You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

March 20, 2026

Thailand Ties Data Center Tax Breaks to Workforce and Supply Chain Development

Subscribe to Updates

Thailand’s Board of Investment (BOI) now requires data center projects to demonstrate measurable benefits for local workforce development, R&D, SME capability, and domestic supply chains to qualify for corporate income tax (CIT) exemptions. BOI Notification No. Por. 3/2569, issued on February 6, 2026, updates the requirements for projects seeking promotion under BOI category 8.2.1 (data centers).

All data center projects must now submit and implement plans covering development of Thai human resources and domestic supply chain support before benefiting from any CIT exemption.

Human Resources Development Plan

The BOI seeks to promote local talent development beyond basic training. Plans must include the following elements:

  • Training for data center design, construction, and operations targeting vocational students, engineering and ICT undergraduates and postgraduates, and energy and building personnel in Thailand.
  • Joint curricula with Thai universities and technical institutes.
  • Collaborative R&D with Thai nationals or institutions in areas including AI, resource allocation, high-performance computing, and data center hardware and systems.
  • Thai SME upskilling in electrical and energy systems and IT services.

Domestic Supply Chain Support Plan

Plans must demonstrate knowledge transfer in design, construction, cooling, security, and power and water management. Projects must also include usage or installation of domestically manufactured equipment or engage specialist domestic entities.

Criteria for BOI Evaluation

The BOI will assess data center operators’ eligibility for CIT incentives based on two criteria:

  • Scale requirement: Training and joint-curriculum initiatives must reach a total participants equal to at least 10 times the project headcount and run for the duration of the CIT incentive. If this threshold is not met, the applicant must also implement continuous R&D or SME skills-development plans throughout the incentive period.
  • Substantiality test: Supply-chain plans must be substantive, meet industry standards, and show measurable development of the domestic digital and data center supply base.

To ensure compliance, the BOI will conduct two-stage verification. Before using CIT exemptions, applicants must provide evidence of binding commitments, such as agreements with educational institutions or agencies. At full project startup, the BOI will cross-check plans against the BOI application, including any amendments, financial statements, accounting records, and partner confirmation letters.

Outlook

The BOI now ties incentives to measurable local impact. Projects must commit to sustained investment in Thai talent, R&D, and domestic suppliers. Investors should integrate these requirements into project planning from the start to secure and fully benefit from BOI tax incentives.

