You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

July 26, 2021

Laos Issues E-commerce Regulations

Though online purchases of goods and services have been booming in Laos, the country’s laws and regulations have not kept pace. Providers of legal advice on these activities have therefore had to interpret laws and regulations on traditional physical retail activities instead, and apply them to online activities. However, Laos is making strides toward providing clear legal guidance for e-commerce operations by issuing legal measures to facilitate the regulation of online business activities.

For instance, on June 4, 2021, the new Decree on E-commerce No. 296/GOV (dated April 12, 2021, and published in the Lao Official Gazette on May 20) came into effect to clarify the regulatory framework for e-commerce in the country and to set requirements for electronic purchase contracts.

The decree, which applies only to operators residing or registered in Laos, regulates individuals and legal entities involved in the following activities:

  • Selling goods and services via their own electronic platform (website, program, or other instruction set);
  • Providing electronic marketplace services; and
  • Selling goods and services via electronic marketplaces.

Seller Notification Requirement

Business operators looking to sell goods or services via an electronic platform, either on their own website or application or via an electronic marketplace, must notify the relevant department of the Ministry of Industry and Commerce of their activity. (Existing operators must notify the ministry within 90 days from the decree’s effective date.) Although the chief concern of the decree is to target those whose regular activity is to sell goods and services online, the decree does not address whether those selling occasionally through an electronic marketplace still need to notify the ministry.

Documents for the notification consist primarily of the application form provided by the Ministry of Industry and Commerce, the enterprise registration certificate (i.e., proof of having registered a legal entity in Laos) or a simple ID card for individuals, a copy of the business operating license (for activities that require approval from a line ministry), and a copy of a contract with a payment service provider for payment via an electronic platform. Upon receipt of the necessary documentation, the ministry’s relevant departments or agencies will certify the notification within three working days. This certificate is valid for two years, and must be renewed thirty days before its expiry.

Electronic Marketplace Registration

Electronic marketplaces must be operated via an incorporated legal entity, which means an Enterprise Registration Certificate is a necessary prerequisite to operating an electronic marketplace in Laos. As for technical requirements, electronic marketplaces must obtain a Ministry of Technology and Communications certificate confirming their “technical conformity.” (The process and requirements for obtaining this certificate may be the subject of guidance that is yet to be issued.)

Similar to the grace period for the notification requirement mentioned above, existing electronic marketplace operators have 90 days (from June 4, 2021) to request authorization from the ministry. Upon receipt of the necessary documentation, the ministry’s relevant departments will consider and provide its authorization within five working days. This authorization is valid for three years, and must be renewed thirty days before its expiry.

Foreign Restrictions

Foreign shareholders cannot hold more than 90 percent of the shares of the legal entity operating an electronic marketplace, and the registered capital must be at least LAK 10 billion (approx. USD 1.05 million).

It is important to note that this decree does not replace existing laws and regulations that address certain types of goods or services sold, for which licensing, notification, minimum investment, and other requirements may apply. For instance, foreign participation in the provision of retail and wholesale services in Laos is limited under the Decision on Retail and Wholesale Business. Under this decision, a foreign shareholder who holds up to 50% of the shares in a retail or wholesale business must invest at least LAK 4 billion (approx. USD 423,350). Between LAK 10 billion (approx. USD 1.05 million) and less than LAK 20 billion (approx. USD 2.1 million) a foreign shareholder may hold 70% of the legal entity, while a foreign shareholder must invest at least LAK 20 billion to hold 100% of the shares of the marketplace’s legal entity conducting retail and wholesale services. Similar restrictions are likely to apply for online retail and wholesale businesses.

Transparency

The decree requires business operators of electronic platforms to disclose information on their platforms and activities, as well as on the goods and services sold. Accordingly, information on the business operator, such as its name, address, contact details, and Enterprise Registration Certificate or the relevant operating license, must be displayed on the electronic platform.

Descriptions of goods or services should note the product specifications (size, color, aspect, and so on) following the product labels as applicable, and product-related information such as origins, prices, return and warranty policies, related fees (e.g., shipment and payment methods), and terms and conditions. In addition, information on customers’ “satisfaction and opinion” concerning the goods and services must be displayed on the corresponding electronic platform. The decree also emphasizes that information on the goods or services offered must be realistic and portray products’ actual characteristics.

Product Liability

The decree also addresses liability for the goods and services sold, deeming electronic selling platforms and sellers on electronic marketplaces legally responsible for the goods and services they sell online.

