1. Introduction

Corporate Data Ownership Systems in Thailand concern the legal rights, responsibilities and liabilities associated with the collection, creation, storage, processing, licensing, transfer, commercialisation and protection of data held by companies.

In the modern Thai economy, corporate data is an important commercial asset. Businesses rely on customer databases, employee records, financial information, artificial intelligence datasets, software databases, transaction histories, intellectual property and confidential business information.

However, Thai law does not establish one universal property right over all corporate data. Instead, legal protection depends on the nature of the information and the rights involved.

For example:

Personal data: Protected under the Personal Data Protection Act B.E. 2562 (2019).

Trade secrets: Protected under the Trade Secrets Act B.E. 2545 (2002).

Databases and software: May receive protection under the Copyright Act B.E. 2537 (1994).

Commercial information: May be protected through contractual rights and confidentiality obligations.

Electronic records: Governed partly by the Electronic Transactions Act B.E. 2544 (2001).

Corporate assets: May be subject to contractual, fiduciary, insolvency and civil liability principles.

The central legal distinction is between ownership of information, ownership of intellectual property in information, control over personal data and contractual rights to use information.

2. Legal framework governing corporate data ownership

A. Personal Data Protection Act B.E. 2562 (2019)

The PDPA is one of the most important laws affecting corporate data governance in Thailand.

It regulates the collection, use and disclosure of personal data by data controllers and data processors.

Its principal requirements include:

Lawful grounds for processing personal data.

Appropriate consent where consent is the applicable legal basis.

Transparency concerning data collection and processing.

Purpose limitation.

Data minimisation.

Appropriate security measures.

Data-subject rights.

Breach notification obligations.

Restrictions on certain international transfers.

Accountability of controllers and processors.

Important distinction: A company does not become the absolute owner of customer information simply because it collected or paid for the database.

The company must exercise its rights consistently with the PDPA and the rights of the individuals concerned.

B. Trade Secrets Act B.E. 2545 (2002)

The Trade Secrets Act protects commercially valuable confidential information.

Corporate information may qualify as a trade secret where it:

Is not generally known or accessible to persons normally dealing with that type of information.

Has commercial value because it is secret.

Has been subject to appropriate measures to maintain secrecy.

Examples include:

Customer pricing databases.

Manufacturing formulas.

Supplier information.

Marketing strategies.

Proprietary business algorithms.

Confidential financial models.

Non-public commercial research.

Section 6 addresses unlawful disclosure, acquisition or use of trade secrets.

A company seeking protection must establish not merely that information was confidential, but also that it took appropriate measures to preserve confidentiality.

C. Copyright Act B.E. 2537 (1994)

Copyright may protect original databases through the originality of their selection or arrangement, as well as qualifying computer programs.

However, copyright does not automatically protect every individual fact, customer record or item of raw data.

Corporate ownership also depends on the applicable employment, commissioned-work and assignment provisions.

D. Civil and Commercial Code

The Civil and Commercial Code provides important contractual and civil-liability foundations.

Relevant areas include:

Contractual obligations.

Breach of confidentiality agreements.

Compensation for contractual loss.

Wrongful acts under Sections 420 onwards.

Agency and fiduciary responsibilities.

Corporate obligations.

Unjust enrichment where applicable.

E. Electronic Transactions Act B.E. 2544 (2001)

This legislation recognises electronic transactions and electronic records.

It provides legal recognition to electronic information and supports the evidentiary use of electronic records, subject to statutory requirements.

It is particularly important when companies dispute:

Ownership-related electronic documentation.

Digital contracts.

Electronic signatures.

Data transfers.

Electronic business records.

Digital evidence of commercial transactions.

3. Major forms of corporate data ownership

4. Important Thai case laws and judicial principles

Important qualification: Thailand has relatively limited publicly available reported court decisions specifically concerning personal-data ownership under the PDPA. Therefore, the following cases include directly relevant decisions on corporate trade secrets, employee-created software, copyright ownership, licensing and commercial information rights. The copyright cases are supporting authorities by analogy, not judgments directly deciding ownership of modern corporate databases.