Related Professionals

Industries

Technology

Practices

Corporate/M&A

Location

RELATED INSIGHTS​ 

February 26, 2023
Vietnam’s Ministry of Information and Communications (MIC) has been working to replace the outdated 2009 Telecom Law with a new version more suited to today’s digital economy. A draft Telecom Law was made available for public consultation from October 27 to December 27, 2022. On January 17, 2023, the MIC submitted an amended draft (the “Draft”) to the Ministry of Justice for appraisal (the Vietnamese version of the Draft and accompanying documents in the dossier can be accessed here). The Draft is scheduled to be discussed by the National Assembly in May 2023 and submitted for approval in October 2023. The key content and changes of the Draft as compared to the existing law are set out below. 1. Licensing Telecom Services For domestic enterprises, the 2009 Telecom Law only provides two types of licenses—telecom network establishment licenses and telecom service business licenses—without differentiating the conditions and licensing procedures for various types of telecom services. This no longer meets management requirements and does not encourage enterprises to participate in providing new services on already existing infrastructure. Although the Draft retains the two main types of licenses—licenses to provide telecom services with network establishment for a term of not more than 15 years; and licenses to provide telecom services without network establishment with a term of no more than 10 years—it also provides different licensing conditions for different types of telecom service provision, with three kinds of licensing: (i) individual licenses for certain enterprises with specific conditions and obligations based on telecom management objectives at the time of licensing; (ii) class licenses for businesses that meet the prescribed licensing conditions; and (iii) registration, which requires businesses only to submit registration information according to the prescribed form to be licensed. In addition, to avoid the situation of licensed telecom network enterprises
Read More
February 24, 2023
Noppparat Lalitkomon, head of Tilleke & Gibbins’ data protection team in Thailand, has prepared the Thailand contribution for the Data Privacy Trends and Topics Report, published by Lex Mundi. The report provides brief overviews of recent and upcoming regulatory and legal developments concerning data privacy in the jurisdictions of Lex Mundi member firms in 53 jurisdictions around the world. Drawing on the expertise of Lex Mundi member firms from around the world, the report features local insights to help businesses handle cross-border data and cybersecurity challenges. Lex Mundi has also compiled a global overview of how firms in each region assess the likelihood of significant changes to the data protection landscape in 2023. Notably, Asia and the Pacific is identified as the region most likely to undergo changes, with 73% of reporting firms expecting significant developments in their jurisdictions. The report containing all 53 contributions—grouped by world region—is available on the Lex Mundi website or through the button below.
Read More
February 16, 2023
Thailand has issued a Royal Decree on the Supervision of Regulated Digital Identification Authentication and Verification Service Businesses B.E. 2565 (2022) (the “Royal Decree”), aimed at regulating business operators that provide digital identification authentication and verification services (“Digital ID Services”). The Royal Decree was published in the Government Gazette in December 2022, and will take effect 180 days from the publication date, i.e., on June 21, 2023. The key details and requirements of the Royal Decree are as follows: Regulated Digital ID Services Under the Royal Decree, the provision of the following Digital ID Services requires prior approval from the Electronic Transaction Development Agency: Identity verification service – Services for collecting and identifying information relating to the identity of a person, and verifying the connections between the person and the identity. Authenticator issuance and management service – Services relating to the connection between a person who has passed the identification process with an authenticator, and managing actions which are used to identify a person. Authentication service – A process to authenticate a person by inspecting his/her authenticator. Digital ID networks/systems – Provision of networks or systems used to exchange information for digital identification purposes, excluding services provided by an intermediary. Exempted Digital ID Services The Royal Decree also specifies a list of Digital ID Services that are exempted from supervision under the Royal Decree, as follows: Issuance of certificates to support the use of electronic signatures in accordance with the Electronic Transaction Act. Digital ID Services conducted for use within the operator’s own business only, and which do not involve the provision of such services to third parties. Other Digital ID Services as prescribed by the Electronic Transaction Committee. Qualifications of Business Operators The types of business operators qualified to operate Digital ID Services include (i) private limited companies;
Read More
February 10, 2023
On January 16, 2023, Thailand’s Securities and Exchange Commission (SEC) prescribed a set of security measures that digital asset business operators must implement if they provide custody of digital assets for their customers. The new security measures are prescribed in two notifications from the SEC and its office on digital asset wallet management systems and cryptographic key management systems, with the aim of safeguarding digital assets in custody against loss, fraud, and cybertheft. The notifications took immediate effect. The new security measures and the management systems are summarized below. Policy and guidelines for managing systems related to digital asset custody Digital asset business operators must have a written risk management policy for all systems relating to digital asset custody, approved by their board of directors and made accessible to all employees. The policy must be reviewed or revised at least once annually, or promptly if any potential risks are identified. Specific procedures must be implemented, such as establishment of a compliance team and internal controls. Management of systems for digital asset wallets and cryptographic keys Digital asset business operators must have policies and procedures for managing all systems relating to digital asset custody. This includes properly designing, developing, and managing digital asset wallets in a safe and secure manner. The same requirement on policies and procedures applies to cryptographic key management as well. Management of incidents that may affect systems related to digital asset custody Digital asset business operators must have measures in place to manage incidents that may impact systems related to digital asset custody. The measures include designating a person responsible for incident management, testing and reviewing the incident management policy annually, reporting any incidents affecting digital asset custody to the designated responsible person and the SEC immediately, and conducting a digital forensic investigation with an independent
Read More