You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 10, 2026

Thailand Launches Public Consultation on Draft Data-Sharing Law

Subscribe to Updates

On July 31, 2026, Thailand’s Big Data Institute (BDI) launched a public consultation on the principles of a proposed new data-sharing law, with comments accepted until August 31, 2026. If enacted, the law would establish Thailand’s first comprehensive framework for government and private-sector data sharing, creating a systematic, secure, and transparent regime to support analytics, policymaking, research, and innovation.

Central Data-Sharing Platform

The draft law establishes a central system for data sharing, managed by the BDI. Government agencies would be required to connect to the BDI’s Data Integration and Intelligence Platform (also referred to as D2), in accordance with the BDI’s rules and procedures.

Five Dimensions of Data Sharing

The draft law covers five key types of data sharing between government (G), businesses (B), and consumers (C):

  • G2B: Private organizations may request government data specifically for research and development purposes. The BDI will assess the applicant’s data governance, security, and privacy capabilities whether such measures meet prescribed standards before forwarding the request to the relevant government agency within 90 days. Any dispute may be escalated to a newly established Data-Sharing Promotion Committee for final determination.
  • G2G: Government agencies may request data from other agencies through the central system. The data-holding agency must respond within 90 days, taking legality, necessity, proportionality, public interest, and personal data protection into account. Disputes may be referred to the Data-Sharing Promotion Committee for adjudication.
  • B2G: In emergency situations involving public safety, economic security, or disaster response, the Minister of Digital Economy and Society may require private entities to provide data through the central data-sharing system. Government agencies must specify the data requested, demonstrate its necessity and expected benefits, and request only data reasonably available to the data holder. Requests for personal data must be limited to the minimum amount necessary.
  • B2C: Royal decrees may require businesses in designated sectors to share customer data or business data with consumers or authorized third parties to promote consumer rights and competition. The relevant royal decree must specify at least the covered sectors, categories of data to be shared, eligible recipients, technical standards, exemptions, conditions for disclosure, and oversight mechanisms.
  • B2B: Data sharing between businesses is governed by freedom of contract and is subject to applicable laws, including data protection and competition laws. To promote trust, the government will issue a nonbinding framework on trusted data-sharing and a voluntary certification system for providers of data-sharing services, under which certified providers may display a recognized trust mark indicating compliance with prescribed standards.

Key Provisions of the Draft Law

The draft law addresses several additional areas of note:

  • Personal data protections. Where government data requested for sharing contains personal data, the data-holding agency must either deidentify the data, obtain data-subject consent, or confirm that a lawful basis for disclosure under the Personal Data Protection Act applies. In B2G emergencies, pseudonymized personal data may only be requested if nonpersonal data is demonstrably insufficient, and the Office of the Personal Data Protection Committee must be promptly notified.
  • Documentation and transparency. Government agencies and private organizations that receive and use government data in accordance with the law must submit details of the relevant data sharing agreement to the BDI within 15 days executing it. The BDI will make details of such agreements publicly available.
  • Data-Sharing Promotion Committee composition. The new Data-Sharing Promotion Committee mentioned above will be chaired by the Minister of Digital Economy and Society and comprises 10 ex-officio members and six expert members. The committee will issue regulations and policy recommendations, resolve disputes, oversee the voluntary certification of data-sharing service providers, and monitor implementation of the data-sharing regime.
  • Enforcement. Noncompliance is classified as a pinai (civil fine) offense. Civil fines apply to private entities that refuse to share data following a ministerial emergency order, and to designated business operators that fail to share consumer or business data as required by royal decree. No criminal penalties are imposed under the draft law.
  • Voluntary certification for data-sharing service providers. The draft law introduces a voluntary certification regime for data-sharing service providers, including data intermediaries, deidentification service providers, and secure access data service providers. Providers that meet prescribed standards may register with the Data-Sharing Promotion Committee and obtain a trust mark.

Impact on Private Sector

Companies operating in Thailand should be aware of several key implications:

  • Emergency data-sharing obligations. Private entities may be required by ministerial order to connect their systems and share data during declared national emergencies, with civil fines for noncompliance.
  • Sector-specific consumer data-sharing mandates. Businesses in sectors designated by royal decree—such as banking, insurance, e-commerce, or telecommunications—may be required to share customer data and business data at the request of consumers, comparable to “smart data” schemes in the UK and other jurisdictions. Such royal decrees may impose additional compliance requirements and designate a regulator for oversight and enforcement.
  • New opportunities for data-driven innovation. The new framework may enable qualifying businesses to access government data for research and development, creating opportunities to develop new products, services, and analytical capabilities.

Companies and other stakeholders should review the draft principles of the proposed data-sharing law and consider submitting comments during the public consultation period, which is open through August 31, 2026.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

