among the most consequential provisions for anyone considering whether to make a secret recording.

Section 226: The Exclusionary Rule

Section 226 establishes that material evidence, documentary evidence, or personal evidence may be admitted in court to prove guilt or innocence. However, such evidence must not have been obtained through inducement, promises, threats, deception, or "other improper means."

Thai courts have interpreted "other improper means" to include recordings made in violation of privacy rights. If a recording was obtained by planting a hidden device in someone's home, or by intercepting a phone call without authorization, Section 226 provides grounds for exclusion.

The exclusionary rule in Thailand functions differently from its American counterpart. In the U.S., the exclusionary rule is rooted in the Fourth Amendment and applies primarily to government actors. In Thailand, Section 226 can apply to evidence gathered by private citizens as well.

Recent Supreme Court decisions reinforce this. In Supreme Court Judgment No. 8575/2563, the court ruled that a secret audio recording made without the other party's knowledge was unlawfully obtained and therefore inadmissible in a criminal defamation prosecution. Supreme Court Judgment No. 3782/2564 reached the same conclusion in a private prosecution case, holding that the recording violated the opposing party's privacy rights under Section 32 of the Constitution.

Section 226/1: The Balancing Exception

Section 226/1 creates a critical exception. Even when evidence was obtained improperly or illegally, the court may still admit it if doing so "will be more beneficial to the administration of justice than the harm caused by the impact on the standards of the criminal justice system or the basic rights and freedoms of the people."

This is a balancing test. The court weighs the value of the evidence against the severity of the rights violation. In practice, courts are more likely to admit secretly recorded evidence in cases involving serious crimes, such as corruption, human trafficking, or organized crime, where other evidence is difficult to obtain.

Section 226/1 gives Thai judges significant discretion. There is no bright-line rule about when a recording will or will not be admitted. Each case turns on its facts.

---

Recordings as Evidence: Criminal vs. Civil Courts

The treatment of recorded evidence in Thailand depends heavily on whether the case is criminal or civil. The two systems apply different standards.

Criminal Proceedings

In criminal cases, the default position is that secretly recorded evidence is inadmissible under Section 226. The prosecution bears a high burden to justify the use of improperly obtained evidence, and courts apply the Section 226/1 balancing test cautiously.

That said, when a recording captures evidence of a serious offense and no other evidence is available, courts have admitted it. The decision is always case-specific. Defense attorneys routinely challenge secretly recorded evidence on constitutional grounds, citing Sections 32 and 36 of the Constitution. The 2020 and 2021 Supreme Court decisions discussed above (Judgments 8575/2563 and 3782/2564) confirm that courts take this challenge seriously in criminal defamation and private prosecution matters.

Civil Proceedings

Civil courts in Thailand are more receptive to recorded evidence. The Thai Supreme Court has accepted secret recordings in civil disputes on multiple occasions. In Supreme Court Judgment No. 4674/2543, the court allowed a secret recording because no law explicitly prohibited it in the civil context and the evidence helped resolve the dispute.

Similarly, Supreme Court Judgment No. 3911/2534 accepted a secretly recorded conversation as admissible evidence in a civil case.

The takeaway: if you have a civil dispute in Thailand and possess a recording that supports your claim, courts are more likely to consider it. But the recording could still expose you to separate criminal or civil liability for making it in the first place.

---

The Personal Data Protection Act (PDPA)

The PDPA B.E. 2562 (2019) is Thailand's most significant privacy legislation. It came into full force on June 1, 2022, and it has reshaped the legal landscape for recording in both personal and commercial contexts.

The PDPA applies to the collection, use, and disclosure of personal data. A voice recording, a video recording, or a photograph that identifies a specific individual all qualify as personal data under the Act.

Consent Requirements Under the PDPA

Section 19 of the PDPA states that a data controller shall not collect, use, or disclose personal data unless the data subject has given prior consent. Consent must be:

• Explicit: Given in writing or through an electronic system.
• Informed: The data subject must understand what data is being collected and why.
• Freely given: Consent obtained through coercion or deception is invalid.
• Withdrawable: The data subject can revoke consent at any time, and withdrawal must be as easy as giving consent.

Consent is not the only lawful basis. Sections 24 and 26 of the PDPA enumerate six grounds on which a data controller may process personal data without consent: performance of a contract, vital interests, legitimate interests (where the controller's interests do not override the data subject's rights), compliance with a legal obligation, public interest, and research. The legitimate-interest ground has attracted attention from legal commentators as a potential basis for participant recordings made to protect one's own legal rights, but the PDPC has not issued binding guidance specifically on this point.

