You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

December 4, 2025

Thailand Expands Fast-Track Cybersecurity and Defense Procurement

Thailand has expanded the circumstances under which state agencies may bypass competitive bidding procedures to address urgent security challenges. On November 28, 2025, Thailand’s Ministry of Finance published the Ministerial Regulation Determining Cases of Procurement by Specific Method (No. 6) B.E. 2568 in the Royal Gazette, introducing a new pathway for procuring supplies and services needed to address cyber and military threats that may affect the stability of government agencies or the nation. For technology vendors, cybersecurity firms, and defense contractors, this regulatory change creates immediate opportunities to engage directly with government buyers facing urgent security challenges.

New Fast-Track Category for Security Threats

The regulation amends Thailand’s Public Procurement and Supplies Management Act B.E. 2560 (2017) to add a new category of procurement that qualifies for the “specific method”—a noncompetitive, direct selection process. Previously, agencies could use this expedited method only in limited circumstances, such as emergencies, cases with proprietary technology requirements, or national security operations. The new provision explicitly covers procurement of supplies related to preventing or resolving cyber or military threats that could impact the stability of a state agency or the country.

This addition recognizes the urgent nature of modern security challenges, where competitive bidding timelines may leave agencies vulnerable during critical threat windows. State agencies dealing with active cyberattacks, preparing defensive measures against anticipated threats, or responding to military security concerns can now move directly to negotiate with qualified vendors rather than conducting lengthy public tender processes.

Vendor Considerations

Vendors offering cybersecurity solutions now have a regulatory avenue to work directly with government clients when stability concerns are present. These solutions include threat detection systems, anti-ransomware tools, incident response services, firewalls, and security consulting. Similarly, defense contractors providing military equipment or specialized security supplies can pursue direct engagement channels where traditional procurement methods would create unacceptable delays.

Procuring agencies will need to demonstrate that the procurement relates to preventing or resolving a genuine cyber or military threat to stability. Therefore, vendors should be prepared to show how their solutions address the specific security challenges the agency faces, as well as why direct engagement serves the government’s urgent needs.

Similarly, vendors approaching and building relationships with government clients should be able to emphasize response speed, proven effectiveness in similar threat environments, and the urgency factors that justify bypassing competitive procedures.

