1. Introduction

Corporate Governance Data Ownership Claims in Thailand concern disputes over the ownership, control, access, use, transfer, protection and commercialization of information generated, collected or maintained by companies and their stakeholders.

In modern Thai corporate structures, data is an important commercial asset. Companies generate and maintain substantial quantities of information, including:

Corporate financial records and accounting databases.

Customer and employee personal information.

Shareholder registers and corporate governance documents.

Business strategies, trade secrets and confidential commercial information.

Software databases, algorithms and artificial intelligence training datasets.

Supply-chain, manufacturing and transaction records.

Digital intellectual property and cloud-stored corporate information.

Thailand does not have one comprehensive statute that declares all corporate data to be property owned by the company. Instead, legal protection depends on the nature of the information, contractual arrangements, intellectual property rights, confidentiality obligations, personal data protection rules and corporate governance duties.

Consequently, a company may control a database without owning every item of information contained in it. Similarly, an employee, shareholder, customer or director may have legally protected rights concerning information held by the company.

2. Legal Framework Governing Corporate Data Ownership in Thailand

A. Thai Civil and Commercial Code

The Thai Civil and Commercial Code (CCC) provides the foundational framework for corporate relationships, contractual obligations, property rights and civil liability.

Its relevance includes:

Corporate authority: Directors exercise management authority subject to statutory requirements, the company's objectives and applicable corporate documents.

Contractual ownership: Agreements can determine rights to use, access, transfer and commercialize databases and other information assets.

Breach of contract: Unauthorized disclosure, transfer or exploitation of confidential corporate data may create contractual liability.

Civil responsibility: Wrongful conduct causing damage may give rise to compensation claims.

Agency and fiduciary relationships: Directors, agents and employees may be accountable for misuse of entrusted corporate information.

The distinction between ownership of a physical or intellectual asset and control over information is especially important.

B. Personal Data Protection Act B.E. 2562 (2019)

The Personal Data Protection Act (PDPA) is central to corporate data governance.

It regulates the collection, use and disclosure of personal data by data controllers and data processors.

Important provisions include:

Section 19: Consent requirements and conditions.

Section 23: Information that must be provided when collecting personal data.

Section 24: Lawful bases for collecting personal data.

Section 26: Additional protection for sensitive personal data.

Section 27: Restrictions concerning the use or disclosure of personal data.

Section 37: Duties of data controllers.

Section 40: Duties of data processors.

Sections 77–78: Civil liability and compensation.

Legal significance: A corporation cannot claim unrestricted ownership over customer or employee personal data merely because that information is stored in its database. Its collection and use must comply with the PDPA.

C. Trade Secrets Act B.E. 2545 (2002)

The Trade Secrets Act protects commercially valuable confidential information.

Corporate information may qualify as a trade secret when:

It is not generally known or readily accessible.

It derives commercial value from its secrecy.

Appropriate measures are taken to maintain confidentiality.

Examples include customer databases, manufacturing information, pricing algorithms, marketing strategies and confidential supplier information.

Unauthorized disclosure, acquisition or use may result in civil remedies and, where statutory requirements are satisfied, criminal consequences.

D. Copyright Act B.E. 2537 (1994)

Copyright protection may apply to original computer programs, database arrangements and other qualifying creative works.

However, copyright does not automatically protect every fact or individual data entry contained in a corporate database.

The distinction is between:

Individual information or factual data.

Original expression and creative database structure.

Software used to collect, process or organize information.

E. Computer Crime Act B.E. 2550 (2007), as amended

The Computer Crime Act provides protection against specified forms of unauthorized computer access, interference and misuse.

It may become relevant where a former director, employee, contractor or business competitor unlawfully accesses, alters, deletes or interferes with corporate information systems.

F. Public Company and Securities Regulation

The Public Limited Companies Act B.E. 2535 (1992), Securities and Exchange Act B.E. 2535 (1992), and applicable Stock Exchange of Thailand regulations establish additional corporate disclosure, recordkeeping and governance requirements.

These rules are particularly important where disputes concern shareholder access, directors' responsibilities, financial information and disclosure of material corporate information.

3. Meaning and Classification of Corporate Data Ownership Claims

Corporate data ownership claims arise when two or more parties dispute legal rights over information created, collected, processed, stored or commercially exploited in the course of business.

The principal categories are:

Important legal distinction: ownership versus control

Thai law does not automatically treat all information as a proprietary asset.

