You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

June 11, 2026

Thailand Set to Overhaul Its E-Transactions Framework

Subscribe to Updates

Thailand’s Electronic Transactions Development Agency (ETDA) has released a revised draft Electronic Transactions Act (ETA) for public hearing from May 12, 2026, to June 15, 2026. This is not merely an amendment to certain provisions of the current ETA, but a comprehensive redrafting of the entire act.

The revised draft ETA introduces several significant changes from the current framework, with practical implications for businesses operating in Thailand.

Unified Coverage of Public and Private Sectors

The current law segregates government transactions into a separate chapter with distinct rules. The draft ETA eliminates this division, defining “transaction” to encompass civil and commercial juristic acts as well as administrative procedures, administrative contracts, and other acts of government agencies.

Enhanced E-Signature Definition

The definition of “electronic signature” is broadened to expressly include biometric data and refocused on identifying the signatory and demonstrating intent regarding the content of the electronic data.

Shift in Burden of Proof

When a party challenges the reliability of electronic data created using a “trusted electronic method” or a method prescribed by the ETDA, the burden of proof and the cost of proving unreliability shifts to the challenger.

Introduction of New Digital Method Concepts

The draft ETA introduces several new digital method concepts that are not currently recognized under the existing ETA framework. These include:

  • Electronic timestamping (e-timestamp)
  • Electronic registered delivery
  • Electronic company seals
  • Electronic stamp duty compliance
  • Electronic identity authentication and verification
  • Electronic transferable records (electronic bills of lading, promissory notes, and similar negotiable instruments)

Recognition of Automated Systems and Electronic Contracting

The draft ETA expressly recognizes the legal validity and enforceability of contracts formed through automated systems, including contracts concluded entirely between automated systems or between an automated system and a person. A party may not deny the binding effect of such contracts solely because no human review or intervention was involved in the transaction process.

The draft, however, also introduces safeguards for unexpected automated actions. Where an automated system acts in a manner that could not reasonably have been anticipated by the party using the system, the action may not be legally binding if the counterparty knew or should reasonably have known that such action was unintended or unforeseeable.

In addition, the draft ETA provides protection for input errors made by individuals interacting with another party’s automated system. If the system does not provide a means to correct the error, the individual may withdraw the erroneous electronic communication, provided that notice of the error is given promptly after discovery; and the individual has not received or benefited from the relevant goods or services.

These new requirements would impact the use of AI, especially agentic AI, in business operations.

New Obligations for E-Transaction Service Providers

The draft ETA proposes to replace the current mandatory licensing regime applicable to certain electronic transaction businesses with a voluntary certification framework.

The draft ETA identifies seven categories of electronic transaction services: (1) identity verification, (2) electronic signature services, (3) timestamping, (4) electronic data transmission and storage, (5) website or domain name registration/certification, (6) electronic transferable record systems, and (7) other services prescribed by ministerial regulation. Service providers in these categories must comply with detailed operational duties, including maintaining reliable systems, processes, and personnel; implementing risk management frameworks; publishing electronic channels for complaints; and enforcing cybersecurity measures together with protocols for notifying, remedying, and mitigating damage from incidents.

Providers that clearly disclose the purpose and limitations of their services are shielded from liability where users act outside or beyond those disclosed boundaries.

Shifting Criminal Penalties to Civil Liability

The draft ETA removes the existing criminal penalties imposed on service providers operating without the required license, registration, or notification. These violations currently carry penalties of imprisonment for up to three years and/or fines of up to THB 300,000. This change aligns with the draft ETA’s shift from a mandatory licensing regime to a voluntary certification framework. Under the proposed framework, enforcement would instead focus on civil liability. In particular, service providers that fail to comply with their duties prescribed in the Draft ETA may be held liable for damages suffered by users or other relevant parties.

