Guest Wi-Fi compliance in Thailand: CCA and PDPA
Providing guest Wi-Fi in Thailand requires simultaneous adherence to the Computer Crime Act B.E. 2550 (and its 2560 amendment) and the Personal Data Protection Act B.E. 2562.
RM-WiFi automates statutory traffic data retention in line with local Thai regulations with synchronised NTP clocks while keeping guest consent unbundled from basic connectivity.
Thailand Computer Crime Act Section 26 obligations
Section 26 of the Thailand Computer Crime Act (CCA) classifies commercial entities providing internet access—including hotels, resorts, serviced apartments, cafés, and beach clubs—as service providers required to retain computer traffic data in accordance with local statutory regulations.
The statute imposes clear operating requirements on network operators:
- Statutory traffic log retention
- Operators must store computer traffic data for the statutory retention period mandated by Thai regulations (and any formal extensions ordered by competent officials for specific investigations).
- Mandatory data fields
- Retained logs must record user identification, allocated internal IP address, public NAT IP address, source port, client device MAC address, and precise session start and end timestamps.
- Log security and non-repudiation
- Traffic logs must be stored on secure, append-only media ensuring stored records cannot be altered, modified, or deleted prematurely.
- Automated lifecycle compliance
- RM-WiFi retains and purges connection records automatically in accordance with local Thai regulations.
Stratum 1 and Stratum 2 NTP clock synchronisation
A central mandate of CCA Section 26 regulations is the precision of system timekeeping across all logging equipment. Digital records without certified time sources are inadmissible in Thai judicial proceedings.
RM-WiFi enforces rigorous time synchronisation standards across all on-property gateways and cloud controllers:
- Stratum 1 and 2 reference clocks
- All network routers, wireless access points, and RADIUS servers synchronise continuously to Stratum 1 or Stratum 2 time sources, such as the National Institute of Metrology Thailand (NIMT) or primary Asian NTP pools.
- Tight timing tolerances
- Hardware clocks maintain strict timing alignment to guarantee accurate cross-system event correlation during law enforcement forensic reviews.
- Continuous time verification
- The platform alerts administrators if an edge router or controller experiences NTP loss or abnormal clock drift.
- UTC and Indochina Time alignment
- Logs record in UTC alongside Indochina Time (UTC+7) timestamps to eliminate ambiguity in incident reports.
User identification for staying guests vs day visitors
CCA Section 26 requires positive identification of every user accessing the network. RM-WiFi implements distinct identification pathways tailored to guest classifications:
- PMS validation for staying guests
- In-house hotel and resort guests authenticate using room number and surname. RM-WiFi verifies credentials against active PMS folios in real time, and ends access at check-out after a short grace period.
- Direct-booked vs OTA-booked guests
- Direct-booked room guests connect immediately without email or survey prompts; OTA-booked guests whose email is masked by an OTA proxy can be prompted for their personal email and optional marketing consent.
- Hotel Act regulatory linkage
- Positive identification under the CCA is achieved because the PMS folio directly links the assigned IP and MAC address to the guest's passport or Thai National ID collected at check-in under the Hotel Act B.E. 2547.
- Walk-in visitor verification
- Non-staying visitors in restaurants, bars, and beach clubs authenticate via social login, email confirmation, or mobile SMS OTP verification, capturing verifiable identification records prior to granting network access.
Personal Data Protection Act (PDPA B.E. 2562) alignment
Thailand's Personal Data Protection Act enforces strict privacy rights for data subjects, restricting how personal data is collected, stored, and processed.
RM-WiFi enforces full architectural alignment with PDPA mandates:
- Unbundled consent requirements
- Under PDPA Section 19, basic Wi-Fi connectivity cannot be conditioned upon consent to marketing communications or analytical tracking.
- Lawful basis separation
- Network traffic logs process under statutory legal obligation (PDPA Section 24(6) and CCA Section 26). Promotional marketing requires separate, explicit, affirmative consent.
- Unchecked marketing opt-ins
- Marketing checkboxes on portal pages remain unchecked by default. Guests who decline marketing receive standard, unthrottled internet access.
- Consent logging and audit trails
- Every affirmative marketing opt-in records the timestamp, IP address, and accepted privacy policy version.
Data subject rights and law enforcement disclosure
The PDPA grants individuals legal rights regarding personal data, including the right to request data erasure and access.
RM-WiFi manages data subject rights while maintaining legal compliance with CCA retention requirements:
- Marketing profile deletion
- When a guest exercises their right to erasure under PDPA Section 33, RM-WiFi immediately deletes contact records, marketing tags, and stay histories from RM-CRM.
- Statutory traffic log preservation
- Computer traffic logs retained to follow local Thai statutory regulations are preserved in pseudonymised format until the mandatory retention window expires.
- Law enforcement disclosure handling
- When official requests arrive from the Cyber Crime Investigation Bureau (CCIB) or Royal Thai Police, RM-WiFi exports isolated session records matching specific timestamps, IP addresses, or MAC addresses without exposing unrelated guest folios.
Clear subscription plans, or a tailored quote for your property.
See our published monthly rates for RM-WiFi, RM-Tables, RM-CRM, RM-Desk and Resort Manager Flex on our Pricing page, or tell us how many rooms and outlets you run and which add-on modules you need for a tailored proposal.