You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

April 29, 2025

Thailand Issues Draft Principles to Amend Insurance Data Guidelines

On April 11, 2025, Thailand’s Office of Insurance Commission (OIC) released draft principles for two notifications for public comment, open until the end of April. These aim to amend the OIC Notifications on Guidelines for Customer Personal Data Protection for life and non-life insurance businesses, which were issued in 2021.

Key Principles

Both life and non-life insurance companies will be required to obtain consent for the following processing activities:

  • Processing of general personal data:
    • When requesting the OIC to disclose information related to a customer’s insurance policy for the purpose of underwriting or claims consideration.
  • Processing of sensitive personal data:
    • When requesting the OIC to disclose information related to a customer’s insurance policy for the purpose of underwriting or claims consideration; and
    • When requesting the OIC to disclose information about a customer’s insurance fraud behavior for fraud monitoring, fraud risk management, and assessing and preventing insurance fraud risk for underwriting or claims payment.

The consent for the above processing activities must be in accordance with the consent requirements prescribed by the OIC, and the disclosure of personal data must also comply strictly with the conditions set by the OIC.

Life insurance companies may obtain consent for other purposes as long as they comply with Thailand’s Personal Data Protection Act B.E. 2562 (2019), and companies will be liable in the event of a personal data breach.

Additional Principles for Non-Life Insurance Businesses

Non-life insurance companies will be required to provide a privacy notice and a summary of the privacy notice for each type of insurance policy in accordance with the form prescribed by the OIC. The privacy notice and its summary must be provided prior to or at the time of offering insurance policies, or together with the consent form for data processing through any channels used for offering insurance. The privacy notice and its summary must also be published on the company’s website.

The prescribed privacy notice templates cover different types of insurance policies, including: (1) accident and health insurance; (2) fire, property, miscellaneous, and other types of insurance; and (3) compulsory motor insurance and voluntary motor insurance.

The OIC further prescribes a consent form for the processing of data relating to health, disabilities, sexual orientation, biometric data, genetic data, and race for purposes related to insurance applications, underwriting, or claims settlement, from sources such as other insurers, reinsurers, insurance brokers, authorized agencies, medical facilities, doctors, or insurance agents and brokers.

Compliance Preparation

Insurance companies operating in Thailand should review their existing consent mechanisms and privacy documentation to ensure compliance with these forthcoming requirements once finalized.

RELATED INSIGHTS​ 

December 10, 2024
Thailand’s Ministry of Finance (MOF) has issued a new notification easing foreign shareholding and board limits for life insurers. This long-awaited update aligns with the draft notification that was previewed in May 2024, and reflects the MOF’s intention to enhance the stability and competitiveness of life insurers. Life Insurer Qualifications Life insurers may apply for permission to exceed 49% foreign shareholding or have a majority of foreign directors if: The life insurer operates in a manner that could harm the insured or the public, and either (1) the OIC has directed the company to improve its status or adjust its capital, or (2) the company’s actions may have a significant impact on the insurance industry, causing significant compensation burdens and affecting the company’s capital adequacy ratio (CAR); The life insurer’s shareholders are unable to increase capital; and The life insurer is unable to attract Thai investors to increase the capital necessary to ensure stability and the long-term operation of the business. Foreign Shareholder Qualifications To qualify, foreign shareholders must: Either be an insurance company or have at least 10 years of relevant experience in the insurance industry; Demonstrate financial stability and possess a credit rating (or have a parent company with a credit rating) of at least “A” from a reputable credit rating agency; Present a clear and comprehensive business plan to develop and promote the company’s efficiency and competitiveness in the industry; and Be able to make an investment that increases the company’s capital by at least THB 2 billion to maintain stability with a CAR of at least 250%. For more details on the MOF’s notification regarding criteria on foreign shareholding limits for life insurance companies, or on any issue concerning insurance regulations in Thailand, please contact Athistha (Nop) Chitranukroh at [email protected], Witchupong Chittchang at [email protected], Ajaree
December 6, 2024
Thailand’s Office of Insurance Commission (OIC) recently announced two Notifications regarding Timeframe Standards for Service Level Agreements, for both life and non-life insurance companies. Under these notifications, every insurance company is required to set out clear and specific timeframes in its service level agreement (SLA) for at least the following activities: Providing information about life and non-life insurance and offering insurance policies; Underwriting and providing after-sales services; Paying compensation under the insurance policy; and Handling complaints. The timeframes described in the SLA must not exceed those specified in the insurance policy or by the relevant laws, and the SLA (which must be published on the insurer’s website) must be continually updated to reflect any changes in the timeframes. Insurance companies are required to disclose the standard timeframes for SLAs on their website by January 1, 2025, and notify the OIC through the channels and methods specified by the OIC. For more details on the OIC’s notifications on SLA timeframe standards, or on any aspect of insurance regulations in Thailand, please contact Athistha (Nop) Chitranukroh at [email protected], Witchupong Chittchang at [email protected], Ajaree Trachukul at [email protected], Thammapas Chanpanich at [email protected], or Sireethorn Wijan at [email protected].
December 4, 2024
Thailand Legal Basics, a valuable primer for foreign investors, explores all aspects of living and doing business in Thailand. Written by specialists at Tilleke & Gibbins in Bangkok, it is the only comprehensive English-language guide to the Thai legal system with a focus on the concerns of foreign business and investment.
October 9, 2024
Thailand’s Anti-Money Laundering Office has released new guidelines on customer due diligence (CDD) for insurance companies to outline anti-money laundering and counter-terrorism financing measures based on the Anti-Money Laundering Act B.E. 2542 (1999). The previous guidelines were revoked and replaced by these guidelines. The guidelines include seven key measures: Anti-money laundering and counter-terrorism financing policy: Insurance companies must establish a policy in Thai that outlines the organization’s approach to assessing, managing, and mitigating risks related to money laundering, terrorism financing, and proliferation. Risk management framework: Insurance companies’ frameworks for risk management are to be divided into three stages: (1) internal risk management, (2) risk assessment before customer onboarding, and (3) ongoing customer risk management. CDD before engagement with customers: Insurance companies must implement a rigorous approval process to verify customers’ identities. Customer information review and transaction monitoring: Insurance companies must update customer information and the list of banned transactions to ensure compliance with current risk profiles. Enhanced CDD for high-risk clients: Insurance companies must apply a stricter level of verification and monitoring measures for high-risk clients, including reviews of financial transactions. Third-party reliance and subsidiary controls: Reliance on third parties is allowed only in processes for customer identification and verification of identity. Internal controls and policies for subsidiaries or affiliates must be updated regularly. Suspicious transaction reporting: Insurance companies must report any suspicious transactions, particularly whenever CDD is not available. For more details on the CDD guidelines, or on any aspect of insurance and anti-money laundering regulations in Thailand, please contact Athistha (Nop) Chitranukroh at [email protected], Witchupong Chittchang at [email protected], Ajaree Trachukul at [email protected], or Sireethorn Wijan at [email protected].