Implications for Businesses

The draft ETA carries several key implications for businesses operating in Thailand:

  • Digital-first policy. Organizations should evaluate whether internal workflows—especially government filings, notices, and contract execution—can migrate to fully electronic processes.
  • E-signatures and biometrics. Organizations using biometric authentication (fingerprints, facial recognition) for contract execution will have clearer statutory backing but must ensure compliance with Thailand’s Personal Data Protection Act.
  • Burden of proof. Businesses should proactively align their systems with ETDA-prescribed standards.
  • New digital methods. Businesses may rely on e-signatures, e-stamping, e-delivery, and digital identity verification with greater legal certainty, reducing operational friction and supporting digital transformation.
  • Automated systems. Businesses should review their internal procedures and legal limitations for automated systems, AI tools, and digital contracting.
  • Licensing regime. The draft ETA shifts from regulatory approval to a standards-based framework. While licensing burdens may decrease, greater emphasis will be placed on ETDA-prescribed standards, operational reliability, and civil liability.
  • Civil liability shift. Despite reduced criminal exposure, service providers must maintain compliance and operational standards, as failures may result in civil liability for damages.

Next Steps

After the public hearing, the draft ETA will be revisited and further proposed to the parliament for consideration and approval before enactment. This process may take up to a year.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

April 3, 2026
On March 16, 2026, Vietnam’s Ministry of Public Security released a draft version of a new Decree on the Prevention and Combating of Cybercrime and High-Tech Crime to replace the currently effective Decree 25/2014/ND-CP. In the draft, the ministry has proposed a comprehensive regulatory framework aimed at addressing violations occurring within the cybersecurity domain, including measures related to intellectual property. Acts of Online IP Infringement Article 9 of the draft decree notably introduces specific provisions addressing online intellectual property infringement, with detailed lists of acts considered to constitute infringement in the online environment. Copyright and related rights infringement includes: Uploading or sharing works, performances, sound recordings, video recordings, broadcasts, computer programs, software, research, documents, theses, or other intellectual creations on digital platforms without the consent of the rights holder. Unauthorized livestreaming of copyrighted television programs, sporting events, or artistic performances. Uploading, sharing, storing, transmitting, or providing links to infringing works or digital content via websites, social networks, applications, or digital platforms. Providing or using software, tools, devices, or access codes to circumvent technological protection measures or evade lawful control mechanisms implemented by rights holders. Using artificial intelligence (AI) tools to replicate the ideas or structure of another person’s work without significant new creativity or without proper attribution, thereby causing damage to the original author. Industrial property infringement includes: Manufacturing, trading, advertising, or distributing counterfeit goods bearing counterfeit trademarks, geographical indications, or industrial designs, as well as goods infringing industrial property rights through online platforms. Unauthorized registration, appropriation, or use of domain names, account names, or digital identifiers that create confusion regarding the rights holder or the origin of goods or services. Producing, using, or offering for sale products containing all or part of a patented invention via online platforms. Advertising or introducing products with technical features or characteristics identical
Read More
April 3, 2026
Thailand’s Securities and Exchange Commission (SEC) has established a comprehensive governance framework for the use of artificial intelligence and machine learning (AI/ML) in the capital markets. The framework provides guidance to capital market business operators on understanding the risks associated with AI/ML implementation and adopting appropriate practices to build public confidence in Thailand’s capital markets. While the guidelines are principle-based rather than prescriptive, they reflect the SEC’s expectations for responsible AI/ML governance and are likely to inform supervisory activities and industry standards going forward. Scope The framework applies to capital market business operators supervised by the SEC. This includes, for example, securities and derivatives firms, asset management companies, mutual fund and private fund managers, investment advisors and investment consultants (including robo-advisory service providers), derivatives intermediaries, and other licensed intermediaries and market operators in the Thai capital markets that deploy AI/ML in their operations. Core Principles of the Guidelines The framework is presented as a best-practice manual rather than prescriptive regulation, providing guidance that regulated entities may apply to their AI/ML governance and risk management as