Thailand

ETDA เปิดไฮไลท์ เวที AIGW 2026 ชู AI Governance จากหลักการระดับโลก สู่การใช้งานจริงในประเทศไทย

Thailand maps long-term semiconductor strategy, pushes toward full value chain

Primary source (boi.go.th) dated 7 January 2026 in TH. See linked source for full text.

Securities and Exchange Commission's investigation into Bitazza Global for operating digital asset exchange without license

On 22 March 2026, the Ministry of Digital Economy and Society’s order blocking access in Thailand to the Bitazza Global platform enters into force under the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes (No. 2) B.E. 2568 (2025). The Decree authorises the Ministry to block access to unauthorised digital asset trading platforms. The Securities and Exchange Commission previously found that Bitazza Global operated a digital asset exchange in Thailand without...

Thailand SEC order extending remedy deadline for KuCoin capital maintenance deficiency

Thailand SEC issued an order to extend the deadline for KuCoin to remedy its capital maintenance deficiency until 30 March 2026.

Digital services tax prohibition in United States of America and Thailand's Agreement on Reciprocal Trade

On 26 October 2025, the United States and Thailand announced a Framework for the Agreement on Reciprocal Trade. Under the Framework, Thailand committed not to impose digital services taxes or measures that “discriminate against US digital services or digital products”.

Thailand unveils draft AI legislation principles, open to public comment

ระบบกลางทางกฎหมาย

Government access to data provisions in Ministerial Regulation No. 2 (B.E. 2568) under the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes

On 13 April 2025, Ministerial Regulation No. 2 (B.E. 2568) under the Emergency Decree on Measures for the Prevention and Suppression of Technology Crimes entered into force. The Regulation applies to mobile network operators, internet service providers, social media platforms, financial institutions, and other digital intermediaries operating in Thailand. It mandates that service providers retain user identification data and access logs, disclose information to government authorities upon req...

2025 APEC Digital and AI Ministerial Statement

APEC 2025 Digital and AI Ministerial Statement “Digital and AI Transformation toward Prosperity and Sustainable Growth for All” Incheon, Republic of Korea, 4-6 August 2025

Personal Data Protection Committee's guidelines on compliance with ASEAN Cross-Border Data Flows Mechanism

On 3 February 2025, the Personal Data Protection Committee (PDPC) of Thailand published guidelines on compliance with the ASEAN Cross-Border Data Flows (CBDF) mechanism. The guide outlines the ASEAN data protection frameworks, including Model Contractual Clauses (MCCs) and ASEAN Certification, and compares these with Thailand's Personal Data Protection Act (PDPA). The framework delineates compliance obligations, enforcement mechanisms, and dispute resolution processes. It provides a step-by-s...

Personal Data Protection Committee guidelines to facilitate compliance with EU General Data Protection Regulation and UK Data Protection Act

On 28 January 2025, the Personal Data Protection Committee (PDPC) published guidelines to assist businesses in aligning with the European Union's General Data Protection Regulation (GDPR) and the United Kingdom's Data Protection Act (DPA). The guidelines focus on the mechanisms for cross-border data transfers, including adequacy decisions, standard contractual clauses (SCCs), binding corporate rules, and specific derogations. The guidelines seek to enhance compliance for organisations in Thai...

NCSC Standards for Defining Characteristics and Cybersecurity for Information Systems or Critical Infrastructures B.E. 2566 (2023)

On 18 January 2025, the National Cyber Security Committee’s (NCSC) cybersecurity standards aimed at defining characteristics and ensuring the security of information systems or critical infrastructures enter into force. The standard was issued under the Cybersecurity Act and establishes a risk-based security classification for organisations’ data or information systems. Organisations must perform a self-assessment based on three key security objectives: confidentiality, integrity, and availab...

PDPC review of Personal Data Protection Act B.E. 2562 and its secondary legislation

On 18 January 2025, the Office of the Personal Data Protection Committee (PDPC) concluded its consultation on the review of the Personal Data Protection Act B.E. 2562 and its secondary laws. The Personal Data Protection Act establishes protections for personal data, outlines the roles of data controllers and processors, and sets guidelines for data security, consent, and breach notifications. It also establishes the PDPC as the supervisory authority and details the rights of data subjects, li...

Deputy Prime Minister order for enforcement of personal data protection in mobile devices

On 18 January 2025, the Deputy Prime Minister ordered the Office of the Consumer Protection Board to enforce control over mobile phone distributors and service providers, including brands like Oppo and Realme, to ensure compliance with personal data protection laws. The Personal Data Protection Committee (PDPC) was tasked with coordinating with relevant agencies to inspect and prevent the installation of illegal applications on mobile phones and tablets. It was also highlighted that data secu...