Case 1. Heat & Combustion Co., Ltd. v. Somsak Sukkasem – Supreme Court Decision No. 10217/2553

Area: Trade secrets and corporate confidentiality.

Facts:

The dispute concerned confidential business information and the obligations of employees not to disclose confidential company information.

The company relied on confidentiality and non-compete provisions in employment agreements to establish that the information was protected as a trade secret.

Legal issue:

Whether general confidentiality and non-disclosure clauses were sufficient to establish appropriate measures for maintaining trade-secret protection.

Judicial principle:

The Supreme Court emphasised that a company must take appropriate measures to maintain the secrecy of the information.

A general contractual restriction, without adequate identification and protection of the actual confidential information, was insufficient.

Relevance to corporate data ownership:

Companies must identify their confidential datasets.

Customer and supplier databases should have restricted access.

Confidential records should be classified.

Employees should be subject to appropriate confidentiality obligations.

Technical and organisational security measures should accompany contractual protection.

This is one of the most important Thai authorities for corporate data confidentiality.

Case 2. Supreme Court Decision No. 9523/2544 – Employee-Created Computer Software

Area: Software ownership and employer–employee intellectual property disputes.

Facts:

An employee created a computer program and installed it on the employer's computer system for use in the employer's business.

After leaving employment, the employee sought the return of the software and challenged the employer's continued use.

Legal issue:

Whether software developed by an employee automatically becomes the employer's copyright property merely because it was created for business purposes.

Judicial decision:

The Supreme Court recognised the employee as the copyright owner under the applicable Copyright Act provisions because there was no written agreement transferring ownership to the employer.

The employee had permitted the employer to use the program during employment. That permission did not establish permanent ownership.

Continued use after permission was withdrawn could constitute a wrongful act under Section 420 of the Civil and Commercial Code.

Relevance:

This judgment is particularly important for:

Employee-created databases.

Internal management software.

Proprietary information systems.

Corporate analytics programs.

Software developed by IT employees.

AI tools developed within companies.

It demonstrates that the person who creates a digital asset and the business that uses it may have different legal rights.

Case 3. Saeksan Tape & Record Registered Partnership v. Rose Video Co. Ltd. & Others – Supreme Court Decision No. 7328/2001

Area: Copyright assignment and contractual ownership.

Facts:

A dispute arose concerning an agreement described as a sale of copyright in musical compositions.

The plaintiff claimed that the agreement transferred copyright ownership. Subsequently, other parties entered into arrangements permitting commercial adaptation and reproduction of the compositions.

Legal issue:

Whether contractual language concerning a sale of copyright was sufficient to establish an effective assignment of copyright.

Judicial principle:

The Supreme Court examined the actual contractual arrangement and distinguished copyright assignment from permission to exploit copyrighted works.

The agreement did not establish the transfer claimed by the plaintiff.

Relevance:

Corporate data transactions frequently involve similar contractual problems.

For example, an agreement to access a database does not necessarily transfer ownership of:

The database structure.

The underlying software.

Original analytical reports.

Copyright-protected compilations.

Proprietary research.

Companies must clearly distinguish ownership transfers from data-use licences.

Case 4. PGM Record v. Visa Khanthap & Others – Supreme Court Decision No. 679/2004

Area: Copyright assignment and commercial licensing.

Facts:

The dispute concerned an agreement described as a transfer of copyright in musical compositions.

The author-composer subsequently permitted other parties to produce different versions of the compositions.

Legal issue:

Whether the earlier agreement had effectively transferred copyright ownership or merely granted particular commercial exploitation rights.

Judicial significance:

The decision illustrates the importance of examining the substance and scope of a copyright agreement rather than relying exclusively on its description.

Relevance to corporate data ownership:

A company entering into a data-sharing arrangement must identify whether the agreement grants:

Temporary access.

A limited-purpose licence.

A commercial exploitation licence.

An exclusive licence.

An actual assignment of transferable intellectual property rights.

These rights are legally different and should not be treated as interchangeable.

Case 5. Public Prosecutor v. Sermsak Kamsamer & Another – Decision No. 3707/2003

Area: Copyright enforcement and evidentiary reliability.

