Thailand is developing new legislation on responsible business conduct that would impose statutory obligations on large enterprises to manage human rights and environmental risks throughout their operations and supply chains. The Draft Act on the Promotion of Responsible Business Conduct, commonly referred to as the Human Rights and Environmental Due Diligence (HRDD) Bill, has been developed through extensive consultation involving a wide range of stakeholders, with the Ministry of Justice playing a leading role. If enacted, the HRDD bill would reshape how certain large businesses operate and manage their supply chains, reflecting a recognition of international standards and global concerns regarding human rights and environmental protection. By introducing legally binding due diligence obligations, the draft aims to ensure that businesses operating in Thailand are held accountable for adverse impacts throughout their operations and supply chains, in line with emerging global legal frameworks. Who Will Have to Comply? The HRDD bill primarily targets large enterprises based on their annual revenue thresholds: Manufacturing businesses with annual revenue exceeding THB 500 million Wholesale, retail, or service businesses with annual revenue exceeding THB 300 million The draft would also cover state-owned enterprises and foreign businesses operating in Thailand if their operations meet the applicable revenue thresholds. What Does Human Rights and Environmental Due Diligence Involve? Under the HRDD bill, due diligence is not a one-time checklist but an ongoing process with several key requirements: Adopt and publicly disclose a sustainability policy. Businesses must commit publicly to respecting human rights and protecting the environment, and must integrate this policy into corporate governance and risk management systems. Identify and assess risks. Companies must identify and assess risks of human rights violations and environmental harm across their operations and value chains. Prevent or reduce risks. Businesses must implement effective and proportionate measures to prevent or mitigate

On December 31, 2025, Vietnam’s Ministry of Health (MOH) issued Circular No. 57/2025/TT-BYT providing guidance on the classification of medical devices according to technical standards and quality requirements (Circular 57), applicable to procurement activities for medical devices in Vietnam. According to the MOH, the purpose of the classification is to establish a principle-based legal framework and regulations that enable purchasers to easily identify groups of medical devices aligned with their professional requirements and financial capacity. Some of the key stipulations of Circular 57 are outlined below. Basis for Determining Technical Standards and Quality Under Circular 57, the technical standards of medical devices are determined in accordance with Vietnamese laws on standards and technical regulations, through the following means: Certification of conformity with standards in accordance with Vietnamese laws on standards and technical regulations; Results of conformity assessment conducted by an internationally recognized conformity assessment organization or a legally established domestic or foreign conformity assessment organization operating in Vietnam; and Documentation evidencing compliance provided by the medical device owner. The quality of medical devices is determined based on whether the device has been approved for circulation by the relevant marketing authority of one or more jurisdictions. Classification of Medical Devices Circular 57 classifies medical devices into six groups (from Group 1 to Group 6) based on technical standards and quality. Medical devices subject to classification must simultaneously meet technical standards and quality requirements in accordance with professional specifications and user needs, and must be lawfully marketed in Vietnam. Medical devices manufactured in Vietnam may participate in all corresponding groups, provided they meet the technical standards required by the user and are lawfully marketed in Vietnam. Outlook Circular No. 57 will take effect on February 15, 2026, while the classification requirements will become effective on January 1, 2027. Holders of medical

On December 31, 2025, the government of Vietnam promulgated Decree No. 356/2025/ND-CP detailing and guiding the implementation of the new Personal Data Protection Law (PDPL) that was issued in June 2025. The new decree, like the PDPL, entered into force on January 1, 2026, with the previous Decree No. 13/2023/ND-CP on personal data protection ceasing effect on the same day. Some key points of the new decree include the following: Comprehensive lists of basic and sensitive personal data are provided, which will require companies to review again their existing documents and data type classification to ensure compliance. New timelines are established for responding to specific data subject requests. These timelines are more reasonable and longer than the previous 72-hour requirements. Additional consent guidelines are provided, prohibiting default consent or ambiguous instructions that confuse data subjects about giving or withholding consent. Mandatory content for data transfer agreements/clauses in particular cases is provided. This covers, among other things, (i) the legal basis for the transfer of personal data; (ii) responsibilities for personal data protection during the transfer and processing of personal data; (iii) responsibilities for ensuring the exercise of the rights of personal data subjects; and (iv) responsibilities for coordination and compliance of the parties in cases where violations of personal data protection regulations are detected. The qualifications and responsibilities of data protection officers (DPOs) and data protection departments include, among others, having been trained and fostered in legal knowledge and professional skills regarding personal data protection. There are no specific provisions governing the qualifications or requirements for organizations that provide data protection training or education. New mandatory templates and requirements are provided in relation to data processing impact assessment and data transfer impact assessment, and for cases in which companies need to re-submit assessments to the regulator. Stricter requirements are

Resolution No. 222/2025/QH15 dated June 27, 2025, of the National Assembly of Vietnam (the “IFC Resolution” – see our previous article) set out the foundational legal framework for the establishment and development of Vietnam’s first-ever International Financial Centers (IFC). In furtherance of this framework, on December 18, 2025, the government of Vietnam issued eight implementing decrees to provide detailed regulatory guidance and to operationalize the IFC Resolution in practice. The Eight Implementing Decrees: An Integrated Regulatory Ecosystem The new decrees governing the IFC include the following: Decree No. 323/2025/ND-CP on the establishment of the IFC. Decree No. 324/2025/ND-CP on financial policies applicable within the IFC. Decree No. 325/2025/ND-CP on labor, employment, and social security within the IFC. Decree No. 326/2025/ND-CP on land and environmental matters within the IFC. Decree No. 327/2025/ND-CP on entry, exit, and residence of foreign nationals in the IFC. Decree No. 328/2025/ND-CP on the International Arbitration Center of the IFC. Decree No. 329/2025/ND-CP on banking licensing, foreign exchange management, and anti-money laundering and combating the financing of terrorism (AML/CFT) within the IFC. Decree No. 330/2025/ND-CP on the establishment and operation of commodity exchanges within the IFC. Taken as a whole, these eight decrees translate the IFC Resolution into a coherent and fully operational legal regime governing the establishment, organization, and functioning of Vietnam’s IFC. Collectively, they demonstrate that Vietnam’s IFC framework is best understood not as a collection of isolated incentives, but as a deliberately designed and integrated regulatory system. The Legal Architecture of the IFC: Four Interlocking Pillars Read together, the decrees seem to be designed to address four core regulatory questions from the outset: (i) what the IFC is, from a legal and institutional perspective; (ii) who may participate in the IFC and what activities are permitted; (iii) how people, capital, and projects operate