The PDPA also imposes special restrictions on sensitive personal data, which includes information about race, ethnicity, political opinions, religious beliefs, health, and criminal records. If a recording captures sensitive data, explicit consent is mandatory unless a specific exception applies.

PDPA Penalties

The penalties for PDPA violations are substantial and come in three categories:

• Administrative fines: Up to THB 5 million per offense (approximately USD 145,000).
• Criminal penalties: Imprisonment of up to six months and fines of up to THB 500,000 for unauthorized use or disclosure of personal data. If the violation was committed for commercial gain, the penalties double to up to one year in prison and THB 1 million in fines.
• Civil liability: Affected individuals can sue for actual damages, and courts may award punitive damages of up to twice the actual damages.

PDPA Enforcement Activity

Enforcement was slow in the PDPA's early years, but it has accelerated significantly. On August 1, 2025, the Personal Data Protection Committee issued eight administrative fines across five cases in a single day, with total cumulative fines reaching approximately THB 21.5 million. The largest single fine was THB 7 million, imposed on a computer and equipment retailer for three violations: failure to implement appropriate security measures, failure to notify the PDPC of a data breach within 72 hours, and failure to appoint a Data Protection Officer.

Other August 2025 cases included a government agency fined THB 153,120 for a data breach affecting over 200,000 citizens, a private hospital fined THB 1.21 million for improper document destruction that allowed patient records to be leaked externally, and a cosmetics company fined THB 2.5 million for security failures.

For 2026, the PDPC has publicly named four sectors as enforcement priorities: e-commerce, healthcare, telecommunications, and public services. Businesses in those sectors that record calls, operate surveillance systems, or process customer data without proper consent frameworks should expect heightened scrutiny.

Emergency Decree on Technology Crimes No. 2 (April 2025)

A significant development postdating the existing page is the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes No. 2 B.E. 2568 (2025), which took effect on April 13, 2025. The decree introduces new criminal offenses targeting the misuse of personal data in connection with technology crimes. Individuals may be held criminally liable not only for using personal data to commit a tech crime but also for collecting, possessing, or disclosing that data with the intent to enable criminal activity. Penalties are up to one year imprisonment and a THB 100,000 fine for general violations, and up to five years imprisonment and a THB 500,000 fine for commercial misuse.

Cross-Border Data Transfer Rules

On December 25, 2023, the PDPC published two subordinate regulations governing the cross-border transfer of personal data: the Whitelist Notification (listing countries with adequate protection) and the Binding Corporate Rules and Appropriate Safeguards Notification. Both came into force on March 24, 2024.

These rules are relevant to any organization that records data in Thailand and transfers those recordings to servers or personnel outside the country. The permitted transfer mechanisms are: (1) an adequacy decision for the destination country; (2) binding corporate rules; or (3) standard contractual clauses or other appropriate safeguards. Organizations that transfer recordings without using one of these mechanisms risk PDPA violation.

---

Computer Crime Act and Electronic Surveillance

The Computer-Related Crime Act B.E. 2550 (2007), amended in 2017, addresses electronic surveillance and interception in the digital realm.

Section 8 of the Act criminalizes anyone who illegally intercepts computer data being transmitted through a computer system that is not intended for public access. The penalty is imprisonment of up to three years, a fine of up to THB 60,000, or both.

The 2017 amendments expanded investigatory powers, allowing authorities to use the Act's provisions for any criminal offense that involves computer systems. Service providers may be required to retain user data for up to two years, and authorities can access traffic data without a court order to assist investigations.

Section 18 of the amended Act has been interpreted broadly. While it does not explicitly reference "interception," legal analysts have noted it may encompass direct interception of communications, compelled interception assistance from service providers, and direct access to network operators' systems.

The 2025 Emergency Decree (No. 2) extends this framework further: mobile network operators, telecommunications service providers, and other relevant businesses may be required to transmit customer and transaction data to a centralized government platform when suspected cybercrime is involved.

For individuals, the Computer Crime Act means that intercepting digital communications, recording VoIP calls without authorization, or accessing someone's electronic messages without permission can result in criminal prosecution under Section 8.