RELATED INSIGHTS​ 

April 23, 2025
On April 13, 2025, the government of Vietnam issued Decree No. 89/2025/ND-CP to amend and supplement Decree No. 92/2016/ND-CP dated July 1, 2016, concerning conditional business lines within the civil aviation sector (“Decree 89”). This update was implemented through an expedited procedure with immediate effect and has drawn public attention as it broadens the types of aircraft eligible for import into Vietnam, thereby promising to inject greater diversity into the country’s aviation market. What has changed? Decree 89 expands the recognition of aircraft type certificates—documents ensuring that the design of the aircraft, aircraft engine, or propeller meet airworthiness standards—from two to seven foreign aviation authorities. While Vietnam previously only accepted type certificates from the U.S. Federal Aviation Administration (FAA) and the European Union Aviation Safety Agency (EASA), the country now further accepts type certificates issued by five additional foreign aviation authorities: National Civil Aviation Agency of Brazil (ANAC) Transport Canada Civil Aviation (TCCA) Federal Agency for Air Transport of the Russian Federation (Rosaviatsiya) U.K. Civil Aviation Authority (UK CAA) Civil Aviation Administration of China (CAAC) Additionally, on April 14, 2025, Vietnam’s Ministry of Construction issued Circular No. 03/2025/TT-BXD (“Circular 03”) with immediate effect, amending and supplementing several articles under Circular No. 01/2011/TT-BGTVT previously issued by the Ministry of Transport (which was merged into the Ministry of Construction on March 1, 2025) in 2011 on the promulgation of the Civil Aviation Safety Regulations for aircraft and aircraft operations. Echoing Decree 89, Circular 03 allows the Civil Aviation Authority of Vietnam (CAAV) to issue or recognize Certificates of Airworthiness to aircraft that hold type certificates issued by the aviation authorities of Brazil, Canada, Russia, the United Kingdom, or China, in addition to those issued by the FAA or EASA. Following the entry into force of Decree 89 and Circular 03, the
April 18, 2025
On April 12, 2025, Thailand published an amendment to the Emergency Decree on Measures for the Prevention and Suppression of Technological Crimes in the Government Gazette, with the regulation taking effect the following day. Drafts of the amendment had been shared in recent months, and the final amendment of the decree contains some additional key revisions, such as narrowing the business operators subject to the decree’s requirements, reducing operators’ obligations, and establishing collaboration between relevant stakeholders to tackle technology crime. These key revisions to the amendment are detailed below. Business operators subject to the decree: The business operators covered under the decree now include only payment service providers under the Payment System Act and digital asset operators under the Royal Decree on Digital Asset Businesses. Digital platform services under the Royal Decree on Digital Platform Service Businesses That Are Subject to Prior Notification are no longer within the scope of the decree. Definition of technology crime: The final version of the amendment removed the expanded definition of technology crime that had been included in a previous draft, leaving the decree’s existing definition unchanged. Telecommunications provider obligations: Mobile and telecommunications service providers now have an obligation to monitor and screen for content that may be related to technology crime and suspend SIM cards when instructed to do so by the National Broadcasting and Telecommunications Commission (NBTC). Transaction and account suspension: The amendment removes the decree’s complex transaction suspension procedures and leaves room for business-specific regulators (e.g., Bank of Thailand, Securities and Exchange Commission, NBTC) to impose various technology crime suspension requirements on business operators under their supervision. The newly established Center for Prevention and Suppression of Technology Crimes can also notify financial institutions and business operators of names or digital asset wallet addresses that may be related to technology crime,
April 18, 2025
On April 12, 2025, Thailand issued an amended digital asset regulation that covers offshore digital asset businesses providing services on a cross-border basis to Thai users. These businesses will now be subject to the licensing requirements of the Royal Decree on Digital Asset Business Operations B.E. 2561 (2018), which is supervised by Thailand’s Securities and Exchange Commission (SEC). A digital asset business will be deemed as providing services in Thailand—and therefore subject to requirements under the Royal Decree on Digital Asset Business Operations—if the business does any of the following: Displays content in Thai, either fully or partially; Is registered under a “.th,” or “.ไทย” domain, contains any name relating to Thailand, or uses a domain written in Thai characters; Allows or requires payments in Thai baht (THB) or receives payments through Thai bank accounts or e-wallets; Chooses Thai law to govern transactions or Thai courts to litigate any dispute; Pays online search engines to attract users in Thailand to its services; Has an office, establishment, or personnel in Thailand to support or assist users within the country; or Meets any other criteria specified by the SEC. To operate legally in Thailand, offshore operators meeting any of the above criteria will be required to incorporate a local company in Thailand in order to apply for a digital asset business license with the SEC.
April 11, 2025
Vietnam’s draft Personal Data Protection Law (PDPL) continues to evolve, with significant implications for businesses operating in the region. The latest draft, released to the public in March 2025, contains several noteworthy changes from the previous draft that businesses with operations in Vietnam should be aware of when developing their data protection strategies and compliance frameworks. The draft PDPL will be submitted to the vote of the National Assembly in May 2025 with a tentative entry into force on January 1, 2026. Key Changes in the Latest Draft PDPL 1. Redefined Categories of Personal Data The draft PDPL has made important revisions to personal data classifications: Basic personal data: An individual’s image is no longer classified as basic personal data. Sensitive personal data: Bank account information has been removed from this classification (and is now considered basic personal data), but two new categories have been added: (i) salary, allowances, and other income sources, and (ii) information on land users and information on land containing such information. Organizations should review their data classification schemes and update protection measures accordingly, particularly for salary and compensation information. 2. Data Encryption Requirements The draft PDPL explicitly states that encrypted data remains classified as personal data. Additionally, it mandates that sensitive personal data must be encrypted when stored, transmitted, received, or shared in cyberspace. Organizations and individuals can freely opt for one or more encryption solutions and encryption/decryption processes suitable for their personal data management and administration activities. 3. Biometric Data Processing The latest draft PDPL adds new protection requirements for biometric data. Organizations processing biometric data (such as fingerprints) must: Implement physical security measures for devices storing and transmitting biometric data. Use strong encryption methods during transmission and storage. Restrict access to biometric data. Have early-detection monitoring systems to detect violations of biometric