The decree does not assign similar legal responsibility to entities operating electronic marketplaces on which the goods or services are sold. However, electronic marketplace operators are prohibited from authorizing or ignoring the sale of prohibited goods or services on their electronic marketplaces. Accordingly, they  must take a proactive role in the inspection of goods and services sold.

E-commerce Contracts

According to the decree, which endeavors to cover e-commerce contracts specifically (as opposed to electronic contracts more generally), there are two types of e-commerce contracts.

First, e-commerce contracts made via an “online ordering function” are defined as agreements between seller and client for the sale, purchase, or exchange of goods or services, made by electronic means via the online ordering function of an electronic platform created by the “owner of the electronic platform.” Essentially, this means e-commerce contracts that cover transactions made on electronic platforms (other than electronic marketplaces), and assumes that they use electronic means of payment.

The second type of e-commerce contract is one made “via social media,” which is a term in the decree that the regulator interprets as also covering electronic marketplace contracts for the sale, purchase, or exchange of goods or services.

The decree stipulates that the offering of either type of e-commerce contract is governed primarily by the rules provided in the electronic platform’s terms and conditions. Upon acceptance of the offer by the seller, the e-contract will be deemed formed. The offer will be nullified if the seller does not respond within 12 hours (unlike the 15 days for a traditional contract in writing), unless otherwise stipulated in the terms and conditions of the electronic platform. The client may also cancel its offer before receiving a response from the seller.

Both types of e-commerce contracts must remain accessible to clients after the transaction, (e.g. through archives and purchase histories).

For e-commerce contracts made via the online ordering function of an electronic platform (not on an electronic marketplace), the electronic platform must have a system that allows clients to review, add, amend, confirm, or cancel an offer before formally submitting it by means of the online ordering function. In case of cancellation by the client, electronic platforms must provide clients with evidence that the notification to cancel the contract was sent.

Conclusion

E-commerce activities in Laos have typically had to rely on extensive interpretation of laws that were not made to address e-commerce. The new e-commerce decree discussed in this article is an example of how the government is working to update the regulatory framework to sustain promising high-tech sectors such as e-commerce, fintech, and others. As Laos remains a relatively untapped market in these areas, the Decree on E-commerce eases both local and international investors’ concerns about launching operations by clarifying some key issues. The decree does not address sanctions for noncompliance, and questions remain regarding some of the mandatory requirements (such as the “technical requirements”) to register an electronic marketplace. Therefore, in its current state full implementation of the decree may require subsequent guidance from the authorities.