---

Recording Phone Calls in Thailand

Thailand does not have a specific statute that addresses the legality of recording phone calls between private parties. There is no formal "one-party consent" or "two-party consent" framework like those found in the United States or Australia. However, the practitioner consensus is that a participant in a phone call may record it without creating criminal liability, because no Thai statute expressly prohibits a party from recording their own conversation.

The legal analysis turns on several factors:

• Participant status: Recording a call you are part of is significantly less likely to create criminal liability than intercepting a call between two other people. Third-party interception violates Section 36 of the Constitution and Section 8 of the Computer Crime Act.
• Purpose: Recording for self-protection, to preserve evidence of a legal claim, or for a legitimate business purpose carries more weight than recording for gossip, harassment, or commercial exploitation.
• PDPA compliance: Even a lawful participant recording triggers PDPA obligations. The recording constitutes collection of personal data. Consent is the clearest lawful basis. Legitimate interest may also apply where the recording is necessary to protect a right or defend a legal claim, but this analysis should be documented.
• Disclosure: Sharing the recording is where liability most commonly arises. Publishing or distributing a recording without justification may trigger PDPA penalties, Criminal Code Section 323 (if professional secrets are involved), or criminal defamation under Section 326.

The safest approach for phone calls in Thailand is to inform the other party at the outset that the call is being recorded. This satisfies PDPA consent requirements and eliminates ambiguity about the lawful basis.

---

Recording In-Person Conversations

The same legal framework that applies to phone calls extends to in-person conversations. Thailand has no law that explicitly permits or prohibits recording a face-to-face conversation.

Recording a conversation you participate in is generally less risky than recording someone else's conversation. But "less risky" is not the same as "legal." If the recording takes place in a private setting, such as someone's home, a doctor's office, or a confidential business meeting, the recorder may face liability under:

• Section 32 of the Constitution (privacy violation)
• Criminal Code Sections 322 through 325 (disclosure of secrets, if the recording is later shared)
• The PDPA (collection of personal data without a lawful basis)
• Civil and Commercial Code Section 420 (tort liability for unlawful injury to another's rights)

Recording a conversation in a semi-public setting, such as a restaurant or coffee shop, is less likely to create liability, but it is not risk-free. The key question is whether the other party had a reasonable expectation that the conversation was private.

---

Recording in Public Spaces

Recording in genuinely public spaces, such as streets, parks, and markets, is generally permissible in Thailand. The expectation of privacy is lower in public, and CCTV cameras are widespread throughout Bangkok and other major cities.

The PDPA includes an exception for recordings made for crime prevention and public safety purposes. Security cameras installed in public areas do not require individual consent, though operators should post notices where practicable.

However, recording individuals in public can still create legal issues in certain circumstances:

• Harassment: Repeatedly filming a specific person against their will could constitute harassment or stalking.
• Defamation: Publishing a recording that harms someone's reputation could trigger Thailand's criminal defamation laws under Criminal Code Sections 326 through 333, which are actively enforced.
• Commercial use: Using someone's image or voice for commercial purposes without consent violates the PDPA.
• Lese-majeste context: Recording or sharing content in a public space that involves the royal family or could be characterized as insulting to the monarchy requires extreme caution; see the dedicated section below.

---

Recording Police Officers

Recording police officers in Thailand occupies a complicated legal space with no definitive legislative answer as of mid-2026.

There is no statute that expressly grants citizens the right to film police during the performance of their duties. Conversely, there is no statute that expressly prohibits it in ordinary public settings. The general public-recording analysis applies: filming in a public place carries lower legal risk than in a private setting, and PDPA consent requirements are less stringent in the public interest context.

The Prevention and Suppression of Torture and Enforced Disappearance Act B.E. 2565 (2022) does impose a mandatory audio and video recording obligation on state officials: during apprehension and through the handover stage, custody must be continuously recorded. This obligation runs on the state, not the citizen. Academic commentary has identified a legal gap: the mandatory recording requirement does not explicitly extend to the interrogation stage, leaving that phase without a statutory recording guarantee.

Practical risks for citizens who record police include:

• Section 112 exposure: If a recording captures an interaction involving the royal family or content that could be characterized as lese-majeste, sharing it creates serious criminal risk regardless of the recording's original purpose.
• Computer Crime Act Section 14: Publishing footage online that is found to be false, distorted, or damaging to national security or public order can result in prosecution, even if the recording itself was lawful.
• Obstruction: There is no specific obstruction-of-police-filming offense in Thai law, but officers may assert that filming interferes with a lawful duty if the recorder impedes the interaction.