appropriate. While currently nonbinding, the guidelines signal the SEC’s expectations for the sector, particularly in relation to other binding SEC regulations such as those covering IT risk management and market conduct. The guidelines name four core principles for AI/ML deployment: Fairness: Design and develop AI/ML with consideration for fairness, equality, and social diversity to prevent discrimination against individuals or groups. Legal and ethical compliance: Ensure AI/ML use aligns with applicable laws, ethical standards, and organizational values and policies. Accountability: Establish clear responsibility—both internally and externally—for AI/ML activities and outcomes. Transparency: Provide adequate disclosure to users about AI/ML use, including explainability of decisions and traceability of activities. AI/ML Best Practices The guidelines prescribe best practices across four stages of the AI/ML lifecycle, as described below.
Read More
April 2, 2026
Thailand’s Personal Data Protection Act (PDPA) enforcement has entered a new phase, and the insurance industry is squarely in the regulatory spotlight. The Personal Data Protection Committee (PDPC) considers insurers “large-scale” processors of sensitive data—including health records, financial information, and biometric data—making the sector a focal point for enforcement action. In August 2025 alone, the PDPC issued administrative fines totaling THB 21.5 million, and fines for individual violations have ranged from THB 50,000 to THB 2 million. The PDPC has also deployed its “Eagle Eye Crawler,” an AI-driven surveillance tool that monitors websites around the clock for data leaks and noncompliant privacy notices. This article highlights the key regulatory developments directly affecting insurers and outlines practical steps toward compliance. What Has Changed: OIC and PDPC Alignment The Office of Insurance Commission (OIC) has synchronized its sector-specific rules with the PDPA through the Notification on Customer Personal Data Protection (No. 2) B.E. 2568 (2025). The combined effect of the PDPC’s general enforcement push and the OIC’s sectoral guidance creates four critical compliance areas for insurers. Consent unbundling. Consent for marketing must be strictly separated from the core insurance contract; bundling marketing consent into the policy application is no longer permissible. Agent and intermediary oversight. Insurance intermediaries are generally classified as data processors, meaning that insurers—as data controllers—must provide specific written instructions and security protocols to all agents and brokers. A 2026 enforcement trend shows controllers being held liable for the “weak security” of their vendors and downstream processors. Enhanced privacy notices. Insurers must provide a summary privacy notice alongside the full policy, plainly stating categories of data, purposes, lawful bases, disclosure recipients, cross-border transfers, retention periods, data subject rights, and easy marketing opt-out channels. DPO registration and ROPA. All organizations involved in “regular or systematic monitoring of data subjects on
Read More
March 30, 2026
On March 24, 2026, the Trade Competition Commission of Thailand (TCCT) published its long-anticipated Guidelines on Multi-Sided Platforms and E-Commerce Businesses in the Government Gazette, following the conclusion of a public hearing conducted last year. The guidelines entered into force on March 25, 2026, and significantly expand the application of Thai competition law to digital platform ecosystems. These rules introduce targeted restrictions on platform conduct, such as price-ranking algorithms and tying and bunding, that leverages network effects, and will have far-reaching implications across Thailand’s digital economy—affecting not only platform operators but also platform participants, including sellers, logistics providers, advertisers, and payment service providers operating on or alongside such platforms. The guidelines clarify how existing prohibitions under the Trade Competition Act B.E. 2560 (2017) (TCA)—including abuse of market dominance, cartel conduct, and unfair trade practices—apply in the context of platform-based business models. While many provisions reflect earlier draft guidelines, the final version delivers more precise definitions and clearer enforcement parameters, increasing regulatory certainty while also raising compliance expectations. Applicability The guidelines introduce core definitions that determine their coverage: Multi-sided platform: A platform that acts as an intermediary connecting two or more groups of users, enabling them to have direct interaction in order to exchange or rely on services from one another. Examples include digital platforms for trading goods or services (e-commerce), as defined below. Digital platform for trading goods or services (e-commerce): A platform that acts as an intermediary connecting the distribution, purchase, sale, or exchange of goods or services. This includes operations carried out to facilitate transactions or interactions between business operators through an electronic transaction system, regardless of whether a service fee is charged. Operator of a digital platform business for trading goods or services: A provider of digital platform services for trading goods or services, as described
Read More