RELATED INSIGHTS​ 

June 25, 2026
On June 18, 2026, Thailand’s Office of the Personal Data Protection Committee (PDPC) published two notifications in the Government Gazette establishing Thailand’s first formal certification framework for personal data protection standards under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The notifications, which took immediate effect, introduce a voluntary certification framework aimed at promoting accountability, strengthening organizational data protection governance, and aligning Thailand more closely with international frameworks that recognize certification as a key compliance tool. Certification Criteria The first notification sets out the assessment criteria for organizations seeking certification. Applicants must undergo an evaluation against a framework comprising four assessment categories, 10 focus areas, and 128 assessment criteria covering key elements of a privacy management program. These include: Organizational oversight and internal policies and procedures. Human resource development, including staff training and awareness programs. Clearly defined operational processes and procedures covering data subject rights, transparency obligations, records of processing activities, and lawful basis management, as well as contractual safeguards such as data-processing and data-sharing agreements and risk assessments, including Data Protection Impact Assessments. Technical measures encompassing data security controls and breach response capabilities Based on the assessment results, organizations may be awarded either a PDPA Compliance Certificate or a higher-level PDPA Certificate accompanied by a certification mark. Application and Assessment Process The second notification establishes the application and assessment process for obtaining certification. Eligible applicants include government agencies and private-sector entities that demonstrate sufficient privacy governance maturity and meet the prescribed eligibility requirements. Applicants must submit their applications along with supporting documentation for review. Upon receiving an application, the Office of the PDPC will conduct a detailed evaluation, which may include both documentary review and on-site inspections. Incomplete applications may be rejected, though applicants are typically given a limited period to correct deficiencies before a final decision
June 23, 2026
On May 26, 2026, Thailand’s Department of Land Transport (DLT) published for public consultation a draft amendment to the Ministerial Regulation on Electronic Ride-Hailing Vehicles that would, for the first time, allow juristic persons (legal entities) to register vehicles as electronic ride-hailing cars—a right that currently belongs exclusively to natural persons, limited to one person per one vehicle. If finalized in its current form, the regulation would significantly expand the supply side of Thailand’s ride-hailing market by enabling corporate fleet operators to enter the space. The public comment period is open through June 24, 2026. Key Principles Under the Draft Regulation Under the proposed amendment, juristic persons that maintain a fleet of at least 50 vehicles will be permitted to register vehicles as electronic ride-hailing cars. This represents a fundamental shift from the current framework, which restricts registration to individual natural persons on a one-person-one-car basis. Vehicle Specifications Corporate-owned ride-hailing vehicles must meet the following requirements: Be brand new from the factory, or no more than two years old from first registration with no more than 20,000 km of use. Not be a vehicle that has been reconstructed or repaired after involvement in a serious accident affecting safety—a standard consistent with public transport vehicles (RorYor. 6). Be classified as small, medium, or large in accordance with ministerial or director-general specifications. The vehicles may be equipped with safety devices such as interior or exterior cameras (video/photo recording) and can retain the original factory color of the vehicle body (no mandatory color change is required). License Plates Corporate ride-hailing vehicles will use license plates of the same size, characteristics, and color as those for private passenger vehicles not exceeding seven seats (RorYor. 1), rather than public transport plates. Potential Impact The government has stated that the regulation is intended to: Promote
June 23, 2026
On May 14, 2026, Thailand published a ministerial regulation in the Government Gazette to prescribe measures for prevention and suppression of technology crimes. The regulation creates a comprehensive procedural framework for returning money and digital assets to victims of technology crimes. It will take effect 90 days after publication (in mid-August 2026), giving affected entities a limited window to prepare. Mandatory Reporting Obligations for Financial Institutions When a deposit account, e-money account, or digital asset wallet is frozen in connection with a technology crime, the relevant financial institution or business operator must report transaction data to the Anti-Money Laundering Office (AMLO) via AMLO’s designated electronic system. Required data elements include account numbers (sender and receiver), names, identification or passport numbers, legal entity registration numbers, phone numbers, remaining balance, damage amount, transaction reference numbers, and the bank case ID. Institutions that already share data through the information-sharing system under the emergency decree are deemed to have satisfied this reporting obligation, creating an incentive for platform participation. When the Royal Thai Police or the Department of Special Investigation seize or freeze assets related to technology crimes, they must provide AMLO with investigation reports, complaint evidence, money-trail data, and account statements. Notification and Claims Process Once the AMLO secretary-general approves verified reports of a technology crime, the account information of persons connected to the crime will be published in the Government Gazette, triggering a 90-day window for victims to file claims and for related persons to file objections. Officers will also publish details on AMLO’s electronic media and send registered mail to identified victims, which will be deemed received after 7 days domestically or 15 days internationally. Victims have 90 days from the date the crime is published in the Government Gazette to file claims through AMLO’s electronic system. Claims must include
June 19, 2026
For the first time, Thailand’s Food and Drug Administration (FDA) has published a consolidated list identifying all substances that have successfully passed its novel food safety evaluation process. The list is a step forward in regulatory transparency, but it also highlights a feature of the Thai regime that food companies often overlook: each approval is tied exclusively to the company that applied for it. A substance’s appearance on the list does not give other companies the green light to use it. This article examines the structure of Thailand’s novel food approval framework, the implications of applicant exclusivity, and the strategic choices it requires of food companies looking to bring novel ingredients to the Thai market. Thai FDA Food Safety Evaluation Framework Notification No. 376 of the Ministry of Public Health requires novel food substances to undergo a food safety assessment, with an exemption only for novel foods manufactured exclusively for export. The framework also encompasses “foods that do not qualify as novel foods” but which present characteristics warranting a safety evaluation, such as differing quality standards, increased serving sizes, or applications in specific food categories, where such changes affect consumption levels, nutritional value, or consumer safety. The recently published list of foods that passed the safety evaluation by the Thai FDA is structured by substance category and identifies the approved company (domestic manufacturer or importer), country of origin, substance name and trade name, approved purpose of use, and date of the Thai FDA’s approval notification certificate. A notable feature of Thailand’s novel food regime is that the approval result is tied exclusively to the company that submitted the application. Publication of the consolidated list does not constitute a general authorization to use the approved substances. The Thai FDA’s approval certificate specifies the approved conditions of use and the requirements