Facts:

The proceedings concerned alleged unlawful commercial dealing in copyrighted sound recordings.

The defendants challenged the prosecution's evidence and relied on the conduct of the copyright owner's representative.

Legal issue:

Whether the prosecution had established unlawful infringement through sufficiently reliable evidence, considering the circumstances in which the alleged infringement had been arranged.

Judicial significance:

The case demonstrates the importance of reliable evidence and proper enforcement procedures in intellectual-property disputes.

Relevance to corporate data ownership:

Companies bringing claims involving stolen or misused databases should preserve:

System access logs.

Data-transfer records.

Employee access histories.

Audit trails.

Original database versions.

Digital forensic reports.

Evidence identifying the particular information allegedly misappropriated.

A general assertion that corporate information was stolen may be insufficient without evidence identifying the information and the alleged misuse.

Case 6. Public Prosecutor v. Pongchai Buapan – Decision No. 5049/2004

Area: Copyright enforcement and unlawful commercial reproduction.

Facts:

The case concerned alleged unauthorised commercial reproduction and distribution of copyrighted sound recordings.

The defendant challenged the circumstances surrounding the alleged infringement, including the conduct of the copyright owner's representative.

Legal issue:

Whether the alleged infringement had been sufficiently established where the enforcement representative had participated in creating the circumstances leading to the prosecution.

Judicial significance:

The case highlights the need for reliable evidence and proper procedures when enforcing commercial intellectual-property rights.

Relevance:

This principle is useful in corporate data disputes involving:

Automated data-monitoring systems.

Digital evidence collection.

Database copying allegations.

Employee surveillance.

Investigations into unauthorised data extraction.

A business should ensure that its investigation procedures preserve the authenticity and reliability of digital evidence.

Case 7. Kritsada Paleevong v. Software Supply International Co. Ltd. & Others – Decision No. 1984/2005

Area: Copyright ownership and commercial exploitation rights.

Facts:

The dispute concerned an agreement under which a composer permitted a producer to use musical compositions and the producer acquired copyright in the resulting sound recordings.

The dispute involved the extent of the producer's rights to exploit and transfer those recordings.

Legal significance:

The case illustrates that rights in an underlying creative work and rights in a separately produced recording may belong to different parties.

Relevance to corporate data ownership:

A similar distinction can arise in a corporate database:

An individual may retain rights in original software.

A company may own qualifying copyright in its original database compilation.

A third-party vendor may retain rights in its database-management software.

A customer may retain rights and protections concerning personal information.

A processor may have contractual permission to process information without acquiring ownership of the underlying information.

This distinction is essential in outsourced IT arrangements and corporate data-management contracts.

Case references: Thai Supreme Court decisions and the WIPO Thailand copyright case summaries. The cases above should not be cited as direct PDPA ownership precedents.

5. Corporate data ownership disputes under Thai civil law

A. Disputes between employers and employees

One of the most common forms of corporate data litigation involves employees who develop software, create databases or collect commercially valuable information during employment.

Disputes may arise when:

An employee copies a customer database before resignation.

A former manager transfers confidential business information to a competitor.

An employee claims ownership of software developed for the company.

An employer continues using software after an employee's permission has ended.

A former employee uses confidential pricing information to establish a competing business.

Applicable legal principles:

The Copyright Act, Trade Secrets Act, employment agreements and Section 420 of the Civil and Commercial Code may all become relevant.

The employer should establish the distinction between:

Information belonging to the company.

Information created by employees.

Software owned by external developers.

Personal information controlled under the PDPA.

Information licensed from third parties.

B. Corporate data ownership and outsourcing disputes

Thai companies frequently outsource data management to external technology providers.

Disputes may involve:

Cloud-storage providers.

Database-management companies.

Software developers.

Customer relationship management providers.

Business intelligence consultants.

Artificial intelligence service providers.

For example, a Thai company may pay a technology provider to create and maintain a customer database.

The provider may argue that it owns the software, database structure or technical platform, while the company claims ownership of the collected business information.

The legal outcome depends on the contract, intellectual-property rights, confidentiality obligations and PDPA responsibilities.

A properly drafted agreement should specify:

Ownership of pre-existing software.