For example:

A company may own the copyright in software developed under an applicable employment or commissioned-work arrangement.

A company may control a customer database but remain subject to the PDPA.

An employee may have access to corporate information without acquiring ownership of it.

A shareholder may have statutory inspection rights without becoming the owner of the company's records.

A supplier may retain intellectual property rights in software while granting a company contractual access to the associated database.

This distinction is fundamental to resolving corporate data disputes.

4. Major Types of Corporate Governance Data Ownership Disputes

A. Disputes between companies and directors

Directors frequently have access to sensitive corporate information, including financial forecasts, strategic plans, customer databases and acquisition proposals.

A dispute may arise when a director:

Transfers confidential information to another company.

Uses corporate information for personal commercial benefit.

Shares confidential records with competing businesses.

Uses company databases after leaving office.

Conceals material information from other directors or shareholders.

Such conduct may violate contractual obligations, directors' duties and trade-secret protections.

B. Employee-generated corporate data disputes

Employees may create databases, reports, customer lists, software and analytical models during employment.

The central question is whether the information belongs to the employer, employee or another contracting party.

Relevant considerations include:

Employment agreements.

Intellectual property assignment provisions.

Confidentiality agreements.

Nature of the employee's responsibilities.

Company resources used in producing the information.

Whether the information constitutes a trade secret.

Whether the employee obtained it through ordinary professional experience.

A distinction must be made between an employer's confidential customer database and an employee's general knowledge, professional skills and experience.

C. Shareholder access and corporate information disputes

Shareholders may seek access to financial information, meeting minutes, corporate registers and internal records.

Under Section 1207 of the Civil and Commercial Code, shareholders may inspect the minutes of shareholder and directors' meetings during business hours.

However, shareholder status does not create unrestricted access to every confidential corporate database.

Disputes may involve:

Refusal to provide statutory corporate records.

Concealment of financial information.

Manipulation of shareholder registers.

Improper destruction of corporate documents.

Restrictions on inspection of meeting minutes.

Conflicts between transparency and commercial confidentiality.

D. Customer database ownership disputes

Customer databases are particularly valuable in banking, insurance, telecommunications, retail and digital commerce.

Disputes arise when:

A former employee takes customer records.

A competitor obtains confidential customer information.

A company sells customer information without a lawful basis.

A service provider refuses to return business data.

A corporate group transfers customer information between subsidiaries.

The legal analysis must distinguish trade-secret protection from personal-data protection. Both may apply to the same database, but they protect different interests.

E. Corporate cloud-storage and outsourcing disputes

Companies increasingly store information through external cloud providers and data-processing contractors.

A dispute may concern:

Ownership and return of stored information.

Unauthorized copying.

Data deletion after contract termination.

Access restrictions.

Security breaches.

Cross-border transfers.

Failure to provide data portability.

Contracts should identify the data controller, processor, intellectual property owner, authorized users, retention periods and post-termination responsibilities.

5. Important Thai Case Laws and Judicial Decisions

The following decisions provide judicial guidance on corporate confidentiality, trade-secret protection, digital information, copyright ownership and employee obligations.

Important qualification: Thailand has relatively limited publicly reported higher-court litigation specifically concerning personal data ownership under the PDPA. The following cases therefore include direct trade-secret and confidentiality authorities alongside analogous intellectual-property and digital-information decisions. They should not be mistaken for six PDPA ownership judgments.

Case 1. Supreme Court Judgment No. 10217/2553

Subject: Trade-secret protection and corporate confidentiality.

Facts:

The dispute concerned employees who had access to confidential commercial information, including customer-related information and information about the origin of goods.

The employer relied on confidentiality and non-disclosure provisions in employment agreements to establish that the information was protected.

Legal issue:

Whether a general confidentiality clause in an employment contract is sufficient to establish that business information constitutes a legally protected trade secret.

Judicial principle:

The Supreme Court held that a general contractual prohibition against disclosure was not, by itself, an adequate measure for maintaining trade-secret secrecy under the Trade Secrets Act B.E. 2545.

The claimant must demonstrate actual and appropriate measures protecting the specific information.

Importance for corporate governance:

Companies must identify confidential databases clearly.

Access should be restricted to authorized personnel.

Customer lists should receive appropriate security protection.

Confidentiality agreements should be supported by practical security measures.

Companies must demonstrate which specific information is protected.