SEC Amendments to the Royal Degree on Digital Asset Businesses

On 27 December 2024, the Office of the Securities and Exchange Commission (SEC) of Thailand closed a public consultation on the draft Act to Amend the Digital Asset Business Emergency Decree. It grants the SEC Office the authority to conduct joint investigations with other investigators in certain criminal cases related to digital assets. The act also introduces provisions for consumer protection, including requirements for disclosure, risk management, and dispute resolution mechanisms. Furt...

PDPC guideline on data breach notification requirements

On 18 December 2024, the Personal Data Protection Committee (PDPC) released a guideline clarifying personal data breach notification obligations. According to the guideline, data controllers are not required to notify the PDPC if a breach, based on a risk assessment, poses no risk to individuals' rights and freedoms. However, if the breach poses a risk to individuals, the notification must be submitted within 72 hours of confirming the breach, excluding the time needed for further investigati...

DE and ETDA Generative AI Governance Guideline

On 30 October 2024, the Ministry of Digital Economy and Society (DE) and the Electronic Transactions Development Agency (ETDA), through the AI Governance Center (AIGC), jointly issued the generative artificial intelligence (AI) governance guideline for organisations. The guideline is organised into five sections, each designed to guide organisations in the responsible and effective deployment of generative AI. The first section, understanding generative AI, lays the foundation with definition...

Thailand issues generative AI governance guidelines for organisations

กระทรวงดิจิทัลเพื่อเศรษฐกิจและสังคม (ดีอี) จับมือสำนักงานพัฒนา ธุรกรรมทางอิเล็กทรอนิกส์ (สพธอ.) หรือ ETDA (เอ็ตด้า) โดย ศูนย์ธรรมาภิบาลปัญญาประดิษฐ์ (AI Governance Center หรือ AIGC) เดินหน้าพัฒนากรอบธรรมาภิบาลปัญญาประดิษฐ์ที่เป็นการต่อยอด AI Governance Guideline ของไทย สู่การออกประกาศ Guideline ใหม่!! “แนวทางประยุกต์ใช้ Generative AI อย่างมีธรรมาภิบาลสำหรับองค์กร” (Generative AI Governance Guideline for Organizations) สำหรับผู้บริหารและผู้ที่เกี่ยวข้องนำไปประยุกต์ใช้เพื่อการวางกรอบการกำกับดูแล การประยุกต์ใช้ Generative AI ระดับองค์กรให้มีความชัดเจนและสอดคล้องกับเป้าหมาย โดยเนื้อหา ครอบคลุมตั้ง

PDPC investigation into company selling goods online for alleged breach of the Personal Data Protection Act

On 21 August 2024, the Thai Personal Data Protection Committee (PDPC) imposed its first administrative fine for breach of the Personal Data Protection Act against an unnamed company trading goods online. In particular, the PDPC imposed a TBH 7 million fine and ordered corrective actions on the company after finding it had disclosed personal data without consent to unauthorised persons, specifically, a call center that used personal data to commit fraud.

MDES investigation into online crimes related to Digital Wallet project

On 5 August 2024, the Ministry of Digital Economy and Society issued an order based on the investigation into online crimes relating to the THB 10’000 top-up project through the digital wallet scheme, which opened for registration on 1 August 2024. The digital wallet scheme aims to promote local money circulation and provides THB 10’000 in digital currency to citizens over 16 years old with an annual income below THB 840’000 and bank deposits under THB 500’000. The investigation found six fak...

Prime Minister order requiring expedition of suppression of false news and information on social media

On 16 July 2024, the Prime Minister adopted an order requiring the expedition of the suppression of false news and information on social media. The order addresses misinformation on social media and various platforms that may mislead the public about individuals and significant government initiatives, including the Digital Wallet project. Under the order, the Ministry of Digital Economy and Society and the Technology Crime Suppression Division (TCSD) will establish a working group to analyse ...

Ministry of Digital Economy and Technology Crime Suppression Division investigation into technology crimes including online gambling

On 5 July 2024, the Ministry of Digital Economy and Society (MDES) issued a statement on the "FINAL BET" operation addressing ongoing efforts to combat online crime using AI technology and warning the public against participating in online gambling. In particular, the MDES stated that the "FINAL BET" operation, targeting and dismantling five major online gambling networks, is seizing assets exceeding THB 360 million. The operation involved coordinated efforts with the Anti-Cybercrime Division...