Ownership of newly developed software.

Rights in database compilations.

Permitted data processing.

Data portability.

Restrictions on secondary use.

Security obligations.

Subcontracting conditions.

Termination and deletion obligations.

Rights to retrieve data after termination.

C. Corporate customer database disputes

Customer databases are commercially valuable because they contain information about customer preferences, purchasing histories, transactions and commercial relationships.

However, customer information is not an unrestricted corporate asset.

Under the PDPA, companies must establish an appropriate legal basis for processing and comply with purpose limitation, security and transparency obligations.

A company cannot automatically sell, disclose or commercially exploit personal information merely because it collected that information.

D. Corporate data ownership during mergers and acquisitions

Corporate mergers and acquisitions frequently involve the transfer of digital assets.

Potential disputes include:

Whether customer databases can be transferred to the acquiring company.

Whether the seller owns the relevant software.

Whether third-party licensing agreements permit transfer.

Whether confidential datasets are included in the transaction.

Whether the acquired company has complied with the PDPA.

Whether historical data can be used for new commercial purposes.

Due diligence should examine the legal basis for personal-data processing, the provenance of datasets, intellectual-property assignments and contractual restrictions.

E. Corporate data ownership during insolvency

Corporate data may have substantial economic value during insolvency and restructuring.

Questions include:

Can a database be sold as part of the company's assets?

Can a liquidator transfer customer information?

Can creditors enforce security over qualifying intellectual-property rights?

Can a cloud provider withhold access following non-payment?

Can confidential information be transferred to an insolvency purchaser?

The answer depends on the nature of the asset, applicable security arrangements, contractual restrictions, personal-data obligations and insolvency law.

Importantly, customer personal data should not be treated as freely disposable property merely because it has commercial value.

6. Personal data ownership versus corporate data control

This distinction is central to understanding Thai law.

Important PDPA provisions

The following provisions are especially relevant:

Section 19: Consent requirements and conditions.

Section 23: Information that must be provided when personal data is collected.

Section 24: Legal bases for processing personal data without consent.

Section 26: Additional protection for sensitive personal data.

Section 28: Conditions for transferring personal data outside Thailand.

Section 30: Right of access.

Section 32: Right to object.

Section 33: Right to erasure or destruction, subject to statutory conditions.

Section 35: Data controllers' security obligations.

Section 37: Duties of data controllers, including security and breach notification.

Section 40: Obligations of data processors.

A company that owns a database compilation may still be required to respect individuals' statutory rights over their personal information.

7. Civil liability and remedies

Corporate data disputes may give rise to several different legal remedies.

A. Civil liability under Section 420

Section 420 of the Civil and Commercial Code provides the general wrongful-act foundation.

A claimant must establish the necessary elements of a wrongful act, damage and causal connection.

This may apply where a person unlawfully copies confidential company information or causes damage through unauthorised use of digital assets.

B. Civil liability under the PDPA

Sections 77 and 78 are particularly important.

Section 77 establishes civil liability for damage caused by violations of the PDPA by controllers or processors, subject to the statutory exceptions.

Section 78 permits punitive damages in appropriate circumstances, subject to the statutory ceiling of twice the actual damages.

A data subject may therefore seek compensation for harm caused by unlawful corporate data processing.

C. Injunctions and preventive protection

Companies may seek judicial protection against continuing or threatened unlawful exploitation of qualifying intellectual-property or trade-secret rights.

Preventive measures may include:

Restricting access to confidential databases.

Preventing further unauthorised disclosure.

Preserving electronic evidence.

Preventing unlawful commercial exploitation.

Enforcing contractual confidentiality obligations.

8. Corporate data governance and ownership management systems

An effective corporate data ownership system requires both legal documentation and technical controls.

Enterprise Data Strategy: Transforming Data into Value

Discover and classify sensitive data - Data Access Security

Data Management and Security Architecture | EdrawMax Templates

8

A. Data classification

Companies should classify information into different categories.

B. Data ownership register

Companies should maintain a register identifying:

Dataset name.

Original creator.

Legal owner or rights holder, where applicable.

Data controller.

Data processor.