Application: A corporation cannot establish exclusive trade-secret protection merely by describing all its internal information as confidential.

Case 2. Supreme Court Judgment No. 7189/2562

Subject: Unauthorized transfer of confidential corporate information by an employee.

Facts:

An employee transferred confidential work-related documents from the employer's email system to a personal email account.

The documents concerned business operations and organizational management. The employer had confidentiality arrangements with the employee and was itself subject to restrictions concerning the documents.

Legal issue:

Whether transferring confidential corporate documents to a personal email account constitutes serious misconduct even without proof that the information was subsequently disclosed to an outside competitor.

Judicial principle:

The Supreme Court considered the unauthorized transfer a serious breach of the employee's confidentiality obligations.

The transfer made the information easier to remove or disclose beyond the employer's control. The employer was entitled to treat the conduct as serious misconduct and terminate employment under the applicable labour-law provisions.

Importance for corporate governance:

This decision is particularly significant for:

Corporate email governance.

Employee access controls.

Internal audit reports.

Confidential operational databases.

Restrictions on personal cloud storage.

Information security during employee departures.

Application: Unauthorized copying of corporate information may create legal consequences even before proof of actual external disclosure.

Case 3. Supreme Court Judgment No. 7364/2558

Subject: Protection of trade secrets through non-competition agreements.

Facts:

The dispute involved a cosmetics manufacturer and an employee working in a supervisory production position who had access to commercially valuable production information.

The employment agreement included a restriction preventing the employee from working for a competitor for one year after leaving employment.

Legal issue:

Whether a post-employment restriction designed to protect confidential commercial knowledge is enforceable.

Judicial principle:

The Supreme Court considered the one-year restriction reasonable in the circumstances and examined the legitimate commercial interests of the employer.

It also addressed the agreed contractual penalty and the court's authority to reduce an excessive penalty under the Civil and Commercial Code.

Importance for corporate governance:

Companies may protect genuine trade secrets through proportionate contractual restrictions.

Confidential production information requires effective protection.

Non-competition clauses should be carefully drafted.

Restrictions should not impose unreasonable burdens on employees.

Application: This decision is relevant to businesses protecting proprietary algorithms, product formulas, technical datasets and confidential research.

Case 4. Supreme Court Decision No. 8313/2561 — InfoQuest Ltd. v. Bisnews AFE (Thailand) Co. Ltd.

Subject: Copyright protection of digital information and online databases.

Facts:

The dispute concerned the reproduction and redistribution of news articles, special reports and interview reports distributed through digital information services.

The claimant alleged unauthorized reproduction of protected materials.

Legal issue:

Whether materials circulated through online information systems constitute copyright-protected works or merely unprotected factual information.

Judicial significance:

The dispute illustrates the distinction between factual information and original copyright-protected expression.

Copyright protection may apply to qualifying articles, reports and other original works, even when distributed electronically.

Importance for corporate governance:

Companies should identify the copyright owner of digital content.

Digital information services should obtain appropriate licences.

Corporate databases should distinguish facts from protected creative materials.

Unauthorized reproduction may create intellectual-property liability.

Application: Particularly relevant to financial databases, research platforms, media companies and commercial information providers.

Case 5. Saeksan Tape & Record Registered Partnership v. Rose Video Co. Ltd. and Others — Supreme Court Decision No. 7328/2001

Subject: Copyright ownership, contractual assignment and licensing.

Facts:

The dispute concerned musical compositions created by the late Surapol Sombatcharoen.

One party claimed copyright ownership under an agreement described as a sale of copyright. A later agreement permitted other parties to adapt and reproduce the compositions in video and laser-disc formats.

Legal issue:

Whether the original agreement effectively transferred copyright ownership or whether the parties had merely established particular commercial exploitation rights.

Judicial significance:

The Supreme Court examined the contractual language and the distinction between copyright assignment and licensing.

Importance for corporate governance:

The decision provides an important contractual lesson: companies must expressly establish whether they receive:

Full intellectual-property ownership.

An exclusive licence.

A non-exclusive licence.

Limited reproduction rights.

Rights to modify or commercialize information.

Application: The principle is relevant to corporate software, databases, digital archives, research materials and commissioned technological projects.

Case 6. Supreme Court Decision No. 10673/2010 — Public Prosecutor v. Mrs. Thanchanok Rattanavibulkul

Subject: Copyright infringement involving computer software and digital games.

