You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 11, 2026

Thailand Set to Overhaul Its E-Transactions Framework

Subscribe to Updates

Thailand’s Electronic Transactions Development Agency (ETDA) has released a revised draft Electronic Transactions Act (ETA) for public hearing from May 12, 2026, to June 15, 2026. This is not merely an amendment to certain provisions of the current ETA, but a comprehensive redrafting of the entire act.

The revised draft ETA introduces several significant changes from the current framework, with practical implications for businesses operating in Thailand.

Unified Coverage of Public and Private Sectors

The current law segregates government transactions into a separate chapter with distinct rules. The draft ETA eliminates this division, defining “transaction” to encompass civil and commercial juristic acts as well as administrative procedures, administrative contracts, and other acts of government agencies.

Enhanced E-Signature Definition

The definition of “electronic signature” is broadened to expressly include biometric data and refocused on identifying the signatory and demonstrating intent regarding the content of the electronic data.

Shift in Burden of Proof

When a party challenges the reliability of electronic data created using a “trusted electronic method” or a method prescribed by the ETDA, the burden of proof and the cost of proving unreliability shifts to the challenger.

Introduction of New Digital Method Concepts

The draft ETA introduces several new digital method concepts that are not currently recognized under the existing ETA framework. These include:

  • Electronic timestamping (e-timestamp)
  • Electronic registered delivery
  • Electronic company seals
  • Electronic stamp duty compliance
  • Electronic identity authentication and verification
  • Electronic transferable records (electronic bills of lading, promissory notes, and similar negotiable instruments)

Recognition of Automated Systems and Electronic Contracting

The draft ETA expressly recognizes the legal validity and enforceability of contracts formed through automated systems, including contracts concluded entirely between automated systems or between an automated system and a person. A party may not deny the binding effect of such contracts solely because no human review or intervention was involved in the transaction process.

The draft, however, also introduces safeguards for unexpected automated actions. Where an automated system acts in a manner that could not reasonably have been anticipated by the party using the system, the action may not be legally binding if the counterparty knew or should reasonably have known that such action was unintended or unforeseeable.

In addition, the draft ETA provides protection for input errors made by individuals interacting with another party’s automated system. If the system does not provide a means to correct the error, the individual may withdraw the erroneous electronic communication, provided that notice of the error is given promptly after discovery; and the individual has not received or benefited from the relevant goods or services.

These new requirements would impact the use of AI, especially agentic AI, in business operations.

New Obligations for E-Transaction Service Providers

The draft ETA proposes to replace the current mandatory licensing regime applicable to certain electronic transaction businesses with a voluntary certification framework.

The draft ETA identifies seven categories of electronic transaction services: (1) identity verification, (2) electronic signature services, (3) timestamping, (4) electronic data transmission and storage, (5) website or domain name registration/certification, (6) electronic transferable record systems, and (7) other services prescribed by ministerial regulation. Service providers in these categories must comply with detailed operational duties, including maintaining reliable systems, processes, and personnel; implementing risk management frameworks; publishing electronic channels for complaints; and enforcing cybersecurity measures together with protocols for notifying, remedying, and mitigating damage from incidents.

Providers that clearly disclose the purpose and limitations of their services are shielded from liability where users act outside or beyond those disclosed boundaries.

Shifting Criminal Penalties to Civil Liability

The draft ETA removes the existing criminal penalties imposed on service providers operating without the required license, registration, or notification. These violations currently carry penalties of imprisonment for up to three years and/or fines of up to THB 300,000. This change aligns with the draft ETA’s shift from a mandatory licensing regime to a voluntary certification framework. Under the proposed framework, enforcement would instead focus on civil liability. In particular, service providers that fail to comply with their duties prescribed in the Draft ETA may be held liable for damages suffered by users or other relevant parties.

Implications for Businesses

The draft ETA carries several key implications for businesses operating in Thailand:

  • Digital-first policy. Organizations should evaluate whether internal workflows—especially government filings, notices, and contract execution—can migrate to fully electronic processes.
  • E-signatures and biometrics. Organizations using biometric authentication (fingerprints, facial recognition) for contract execution will have clearer statutory backing but must ensure compliance with Thailand’s Personal Data Protection Act.
  • Burden of proof. Businesses should proactively align their systems with ETDA-prescribed standards.
  • New digital methods. Businesses may rely on e-signatures, e-stamping, e-delivery, and digital identity verification with greater legal certainty, reducing operational friction and supporting digital transformation.
  • Automated systems. Businesses should review their internal procedures and legal limitations for automated systems, AI tools, and digital contracting.
  • Licensing regime. The draft ETA shifts from regulatory approval to a standards-based framework. While licensing burdens may decrease, greater emphasis will be placed on ETDA-prescribed standards, operational reliability, and civil liability.
  • Civil liability shift. Despite reduced criminal exposure, service providers must maintain compliance and operational standards, as failures may result in civil liability for damages.

Next Steps

After the public hearing, the draft ETA will be revisited and further proposed to the parliament for consideration and approval before enactment. This process may take up to a year.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