As a practical matter, many legal observers in Thailand advise that recording police interactions in public, without interference, carries low risk in routine settings. The higher risk arises from what is done with the recording afterward.

---

Workplace Recording and Employer Surveillance

Thailand does not have specific legislation governing workplace surveillance in the way that some European countries do. Employer monitoring practices fall under the PDPA and general labor law principles.

Employers who install CCTV in the workplace must:

• Notify employees that surveillance is in place.
• State the purpose of the surveillance (security, safety compliance, theft prevention, and similar legitimate grounds).
• Limit the scope to areas where employees do not have a strong expectation of privacy. Cameras in restrooms, changing rooms, or prayer rooms are prohibited.
• Comply with the PDPA by treating surveillance footage as personal data, including storage limitations and access controls.

Employees who secretly record conversations with colleagues or supervisors face the same legal uncertainty that applies to all private recordings in Thailand. A recording made to document workplace harassment or illegal activity may be viewed more favorably by courts than one made without a clear purpose. But there is no guarantee of admissibility or immunity from civil liability.

Employers that record employee calls for quality assurance, compliance monitoring, or training purposes must provide prior notification and document a lawful processing basis under the PDPA. With the PDPC having identified the telecommunications and healthcare sectors as 2026 enforcement priorities, call-center and healthcare employers face heightened scrutiny.

---

Business Compliance and Call Recording

Businesses operating in Thailand that record customer calls, meetings, or transactions must comply with the PDPA's consent and notification requirements. This includes:

• Prior notification: Customers must be told at the start of a call that it will be recorded.
• Stated purpose: The business must explain why the recording is being made (quality assurance, dispute resolution, training, and similar grounds).
• Consent mechanism: Under the PDPA, a recorded announcement that "this call may be recorded for quality purposes" followed by the customer continuing the call may constitute valid consent in some circumstances, but best practice is to offer an explicit opt-out and document the consent.
• Data retention limits: Recordings should not be kept longer than necessary for their stated purpose.
• Access rights: Customers have the right to request access to their recordings, request correction, or request deletion under the PDPA.
• Cross-border transfers: Businesses that transfer recordings to overseas servers must use one of the three mechanisms permitted under the December 2023 PDPC regulations (adequacy decision, binding corporate rules, or standard contractual clauses).

Businesses that fail to comply face the full range of PDPA penalties, including administrative fines of up to THB 5 million and potential criminal prosecution. The PDPC's 2026 priorities (e-commerce, healthcare, telecom, public services) signal that call-center-heavy industries are targets for near-term investigation.

---

Law Enforcement Wiretapping and Interception

Law enforcement agencies in Thailand can intercept communications, but only with judicial authorization. The Special Case Investigation Act allows Special Case Inquiry Officials to request wiretapping authorization from the Chief Judge of the Criminal Court.

The requirements for authorization are:

• Reasonable grounds to believe the target has committed or will commit a crime.
• The interception must relate to a serious offense.
• No other appropriate method of investigation is available.
• The authorization is valid for a maximum of 90 days.

The Telecommunications Business Act B.E. 2544 (2001) prohibits the illegal interception, use, or disclosure of messages and information transmitted through telecommunications systems. Service providers can be compelled to assist with lawful interception but cannot conduct surveillance independently.

Thailand's approach to law enforcement interception has drawn criticism from Privacy International and other organizations, which have noted that oversight mechanisms are limited and that the 2017 amendments to the Computer Crime Act expanded government surveillance powers without adequate safeguards.

---

Lese-Majeste (Section 112) and Recording

Section 112 of the Criminal Code imposes imprisonment of three to fifteen years for whoever defames, insults, or threatens the King, Queen, Heir-Apparent, or Regent. In practice, prosecutions have resulted in sentences far exceeding the statutory maximum through stacking of counts.

The Section 112 overlay on recording law is significant in several respects:

Recording content involving the monarchy. Recording video or audio of an interaction, protest, or event that involves commentary about or by members of the royal family creates risk. If the recording captures content that prosecutors characterize as insulting, the act of recording and then retaining or sharing the file can constitute participation in the offense.

Sharing recordings made by others. Thai courts and prosecutors have consistently held that forwarding, reposting, or redistributing content that violates Section 112 is itself an offense. In documented cases, individuals have been convicted for sharing a BBC documentary clip, sharing clips from a late-night television program, and forwarding Facebook posts. The act of redistribution is treated as a fresh publication.