January 9, 2026
Thailand continues to advance its legal and regulatory framework for the technology sector, with several key laws undergoing review and proposed amendments. These developments reflect Thailand’s broader efforts to ensure that its regulatory landscape keeps pace with rapid technological change and aligns more closely with international standards and best practices. The following are key legal developments and proposed legislative reforms in 2026 that are expected to impact businesses operating in the technology sector and the broader Thai business landscape. Data Privacy and Cybersecurity Personal Data Protection Act B.E. 2562 (2019) Following the full enforcement of Thailand’s Personal Data Protection Act (PDPA) in June 2022, businesses and practitioners have identified practical implementation challenges and interpretative issues. These challenges were reflected in an effectiveness assessment conducted by the Personal Data Protection Committee (PDPC) in late 2024. The PDPC published a set of principles for public consultation to identify issues and directions for potential amendments to the PDPA. Key issues: Emerging issues include clarifying the definitions of “data controller,” “data processor,” and “criminal record”; revisiting the scope of sensitive personal data to better reflect Thailand’s context; proposing amendments to the hierarchy of legal bases to avoid misconceptions of consent as the default legal basis; and clarifying the required level of expressiveness for explicit consent, as well as rules for collecting personal data from other sources. Current status: The first round of public consultation has concluded. Next steps: The proposed amendments are proceeding to a revised draft following the consultation outcomes. Cybersecurity Act B.E. 2562 (2019) Thailand is moving forward with proposed amendments to enhance the effectiveness of its national cybersecurity framework, as evolving digital technologies bring new risks such as misinformation, system intrusions, and attacks on critical infrastructure, making cybersecurity a national priority. Key issues: The amendments aim to clarify and strengthen
Read More
January 8, 2026
Thailand’s Digital Government Development Agency (DGA) has proposed new standards that would require government agencies to select cloud services exclusively from a preapproved shortlist of providers. The draft Digital Government Standards re: Cloud Service Provider Standards aims to strengthen procurement confidence and reduce risks associated with selecting cloud service providers that do not meet the required standards. A public hearing period on these standards concluded on December 27, 2025. The DGA will now review submitted comments and consider revising the standards accordingly. Shortlisted Cloud Service Provider Tiers The draft standards establish three tiers of cloud service providers based on their assessed service capability levels, core qualifications, and certifications. The DGA sets qualification requirements for each tier, and it is at the discretion of each agency to select the tier of cloud service provider that best suits its operational needs, as follows: Tier 1 cloud service providers are suitable for providing services involving disclosable official data. Tier 2 cloud service providers are suitable for handling official data and protected data, such as personal data, which requires a high-security public cloud (e.g., virtual private cloud). Tier 3 cloud service providers are suitable for providing services to agencies with specific regulatory and security requirements that handle highly protected data, such as the national security system. These providers must offer sovereign or hybrid cloud as stipulated by the Ministry of Digital Economy and Society. All tiers of cloud service providers must be legal entities incorporated under Thai law and can be authorized distributors of offshore cloud service providers. However, each tier will be subject to different requirements, including infrastructure obligations. Government agencies are encouraged to select a cloud service provider appropriate for their intended use. For example, if a government agency intends to procure cloud services for operating applications that process personal data,
Read More
January 8, 2026
Thailand has enacted comprehensive sexual harassment legislation that significantly expands criminal penalties and creates new compliance obligations for online platform operators. The Act Amending the Penal Code (No. 30) B.E. 2568 (2025), enacted on December 29, 2025, and taking effect the following day, introduces a comprehensive definition of sexual harassment, establishes new criminal offenses with graduated penalties, and imposes content removal obligations on social media platforms and computer system service providers. The amendment, which establishes a comprehensive framework for addressing sexual harassment in both physical and digital environments, significantly expands legal exposure for online service operators. It also grants courts authority to order takedowns of violating data accessible to the public. Definition of Sexual Harassment The law introduces “sexual harassment” as a distinct statutory concept covering physical conduct, verbal conduct, sounds, gestures, expressions, postures, communications, surveillance, stalking, and acts committed through computer systems or electronic devices. Conduct qualifies as sexual harassment when it is sexual in nature and likely to cause the victim distress, annoyance, embarrassment, humiliation, fear, or a sense of sexual insecurity. Criminal Offenses and Penalties The amended Penal Code establishes graduated penalties based on the severity and context of the harassment—including enhanced penalties for public or online conduct. For instance: Basic sexual harassment is punishable by imprisonment for up to one year, a fine of up to THB 20,000, or both. Continuous or repeated harassment that prevents normal life escalates penalties to imprisonment for up to two years, a fine of up to THB 40,000, or both. Critically for online operators, harassment committed in public places, in the presence of the public, or through computer systems accessible to the general public triggers imprisonment for up to three years, a fine of up to THB 60,000, or both. Acts of harassment committed by supervisors, employers, or others
Read More
January 6, 2026
On December 30, 2025, Thailand’s Electronic Transactions Development Agency (ETDA) notified digital marketplace operators of a consolidated list of “high‑risk products” that are subject to strict monitoring on digital platforms. The list was jointly prepared by the Thai Industrial Standards Institute (TISI) and the Food and Drug Administration (FDA) to guide platform compliance in the initial phase of implementation of the Electronic Transaction Committee’s Notification on Other Measures for Marketplace for Goods with Specific Characteristics under Section 18(2) of the 2022 Royal Decree on Digital Platform Businesses Requiring Notification B.E.2568 (2025). The notice is addressed to operators of digital platform services that function as product marketplaces with specific characteristics laid out in the notification. The ETDA states that the TISI and the FDA are closely monitoring the high‑risk product categories on digital platforms, and the published list serves as the baseline reference for platform screening during the initial phase of the notification’s implementation. High‑Risk Product List The list aggregates categories of products that are illegal to sell online or are otherwise tightly regulated under Thai law, with an emphasis on health-related products, controlled substances, medical devices, and a wide range of industrial products that require certification or compliance with specified Thai Industrial Standards, as detailed below. Prohibited and tightly controlled health products. This includes all categories of modern medicines subject to control other than general household remedies; all categories of controlled herbal products except for over-the-counter herbal products; narcotics; psychotropic substances; and medical devices requiring use in medical facilities or a physician’s prescription. Selected industrial products requiring heightened controls. The list highlights dozens of TISI-regulated items commonly sold online. Examples include pacifiers, rice cookers, electrical wire, food wrap film, crayons, washing machines and dryers, air conditioners, electric cookers and air fryers, water heaters, microwave ovens, LED luminaires, hair dryers
Read More