After making revisions to the initial draft notification released in November 2024, Thailand’s Electronic Transactions Development Agency (ETDA) has released an updated draft Notification on Additional Obligations for Digital Platform Service Operators of Online Marketplaces for Goods with Specific Characteristics under Section 18(2) of the Royal Decree on the Operation of Digital Platform Service Businesses Subject to Prior Notification B.E. 2565 (2022) B.E. … . A focus group session was also held to gather feedback from business operators. Below is a summary of key provisions in the new draft. Unchanged Items Some key concerns that remain unchanged from the previous version of the draft notification include the following: Offshore business operators running online marketplaces that act as intermediaries for the sale or exchange of goods and provide facility services for the sale of goods (referred to as “specific marketplace operators” in the draft) are required to establish a local entity in Thailand. However, the criteria for determining which operators are specific marketplace operators are still under discussion due to feedback from business operators. Specific marketplace operators must submit a compliance report to the ETDA along with their annual report each year. Specific marketplace operators must verify that “business users” (e.g., merchants) provide complete details about goods in accordance with product standardization requirements. Removed Obligations The updated draft notification has removed specific marketplace operators’ obligations to: Conduct Identity Assurance Level 2 (IAL2) verification of business users before onboarding them on their platforms. Submit a registry of business users’ information to the ETDA. Retain business users’ information for a specified retention period. Implement measures to filter reviews of products subject to specific standards. Revisions Key revisions made to the draft notification include the following: The effective date has been extended to 120 days after the notification’s publication in the Government Gazette,

On February 6, 2025, the prime minister of Vietnam, Pham Minh Chinh, chaired an online meeting to review the progress of Vietnam’s digital transformation agenda. The meeting assessed achievements under the National Digital Transformation Program and Project 06 on the development and application of population data, electronic identification, and authentication for national digital transformation for the period 2022-2025, with a vision to 2030, approved by the prime minister in 2022. The meeting also outlined key legislative and regulatory priorities for 2025, as set forth in Notice No. 56/TB-BPCP issued by the Government Office on February 23, 2025 (Notice 56). One of the central focuses of the 2025 digital transformation agenda is the development and issuance of laws and regulations governing digital technology, data management, and cybersecurity. Below are the key legal developments provided in Notice 56 that stakeholders should anticipate in the coming months. 1. Law on Digital Technology Industry The Ministry of Information and Communications (MIC) has been tasked with finalizing the draft Law on Digital Technology Industry (DTI Law) for submission to the National Assembly at its 9th session in May 2025. This law is expected to establish a comprehensive legal framework for the digital technology sector, addressing regulatory gaps in emerging fields such as artificial intelligence (AI), Internet of Things (IoT), cloud computing, big data and platform services to promote innovation, ensure data security, and support the growth of the digital economy in Vietnam. Concurrently, the MIC will expedite the issuance of guiding decrees to ensure the swift implementation of the DTI Law once enacted. 2. Law on Personal Data Protection and regulations guiding implementation of Data Law The Ministry of Public Security (MPS) is making efforts to finalize the long-anticipated Law on Personal Data Protection (PDPL)—data protection is currently governed by Decree No. 13/2023/ND-CP on

Tilleke & Gibbins has contributed the Cambodia, Myanmar, Thailand, and Vietnam chapters to Data Protection and Cybersecurity Regulation in Southeast Asia, a wide-ranging guide published by Drew Network Asia (DNA). The resource provides a comprehensive overview of data protection and cybersecurity laws across the region, offering practical insight into compliance requirements and regulatory developments affecting organizations that handle personal data or operate digital services in Southeast Asia. The guide begins with a regional overview, including the broader ASEAN context and cooperation initiatives. Jurisdiction-specific chapters follow a consistent structure—covering data privacy and governance obligations, security requirements and breach notification, outsourcing and cross-border data transfers, and broader accountability and compliance measures. This format allows readers to compare regulatory approaches across markets such as Brunei, Indonesia, Malaysia, the Philippines, Singapore, and others. In addition to the country chapters, the publication addresses cybersecurity and privacy engineering challenges, providing guidance for organizations and outlining obligations applicable to data controllers, processors, and intermediaries. A dedicated section on data breach management across ASEAN examines notification requirements, response considerations, and practical steps for managing incidents in a regional or global context. The guide is intended to serve as a practical reference, and the authors note that specific legal requirements may vary depending on sector, processing activity, or evolving legislation. Readers seeking more detailed advice can contact the practitioners listed in each chapter. The full guide is available for download using the button below or directly from the DNA website.

The Bank of Thailand (BOT) has published the Draft Guidelines for Digital Fraud Management, which aim to help financial service providers tackle digital fraud and ensure safety and trust in the Thai financial system. These draft guidelines, which are available for public comment until March 18, 2025, provide a comprehensive framework for financial service providers, covering prevention, detection, management, and resolution of digital fraud, as well as support for customers affected by fraud. The BOT tentatively plans to implement these draft guidelines on April 1, 2025, along with circular letters on the minimum required measures for tackling “mule accounts” (deposit or e-money accounts used as tools to receive and transfer funds obtained through the commission of any offense) and measures to strengthen Thailand’s customer due diligence and enhanced due diligence procedures. Under the draft guidelines, “financial service providers” include financial institutions and special financial institutions under the Financial Institution Business Act and payment providers under the Payment Systems Act. Commercial banks, special financial institutions, and operators of transferable e-money services must adhere to every requirement in the draft guidelines. Other financial service providers (e.g., payment providers other than operators of transferable e-money services) can implement the draft guidelines as deemed appropriate to their services, products, and service channels. Digital Fraud Management Requirements The draft guidelines establish the following key requirements: Policy and oversight. Directors and senior executives of financial service providers must set and adopt appropriate “end-to-end” fraud management policies and KPIs to manage digital fraud, covering prevention, monitoring, detection, management, resolution, and support for affected customers. Fraud management processes. Financial service providers must establish a clear framework for managing digital fraud throughout the customer lifecycle, from customer onboarding to service termination, according to industry standards at a minimum and covering at least the following processes: Know your customer