Sentences in recent cases. A Chiang Rai resident was sentenced in January 2025 to 50 years in prison for 27 Facebook posts. A free speech activist received 32 months in prison in February 2026 under Section 112 for online speech. The UN Human Rights Council and other bodies have documented repeated records being set for sentence length.

No tourist exception. Foreign nationals are subject to Section 112 while in Thailand. Several non-citizens have been prosecuted. The law does not distinguish between citizens and foreigners.

The practical implication for recording purposes: any recording made in Thailand that captures speech, images, or events that could be characterized as lese-majeste should not be shared, uploaded, or distributed without careful legal review by a Thailand-licensed attorney. Retaining such recordings on a device that could be searched by authorities at the border also carries risk.

---

Voyeurism and Intimate Recording

Thailand does not have a single voyeurism statute modeled on those enacted in the United Kingdom, Australia, or some US states. Protections against non-consensual intimate recording arise from overlapping provisions.

Criminal Code Section 287 criminalizes the creation, possession, and distribution of obscene materials, including digital images and videos. Non-consensual intimate recordings that are sexually explicit fall within this provision.

Computer Crime Act Section 14(4) prohibits importing into a computer system any pornographic data. Sharing non-consensual intimate recordings through messaging apps, social media, or email therefore creates liability under the Computer Crime Act in addition to Section 287.

PDPA exposure also applies: intimate recordings are personal data, and sensitive personal data at that, because they may reveal health information, religious beliefs (in contexts involving location or dress), or other protected categories. Collecting or distributing such recordings without consent is a PDPA violation carrying administrative fines up to THB 5 million.

Filming without consent in private spaces. Installing a hidden camera in a bathroom, hotel room, changing room, or other space where individuals have a reasonable expectation of privacy creates compounded liability under Section 32 of the Constitution, Criminal Code Section 322 (interception by analogy), PDPA Section 19, and potentially the Computer Crime Act if the footage is stored or transmitted digitally.

---

Deepfake and AI-Generated Content

As of mid-2026, Thailand has no standalone law specifically addressing deepfake audio or video. However, several existing statutes apply, and dedicated AI legislation is in active development.

Existing framework for deepfakes. A deepfake that defames a real person may constitute criminal defamation under Criminal Code Sections 326 through 333. A deepfake that uses a person's voice or likeness without consent violates the PDPA as unauthorized processing of personal data. A sexually explicit deepfake distributed online triggers Computer Crime Act Section 14(4) and Criminal Code Section 287. Section 112 applies if the deepfake targets the monarchy.

Emergency Decree No. 2 B.E. 2568 (2025). The April 2025 decree criminalizes collecting, possessing, using, or disclosing personal data with the intent to commit technology crimes. This provision is directly applicable to deepfake creation pipelines that harvest biometric data (voice prints, facial data) to generate synthetic content.

Draft AI Legislation. The Electronic Transactions Development Agency (ETDA) held public hearings in mid-2025 on draft AI legislation under the working title "Draft Principles of the AI Law." The draft specifically addresses the proliferation of deepfakes and AI-generated disinformation threatening national security or democratic processes, and contemplates criminalizing deepfakes created for illicit purposes including pornography and election interference. A risk-based classification framework would place biometric identification systems and political deepfake tools in the highest-risk category, subject to heightened compliance obligations. A final act is anticipated in 2026 or 2027, following further public consultation by ETDA.

Until dedicated legislation is enacted, creators and distributors of synthetic audio or video content involving identifiable Thai residents should conduct a legal review against the existing framework described above.

---

Cross-Border Recording and International Scope

PDPA extraterritorial reach. The PDPA applies to organizations outside Thailand that collect, use, or disclose personal data from individuals in Thailand, provided those organizations offer goods or services to Thai data subjects or monitor the behavior of Thai residents. This mirrors the GDPR's territorial scope. A foreign company conducting video calls with Thai employees or customers, recording those calls, and storing the recordings on overseas servers is subject to PDPA obligations for the entire processing cycle.