Facts:

The proceedings concerned the commercial use of copyrighted computer games, including Spider-Man game software.

The accused operated a video-game business in which game discs were installed on gaming equipment and made available to customers.

Legal issue:

Whether the prosecution had sufficiently established the statutory elements of the alleged copyright-related offences under the Copyright Act and Film and Video Act.

Legal significance:

The decision illustrates that computer programs and digital software can receive copyright protection and that commercial exploitation must comply with the applicable intellectual-property framework.

Importance for corporate governance:

Companies must verify software licensing rights.

Digital assets should be included in intellectual-property registers.

Commercial software usage requires proper authorization.

Unauthorized reproduction or commercial exploitation can create liability.

Application: Relevant to companies developing proprietary software, database systems, digital platforms and corporate information-management applications.

6. Additional Judicial Authority: Contractual Protection of Corporate Information

A further useful authority is the Thai Supreme Court's decision concerning contractual restrictions on confidential business information and anti-competitive employment restrictions.

The following principles should be considered alongside the six decisions above:

Confidentiality clauses should identify the information they protect.

Non-competition restrictions should be proportionate.

Trade-secret protection requires actual secrecy measures.

Copyright assignment must be distinguished from licensing.

Employees must not misuse information entrusted to them.

Companies must establish evidence of unauthorized access, copying or disclosure.

These principles form an important foundation for corporate data ownership litigation in Thailand.

7. Civil Liability and Available Legal Remedies

Corporate data ownership disputes may give rise to different remedies depending on the legal nature of the information and the conduct involved.

A. Compensation for breach of contract

Where an employee, director, contractor or technology provider breaches a contractual confidentiality obligation, the injured company may seek compensation under the contractual provisions of the CCC.

Potential claims include:

Unauthorized disclosure of business information.

Breach of database licensing conditions.

Failure to return corporate records.

Unauthorized commercial exploitation.

Breach of data-processing agreements.

B. Trade-secret remedies

Under the Trade Secrets Act B.E. 2545, the owner or controller of a qualifying trade secret may pursue remedies for unlawful disclosure, deprivation or use contrary to honest trade practices.

Available relief may include:

Compensation for financial loss.

Injunctions against further misuse.

Orders addressing unlawful disclosure.

Other remedies permitted by the applicable legislation.

C. Personal data compensation

Sections 77 and 78 of the PDPA provide important civil remedies.

Section 77 establishes compensation liability for damage resulting from non-compliant processing by a data controller or processor, subject to statutory exceptions.

Section 78 permits punitive damages in addition to actual compensation, up to twice the actual compensation awarded.

This means a company that unlawfully exploits customer or employee information may face substantial financial consequences.

Thailand Law Library+1

D. Copyright remedies

Where corporate software, original database structures or other protected works are unlawfully reproduced or commercially exploited, copyright remedies may be available under the Copyright Act.

E. Injunctions and preservation of evidence

A company facing unauthorized data extraction may seek appropriate interim judicial protection.

Relevant objectives include:

Preventing further disclosure.

Preserving electronic evidence.

Preventing unauthorized commercial exploitation.

Protecting confidential databases.

Preserving relevant contractual and technical records.

8. Corporate Directors' Responsibilities in Data Ownership Governance

Corporate directors play an important role in protecting corporate information.

Their responsibilities include the following.

1. Data asset identification

Directors should ensure that the company identifies important databases, software, research records and confidential commercial information.

2. Ownership documentation

Companies should maintain written documentation identifying ownership, licensing rights and permitted uses.

3. Confidentiality governance

Directors should establish policies governing the handling of confidential information.

4. Data security

Appropriate technical and organizational safeguards should be implemented.

5. Regulatory compliance

Companies must ensure compliance with the PDPA, Trade Secrets Act and applicable intellectual-property legislation.

6. Third-party supervision

Cloud providers, contractors and other processors should operate under appropriate contractual and security arrangements.

7. Incident management

Data breaches and unauthorized access should be investigated promptly, with appropriate notification and remediation where legally required.

9. Burden of Proof and Evidence in Corporate Data Litigation

Evidence is particularly important in Thai corporate data ownership disputes.

A claimant should establish the following:

A particularly important lesson from Judgment No. 10217/2553 is that a confidentiality agreement alone may not demonstrate sufficient protection of a trade secret.

Companies should also maintain access restrictions, classification systems, monitoring and other practical safeguards.