Collection purpose.

Legal basis for processing.

Retention period.

Permitted recipients.

Licensing conditions.

Security classification.

C. Data access governance

Access should be granted according to job responsibilities.

For example:

Human resources personnel should access relevant employee records.

Finance employees should access necessary financial information.

Marketing teams should access only appropriately authorised customer information.

External consultants should receive access only for defined purposes.

D. Data transfer and commercial licensing

Corporate data agreements should clearly identify the rights being transferred.

An agreement should distinguish between:

Data ownership.

Database copyright.

Software copyright.

Trade-secret protection.

Personal-data processing permissions.

Commercial licensing rights.

International transfer rights.

E. AI and corporate data ownership

AI introduces additional legal challenges.

A company using customer information to train an AI model must consider:

Whether the data contains personal information.

Whether the processing has a lawful basis.

Whether sensitive personal data is involved.

Whether the training data contains third-party copyrighted material.

Whether the information is protected by trade-secret obligations.

Whether the model provider can reuse submitted information.

Whether the resulting model or dataset can be commercially licensed.

The fact that a company finances AI development does not automatically establish ownership of every underlying dataset, software component or third-party intellectual-property right.

9. Regulatory enforcement and emerging developments

Although the PDPA has established civil and administrative liability, publicly available Thai judicial decisions specifically addressing personal-data disputes remain limited.

A significant part of enforcement has taken place through the Personal Data Protection Committee (PDPC).

Reported enforcement examples include:

A. Corporate customer-data breach

A major corporate data breach involving inadequate security measures and delayed breach notification resulted in a reported administrative fine of THB 7 million.

20 February 2025+1

B. Cosmetics company data leakage

A cosmetics company reportedly received a THB 2.5 million fine following a personal-data leakage incident involving inadequate security and failure to notify the regulator.

Chambers and Partners+1

C. Collectible toy company and data processor

A compromised reservation system resulted in unauthorised amendments to approximately 200,000 records. Reported fines were THB 500,000 for the retailer and THB 3 million for its processor.

Chambers and Partners

These are administrative enforcement examples, not Supreme Court judgments. They demonstrate the practical importance of corporate data security and processor accountability.

10. Major legal challenges

Thailand's corporate data ownership framework faces several developing challenges.

11. Recommendations for corporate data ownership reform in Thailand

The following reforms could strengthen Thailand's legal framework:

1. Clearer statutory recognition: Develop clearer rules distinguishing corporate data assets, database copyright, personal information and trade secrets.

2. Standardised ownership agreements: Encourage standard contractual provisions for employee-created software, outsourced databases and jointly developed datasets.

3. Data provenance requirements: Require companies to document the source, creator, legal basis and permitted use of commercially valuable datasets.

4. Stronger security governance: Encourage regular access reviews, encryption, incident response planning and independent security assessments.

5. AI data governance: Develop clearer rules for commercial AI training datasets, synthetic data and third-party data licensing.

6. Improved dispute resolution: Strengthen specialist expertise in resolving corporate data ownership and digital intellectual-property disputes.

7. Cross-border cooperation: Improve cooperation concerning international data transfers, cloud services and multinational corporate investigations.

12. Conclusion

Civil Law and Corporate Data Ownership Systems in Thailand operate through a combination of intellectual-property legislation, trade-secret protection, personal-data regulation, contractual obligations and general civil liability.

The most important legal principle is that corporate control of data does not automatically mean absolute legal ownership of every element of that data.

The seven decisions discussed above provide important guidance on software ownership, employee-created works, confidentiality, copyright assignments, licensing and evidence. However, they should not be misrepresented as seven direct judicial decisions on corporate personal-data ownership.

For practical corporate governance, the strongest approach is to combine clear contractual ownership provisions, proper intellectual-property assignments, trade-secret protection, PDPA compliance and reliable digital security systems.

13. Summary of principal legislation and cases

Research note: The Thai trade-secret decisions are particularly relevant to confidentiality and ownership disputes, while the copyright decisions provide supporting principles for digital assets. The limited availability of reported PDPA court judgments is an important limitation when researching this subject.

Trade Secrets protection in Thailand+4