Personal Data Protection Committee Criteria for Deletion or Destruction of Personal Data, or Making Personal Data Unidentifiable

On 27 June 2024, the Personal Data Protection Committee (PDPC) closes the public consultation on the draft Criteria for Deletion or Destruction of Personal Data, or Making Personal Data Unidentifiable. The draft aims to establish guidelines for data controllers on how to handle requests from data subjects to delete, destroy, or anonymize their personal data in compliance with Section 33 of the Personal Data Protection Act B.E. 2562 (2019). In particular, the data controllers are required to c...

ETDA guidelines for managing advertisements on digital platforms (no. 3/2567)

On 11 June 2024, the Electronic Transactions Development Agency's (ETDA) guidelines for managing advertisements on digital platforms (no. 3/2567) entered into force. The guidelines aim to prevent fraudulent activities, illegal product or service offerings, and unlawful solicitation through advertisements on digital platforms. Furthermore, the guidelines aim to help digital platforms to establish effective self-regulation mechanisms to ensure that ads are credible, transparent, and verifiable....

Rules on the criteria for protecting personal data sent or transferred abroad according to Section 28 of PDPA

On 24 March 2024, Thailand’s Personal Data Protection Committee (PDPC) implemented rules regarding the criteria for protecting personal data sent or transferred abroad according to Section 28 of the Personal Data Protection Act (PDPA). The order outlines the rules for the adoption of an adequacy decision, noting that PDPC will assess the level of protection the countries have and will accept cases proposed by data controllers. Further, it outlines the criteria for sufficient data protection s...

Ministry of Digital for Economy and Society Investigation into Personal Data Trading Network

On 15 February 2024, the Ministry of Digital for Economic and Social Affairs (MICT) of Thailand announced the findings of investigations into the personal data trading networks, which resulted in the arrest of nine individuals involved in the illegal trade of personal information. This action was the result of a collaborative effort between the MICT, the Police Headquarters Investigation Technological Crime, the Office of the Personal Data Protection Commission (PDPC), and the Office of the N...

ETDA guidelines for managing the sale of goods requiring product standards on digital platform services (no. 4/2567)

On 2 September 2024, the Electronic Transactions Development Agency's (ETDA) guidelines for managing the sale of goods requiring product standards on digital platform services (no. 4/2567) entered into force. The guidelines aim to establish regulations for the sale and advertisement of goods that must meet legally mandated standards on digital platforms, ensuring that these products are credible, comply with the required standards, and prevent any potential harm to consumers. Furthermore, the...

Establishment of the PDPA Center

On 29 January 2024, the Minister of Digital Economy and Society announced the establishment of the Personal Data Protection Commission (PDPA) Center. The PDPA Center serves as a hub for delivering personal information protection services, expanding communication channels for citizens and various agencies. The services offered by the PDPA Center encompass advisory and information services on PDPA laws, a complaint reception center for PDPA non-compliance, a Personal Data Violation Surveillance...

Decree on exemption of data controllers duties under the Personal Data Protection Act (PDPA)

On 14 January 2024, the Royal Decree outlining exceptions to data controller obligations under the Personal Data Protection Act (PDPA) came into force. This decree stipulates that data controllers are not bound to adhere to Chapters 2 and 3 of the PDPA when responding to personal data requests from specific government entities. These include the National Anti-Corruption Commission, Revenue Department, Customs Department, Excise Department, recognised local government organisations responsible...

ETDA order on details of the terms and conditions notified to the platform users (no. 4/2566)

On 3 January 2024, the Electronic Transactions Development Agency’s (ETDA) order on details of the terms and conditions notified to the platform users (no. 4/2566) entered into force. The order applies to platforms that charge for services, act as intermediaries for goods or services, have contracts with businesses to offer goods or services or provide search engine services. Among others, the terms of service must include service conditions, suspension or termination of services, service cha...

PDPC order on appointment of data protection officers under PDPA B.E. 2566 (2023)

On 13 December 2023, the Personal Data Protection Committee’s (PDPC) order on the requirement for data controllers and data processors to appoint data protection officers (DPO) enters into force. It specifies that data controllers and processors handling large-scale personal data processing activities, especially those requiring regular monitoring, must appoint a DPO. Large-scale collection, use, or disclosure of personal data includes instances where the data is part of core activities invol...