March 12, 2024
Thailand’s Ministry of Finance has issued the Notification re: Criteria, Methods and Conditions for Applying for and Issuing Licenses to Operate Virtual Bank Business, which was published in the Government Gazette on March 4, 2024. This notification opens an opportunity for qualified experts in technology, digital services, and diverse data usage fields to apply for virtual bank licenses to provide financial services through new digital channels. The main goal is to serve the financial needs of target groups that may not have received sufficient or tailored financial services from the traditional banking system. Licensing Timeline Application submission period: 6 months (March 20–September 19, 2024). Announcement of successful applicants: Mid-2025 (approx. 9 months–1 year from the end of the submission period) After the announcement, successful licensees must demonstrate their readiness to commence virtual bank operations within 1 year (extendable for up to 1 additional year) via the following: Having paid-up registered capital of THB 5 billion and plans to increase the paid-up registered capital to at least THB 10 billion after the initial business period; Establishment or adjustment of a financial business group; Procurement of human resources, IT systems, and relevant risk management tools. Number of Licenses to be Issued No written or specified limit, subject to the discretion of the Bank of Thailand (BOT). Key Qualifications Applicants must have the following: Experience and resources to support virtual banking operations according to the business model and plan. Expertise and experience in conducting business that utilizes technology and provides services through digital channels. Experience demonstrating the ability to obtain, access, manage, and utilize data, including development of systems or data connections to facilitate user activities, allowing them to use their data to conduct transactions with other providers. Criteria In assessing applicants’ qualifications for a virtual bank license, the BOT will consider
Read More
February 27, 2024
Thailand’s National Cyber Security Committee (NCSC) released three notifications under the Cybersecurity Act on January 18, 2024, setting cybersecurity-related requirements for key organizations and assets. While one of these notifications already took effect, the two most notable will take effect on January 18, 2025 (i.e., one year from their publication in the Government Gazette). These two are the NCSC Notification Re: Standards for Defining the Security Category for Data or Information Systems B.E. 2566 (2023) (“Notification on Security Category”) and the NCSC Notification Re: Minimum Standards for Data and Information Systems B.E. 2566 (2023) (“Notification on Minimum Standards”). These notifications apply to: State agencies; Supervising or regulating organizations (i.e., state organizations, private organizations, or persons designated by law to regulate or supervise the affairs of state organizations or critical information infrastructure organizations); and Critical information infrastructure organizations (i.e., organizations related to or providing national security, significant public services, banking and finance, information technologies and telecommunications, transportation and logistics, energy and public utilities, and public health). Collectively these are defined as “Organizations” under the notifications. Notification on Security Category The Notification on Security Category sets forth risk-based security classifications—or “security categories”—for Organizations’ data or information systems. For security category assessment purposes, Organizations are required to perform a self-assessment of their data or information systems based on three key security objectives: confidentiality, integrity, and availability. Each of these objectives is further categorized into three risk levels (low, medium, and high), taking into account the assessment of potential impact in the following areas: Organizations’ financial value or reputation; Organizations’ number of service users; Organizations’ ability to perform their duties; State stability or public order. The risk levels for the three objectives are determined by considering whether there are “minimal,” “severe,” or “serious severe” effects, as described below: Confidentiality (not including data classified
Read More
February 2, 2024
The pervasive global issue of illicit personal data trading has extended its reach into Vietnam, where such sensitive information is being sold at minimal costs. A 2023 report from the Ministry of Public Security revealed that over two-thirds of the Vietnamese population has fallen victim to unlawful data collection and distribution. In the past two years, authorities have pressed charges on five criminal cases involving the buying and selling of billions of items of personal data, encompassing a wide range of sensitive information such as names, phone numbers, email addresses, and more. Notably, a person’s profile can be acquired for just USD 1, while profiles of millions of business customers can be obtained for a mere USD 100. Recognizing the severity of the problem, Vietnam has made serious efforts to combat illicit personal data trading by criminal means, encompassing both the legal framework and practical implementation.   Understanding the Criminal Legal Framework Vietnam’s 2015 Criminal Code, as amended in 2017, functions as a pivotal legal instrument delineating offenses and their corresponding punishments. Under Section 2 of Chapter XXI of the Criminal Code (“Offenses Against Regulations on Information Technology and Telecommunications Networks”), individuals engaging in the illicit trading of personal data, depending on the nature of the data (e.g., information about phone number, address, or—more dangerously—bank account) and the nature of the infringing acts, may be charged under different crimes. The sanctions can include monetary fines; non-custodial reform; imprisonment; and/or prohibition from holding certain positions, practicing certain professions, or doing certain jobs. For example, for the illicit trade of private information of an individual on a computer or telecommunications network, Article 288 of the Criminal Code specifies penalties including a monetary fine of up to VND 1 billion (equivalent to around USD 41,000); non-custodial reform of up to three years;
Read More
January 30, 2024
Thailand has made its draft Platform Economy Act (the “Draft PEA”) available to relevant entities in certain industries. The Draft PEA aims to regulate and standardize digital platform service business operations and protect consumers and other stakeholders. Once the Draft PEA becomes law, the Royal Decree on the Operation of Digital Platform Service Businesses that are subject to Prior Notification B.E. 2565 (2022) and the relevant provisions under the Electronic Transactions Act B.E. 2544 (2001), as amended, will cease to have effect. The key provisions of the Draft PEA are summarized below. Definitions The definitions of the key terms under the Draft PEA are substantially similar to the definitions of the key terms under the royal decree mentioned above. According to the Draft PEA, “digital platform services” refers to the provision of electronic intermediary services that manage data to facilitate connection, through computer networks, between business users, consumers, or users, regardless of whether remuneration is charged. Exemption The Draft PEA does not apply to digital platform services (DPSs) that are regulated by specific laws and have rules guaranteeing transparency and fairness, or that follow operational standards no less stringent than those required in the Draft PEA. Nonetheless, the Electronic Transactions Development Agency (ETDA) can request or link data relating to exempted DPSs from the relevant supervisory authorities. Extraterritorial Effect Offshore DPSs with certain characteristics are also subject to the obligations under the Draft PEA and will have to appoint a coordinating person in Thailand. However, offshore DPSs will not have to establish a business in Thailand. General Responsibilities and Obligations The Draft PEA sets out the following requirements: DPSs with (1) at least THB 100 million (approx. USD 2.8 million) in annual revenue from providing the DPSs in Thailand before deducting expenses, or (2) more than 10,000 monthly users
Read More