You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

December 26, 2025

Thailand Extends Compliance Deadline for Ride-Sharing Platforms

Subscribe to Updates

Thailand has granted ride-sharing platforms additional time to comply with new regulatory requirements, extending the compliance deadline to March 31, 2026 (replacing the previous deadline of October 2, 2025). The postponement was made official on December 18, 2025, when Thailand’s Electronic Transactions Development Agency (ETDA) published the second Notification Regarding Supervision of Ride-Hailing Platforms Classified as High-Impact Digital Platform Services under the Royal Decree on Digital Platform Service Businesses.

The notification provides additional time for ride-sharing platforms and drivers to transition to full regulatory compliance. The extension replaces the effective date provision of the earlier notification and applies specifically to ride-hailing activities.

Background

The postponement responds to feedback from operators and driver groups regarding challenges converting private vehicles into legally registered public vehicles, including complex registration procedures, high compliance costs, and operational delays. The Department of Land Transport (DLT) is concurrently reforming its vehicle registration and driver verification processes to streamline operations. Given these issues, the Electronic Transactions Committee has deferred enforcement to provide an adjustment period for operators and drivers to meet compliance requirements.

Ongoing Obligations

While the effective date has been deferred, the substantive obligations imposed on ride-sharing platforms remain fully intact. Operators must continue preparing to comply with the additional duties applicable to high-impact digital platform services, beyond the general requirements under the digital platform services framework.

Operators are expected to use the extended transition period to finalize operational and compliance readiness ahead of enforcement on March 31, 2026. Key focus areas include:

  • Integration with DLT vehicle-registration systems
  • Deployment of robust driver and passenger identity verification mechanisms
  • Updates to platform terms of service, driver-onboarding standards, and internal operational policies
  • Preparation for ETDA reporting obligations and future audit and review processes

Next Steps

While the postponement replaces the previous effective date with the new March 31, 2026, deadline, operators should anticipate increased regulatory scrutiny as the revised effective date approaches and proactively align their operations with the strengthened regulatory framework.

Related Professionals

Industries

Automotive

Technology

Location

RELATED INSIGHTS​ 

February 2, 2021
On February 1, 2021, through Thailand’s Ministry of Digital Economy and Society, the Office of Personal Data Protection Commission announced that it will arrange public hearing sessions for the first set of subordinate regulations under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). Subordinate regulations on the following topics will be covered during the consultations: Consent Privacy notices Responsibilities of data controllers Cross-border data transfers Data protection officers Security measures Compliance processes Sensitive personal data It is anticipated that the draft subordinate regulations will be circulated (in Thai) to registered attendees ahead of the sessions. Participation by video conferencing will be available. In addition, at the First ASEAN Digital Ministers’ Meeting on January 21 and 22, 2021, the ASEAN Data Management Framework (DMF) and the Model Contractual Clauses for Cross Border Data Flows (MCCs) were approved in order to promote the secure free flow of data between ASEAN countries, including Thailand. The development of the Thai PDPA is expected to factor into these DMF and MCC initiatives, potentially allowing businesses in Thailand to transfer data between neighboring countries within the region, in addition to the permitted transfer between countries whitelisted under the European General Data Protection Regulation (GDPR). These initiatives were led by the Singapore Personal Data Protection Commission, and more details are expected in due course. Prior to the PDPA effective date on June 1, 2021, substantial further developments are expected to give further clarification and guidance for businesses, and to ease their compliance concerns. For more information on this development, or any other aspect of data protection in Thailand, please contact Tilleke & Gibbins’ data protection team led by Athistha (Nop) Chitranukroh ([email protected]).
Read More
January 29, 2021
Members of Tilleke & Gibbins’ technology team contributed the Vietnam chapter of the recently published Data Protection Laws of the World (10th Edition), a widely consulted handbook to privacy and data protection laws across more than 100 different jurisdictions.
Read More
January 14, 2021
On November 26, 2020, the Notification of the Ministry of Finance Re: Addition to Other Business Relating to Digital Assets B.E. 2563 (2020) (the Digital Asset Business Notification) and the Notification of the Ministry of Finance Re: Licensing of Digital Asset Business No. 2 B.E. 2563 (2020) (the Digital Asset Business Licensing Notification) were published in the Thai Government Gazette. Additional Digital Asset Businesses The new Digital Assets Business Notification adds two new categories of digital assets business to the list prescribed in the Royal Decree on Digital Asset Businesses B.E. 2561 (2018). Digital Asset Fund Manager is defined as a person who manages funds from digital assets for another person for benefits, or holds themselves out to the general public as being ready to do so, in the ordinary course of business. It does not include the management of digital assets as prescribed by the Securities and Exchange Commission (SEC). Digital Asset Advisory Service is defined as a person who provides consultations to other people, directly or indirectly, regarding the value of digital assets; the suitability of investment in digital assets; or the buying, selling, or exchanging of any digital assets in the ordinary course of business in return for service fees or other compensation. However, this does not include consultations as a part of or relating to a digital asset exchange, digital asset broker, digital asset dealer, digital asset fund manager, or other personal consultation as prescribed by the SEC. Additional Digital Asset Licensing Requirements The Digital Asset Business Licensing Notification amends the definition of “License Applicant” to include cryptocurrency exchanges, digital token exchanges, cryptocurrency brokers, digital token brokers, cryptocurrency dealers, digital token dealers, cryptocurrency fund managers, digital token fund managers, cryptocurrency advisory services, and digital token advisory services. Additional requirements for granting licenses have also been added
Read More
January 13, 2021
Thailand’s Office of the Insurance Commission (OIC) recently issued two notifications—one for life-insurance companies and another for insurance companies—establishing key criteria and requirements for insurance companies to manage risks relating to IT and cybersecurity. The notifications, entitled Notifications Re: Criteria for the Supervision and Management of Risks Relating to Information Technology for Life/Non-life Insurance Companies B.E. 2563 (2020) came into effect on January 1, 2021, and cover eight major aspects of IT risk management as detailed below. IT Governance Insurance companies are required to monitor and manage IT risks and cyber threats in accordance with the size, characteristics, complexity, and context of their business operations, and each company should have at least one director with knowledge of, or past experience in, the field of information technology. IT Project Management Insurance companies are required to develop a written framework for IT project management, covering at least the commencement, implementation, and control of the project, as well as the project closing and post-project auditing. Companies must also appoint a committee for supervising and monitoring IT projects. IT Security Insurance companies are required to institute a written IT security policy, which must be reviewed at least once a year or upon implementing any significant changes. The policy must be approved by the board of directors, or a relevant subcommittee appointed by the board of directors. In outsourcing IT activities to third-party service providers, or entering into any arrangement that allows business partners to connect to or access the company’s IT system, insurance companies are required to specify their own criteria and procedures for the selection of third-party service providers, enter into a written service agreement and a service level agreement with the third-party provider, and conform with other requirements under the notifications. Insurance companies will also be required to comply with the OIC’s forthcoming
Read More