NCSC NCSC criteria and fee rates for fees, maintenance, compensation, and services for operations

On 6 September 2023, the National Cyber Security Committee’s (NCSC) criteria and fee rates for fees, maintenance, compensation, and services for operations entered into force. It outlines the rules and fee structures for services provided by the agency. It details the types of fees, including those for using information systems, conducting surveys, and training, as well as the rates for certification of cybersecurity service providers. The announcement specifies how fees should be calculated,...

Ministry of Digital Economy and Society Lawsuit against Facebook for allegedly not removing scam advertisements

On 21 August 2023, the Ministry of Digital Economy and Society (MDES) announced its intention to initiate legal proceedings against Facebook. The MDES stated that Facebook did not, as asked by the Ministry, remove advertisements for "scams" such as crypto trading or other investments. According to section 15 of the Computer Crime Act, any service provider who cooperates, consents, or conspires to commit an offence in a computer system under their control shall be liable to the same penalty as...

Quality of service requirement in Royal Decree on the Operation of Digital Platform Service Businesses

On 21 August 2023, the Royal Decree on the Operation of Digital Platform Service Businesses B.E. 2565 (2022) entered into force. The decree requires online platform providers, including search engine services, to notify users of their terms and conditions before or at the time of using the platform. These terms must include details such as service use, suspension, termination, and fee structures. They should also outline the main parameters of the algorithms or criteria used to rank or recomm...

ETDA Notification regarding AI Risk Assessment

On 19 August 2023, the Electronic Transactions Development Agency (ETDA) closed its public consultation on the draft Notification regarding AI Risk Assessment. The draft regulation would establish standardised guidelines for assessing and managing risks associated with Artificial Intelligence (AI) systems in Thailand. The proposed framework covers four main components: governance, risk mapping, risk measurement, and risk management. Governance involves implementing systematic management mecha...

Criteria and Procedures for Issuing Orders by the Expert Committee under the Personal Data Protection Act B.E. 2562

On 22 June 2023, the Criteria and Procedures for Issuing Orders by the Expert Committee under the Personal Data Protection Act B.E. 2562, which aligns with Section 16(4) in conjunction with Section 74, paragraph five of the Act, entered into force. It specifies that, unless stated otherwise, the Administrative Procedures Act will apply mutatis mutandis in issuing orders related to data protection. The orders must detail essential facts, legal provisions, and the rationale for decisions, signe...

Data protection regulation in Decree for overseeing business services related to Digital Identity Proofing and Authentication Systems requiring a license (No. ThPhS. 1/2566)

On 22 June 2023, the Decree for overseeing business services related to Digital Identity Proofing and Authentication Systems requiring a license including data protection regulation entered into force. The regulations mandate that service providers implement robust data protection and privacy measures, including secure data collection, storage, and destruction protocols, as well as the management of biometric data. Furthermore, the regulations require the implementation of an incident respons...

Memorandum of Cooperation between the Ministry of Digital Economy and Society (DES) and 16 banks

On 3 May 2023, the Ministry of Digital Economy and Society (MDES) of Thailand and 16 banks signed a memorandum of Cooperation to strengthen public resilience against online fraud and fake news by integrating online fraud awareness services and providing access to accurate news on banking applications.

Artificial Intelligence Promotion and Support Act

On 13 April 2023, the Electronic Transactions Development Agency (ETDA) closed its public consultation on the draft of the Artificial Intelligence Promotion and Support Act. The Act would establish a robust framework to promote and support AI innovation in the country. Furthermore, the Act focuses on creating an AI ecosystem through public-private collaboration, establishing AI Innovation Testing Centers, and facilitating research and development. In addition, it outlines the importance of a ...

ETDA Notification regarding Al Sandbox

On 13 April 2023, the Electronic Transactions Development Agency (ETDA) closed its public consultation on the draft Notification regarding Artificial Intelligence (Al) Sandbox. In particular, the ETDA has proposed the creation of an AI Innovation Testing Center (AI Sandbox) in Thailand to provide a dedicated space for testing and developing AI technologies in a controlled environment. This initiative addresses the current lack of facilities and legal frameworks for structured AI testing. AI d...

Digital Assets Custody Regulation including mandatory management system for asset safety

On 16 January 2023, Thailand’s Securities and Exchange Commission (SEC) implemented regulations mandating digital asset business operators offering clients' digital asset custody services to implement a digital wallet management system that can efficiently manage the custody of digital assets and keys while ensuring the safety of clients' assets. These regulations impose specific requirements such as establishing policies, guidelines, and procedures for overseeing risk management, digital wal...