Deka+1

10. Corporate Data Ownership Claims Involving Different Stakeholders

11. Emerging Challenges in Thailand

A. Artificial intelligence and corporate datasets

AI systems increasingly rely on company databases, employee information, customer records and commercial datasets.

Legal disputes may concern:

Ownership of training datasets.

Unauthorized use of corporate information.

Employee-generated AI models.

Commercial use of customer data.

Ownership of AI-generated reports.

Use of confidential algorithms by competitors.

Thai law does not establish a general proprietary ownership right over all AI training data. The legal position depends on copyright, trade secrets, contracts and personal-data protection.

B. Corporate data commercialization

Companies may seek to monetize customer information, market intelligence and industrial datasets.

However, commercialization must respect personal-data protection requirements, confidentiality restrictions and third-party intellectual-property rights.

C. Cross-border corporate data transfers

Multinational companies operating in Thailand may transfer information to foreign subsidiaries, cloud providers and international service partners.

Such transfers can create disputes involving:

Contractual control.

Cross-border personal-data transfers.

Confidentiality obligations.

Foreign access to corporate information.

Data localization requirements where applicable.

D. Blockchain-based corporate records

Blockchain technology may be used to preserve shareholder registers, corporate transactions and audit records.

However, recording information on a blockchain does not automatically establish ownership or make the underlying information legally valid.

Companies must consider accuracy, authorization, personal-data protection and correction mechanisms.

12. Practical Corporate Governance Framework for Data Ownership Protection

Thai companies should establish an integrated data ownership and governance framework.

Recommended corporate data governance structure

Board of Directors

Oversight and accountability

Corporate Data Governance Committee

Ownership classification and compliance supervision

Legal Department

Contracts, copyright and trade secrets

Data Protection Officer

PDPA compliance and privacy

IT Security Department

Access controls and cybersecurity

Internal Audit

Monitoring and investigation

Employees, contractors and external service providers

Implementation of approved data policies

The framework should include:

A corporate data ownership register.

A database classification policy.

Written intellectual-property assignments.

Employee confidentiality agreements.

Data-processing agreements.

Role-based access controls.

Cybersecurity and audit procedures.

Data retention and deletion policies.

Corporate data breach response procedures.

Regular board-level compliance reviews.

13. Critical Legal Analysis

Corporate governance data ownership in Thailand is characterized by the interaction of several legal regimes rather than one comprehensive ownership statute.

Three important legal distinctions emerge.

First: Corporate possession does not equal absolute ownership.

A company may possess customer information without having unrestricted rights to commercialize it.

Second: Confidentiality does not automatically create a trade secret.

Judgment No. 10217/2553 demonstrates the importance of actual secrecy measures, while Judgment No. 7189/2562 illustrates the legal significance of unauthorized movement of confidential corporate documents.

Third: Intellectual-property ownership depends on the applicable legal instrument.

The distinction between assignment and licensing in Decision No. 7328/2001 demonstrates why corporate contracts must expressly define ownership and exploitation rights.

There is also an important institutional limitation: Thai corporate shareholders generally have specific statutory information rights rather than unrestricted access to all internal corporate information. Section 1207 of the CCC is particularly relevant to access to corporate meeting minutes.

Thai CCC+1

14. Conclusion

Civil Law and Corporate Governance Data Ownership Claims in Thailand represent an increasingly important area of corporate and commercial litigation.

The legal framework combines the Civil and Commercial Code, Personal Data Protection Act B.E. 2562, Trade Secrets Act B.E. 2545, Copyright Act B.E. 2537, Computer Crime Act and corporate and securities legislation.

The six judicial decisions discussed above provide guidance on confidentiality, trade secrets, contractual restrictions, copyright ownership and digital information protection. They also demonstrate that corporate data governance requires more than contractual declarations of ownership.

Ultimately, effective corporate data protection in Thailand depends on clearly documented rights, reasonable security measures, responsible directors, enforceable agreements and compliance with individual data-protection rights.

The central legal principle is that corporate control over information must be distinguished from ownership of intellectual property and the independent rights of individuals whose personal data is processed.

Research qualification: Thai Supreme Court decisions are influential judicial authorities, but Thailand does not follow the strict doctrine of binding precedent associated with common-law systems. Also, the PDPA has not yet produced a substantial body of publicly available higher-court civil judgments. The cases above should therefore be used according to their actual subject matter rather than presented as direct judgments on corporate data ownership.