Cross-border transfer rules (in force March 2024). As noted above, the PDPC published cross-border transfer regulations effective March 24, 2024. The three permitted mechanisms are:

Mechanism	How to Use
Adequacy decision	Destination country must be on the PDPC whitelist
Binding Corporate Rules (BCRs)	Approved BCRs within a corporate group
Standard contractual clauses or appropriate safeguards	Execute approved SCCs or receive PDPC certification

Journalists and foreign correspondents. Recording in Thailand for journalistic purposes does not create a categorical exemption from PDPA obligations, though Section 24(5) of the PDPA recognizes a legitimate-interest ground that may apply in some investigative contexts. The lese-majeste risk applies to foreign journalists equally with citizens.

Travelers. Foreign nationals who travel to Thailand and record video or audio of interactions are subject to Thai law for any processing that occurs on Thai territory. Uploading recordings to cloud services while in Thailand is processing that occurs in Thailand for these purposes. Travelers should be aware that border searches of devices are permitted and that recordings containing content that implicates Section 112 may attract attention.

---

Practical Guidance for Recording in Thailand

Scenario	Risk Level	Key Considerations
Recording your own phone call (participant)	Moderate	No statute prohibits it; PDPA requires a lawful basis; civil courts may accept; disclose to the other party when possible
Recording someone else's phone call (non-participant)	High	Violates Section 36 of the Constitution and potentially Computer Crime Act Section 8
Recording an in-person conversation you are part of	Moderate	Depends on setting and purpose; private settings carry higher risk; PDPA consent or legitimate interest required
Recording in public spaces	Low to Moderate	Generally acceptable; lese-majeste context and Computer Crime Act Section 14 apply to sharing
Recording police in public	Moderate	No express prohibition; Section 112 risk if monarchy-related content is captured; risk rises sharply if footage is posted online
Employer CCTV in the workplace	Low to Moderate	Must comply with PDPA notification and purpose limitation; no cameras in private areas
Business call recording with customer notification	Low	Must provide clear notice, document lawful basis, comply with PDPA retention limits and cross-border transfer rules
Recording to document a crime or protect legal rights	Lower risk	Courts are more sympathetic; Section 226/1 may allow admission; document the purpose contemporaneously
Deepfake or AI-synthesized audio/video	High	Existing statutes apply (PDPA, Computer Crime Act, Criminal Code); dedicated AI law expected 2026-2027
Content involving or referencing the monarchy	Very High	Section 112 exposure; recording and sharing can both constitute offenses; no tourist exception

For anyone uncertain about the legality of a specific recording scenario, consulting a Thai-licensed attorney before proceeding is strongly advisable. The absence of a clear recording statute means outcomes depend heavily on judicial interpretation, which varies.

---

Conclusion

Thailand's recording law landscape has evolved materially since March 2026, when this page was last reviewed. The April 2025 Emergency Decree on Technology Crimes No. 2 introduced new criminal liability for misuse of personal data in digital contexts. The PDPC issued its largest enforcement wave in August 2025, eight fines totaling approximately THB 21.5 million, and announced e-commerce, healthcare, telecommunications, and public services as 2026 priorities. Cross-border data transfer rules took effect in March 2024 and now govern how recordings of Thai residents may be moved across borders. And ETDA is actively advancing draft AI legislation that will directly address deepfakes when enacted.

The foundational framework remains unchanged: Thailand has no standalone wiretapping or recording act. The 2017 Constitution protects privacy (Section 32) and communication secrecy (Section 36). The Criminal Code addresses disclosure of secrets in Sections 322 through 325. The Criminal Procedure Code controls what evidence courts will accept, with criminal courts applying Section 226 strictly and Section 226/1 cautiously, while civil courts have a consistent track record of admitting secretly recorded evidence. The PDPA is the primary regulatory instrument for data-controller obligations.

Two features of Thai recording law distinguish it from most comparable jurisdictions. The first is the absence of any consolidated recording statute, which means that every recording scenario requires analyzing multiple overlapping laws and that judicial outcomes depend significantly on discretion. The second is the Section 112 overlay: the lese-majeste law creates recording and distribution risks that have no direct parallel in other ASEAN jurisdictions or in Western legal systems, and those risks apply equally to tourists, foreign businesses, and Thai nationals.

For individuals, the practical guidance is: disclose before recording when possible; understand that secretly recorded audio is inadmissible in criminal proceedings as a default but carries real weight in civil disputes; exercise extreme caution with any content involving the monarchy; and recognize that enforcement intensity in data protection is rising, not falling.

For businesses, PDPA compliance is not optional. The era of minimal enforcement has ended, and companies that record calls, operate CCTV, or collect customer data without proper consent frameworks are exposed to significant financial and criminal liability.