You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 9, 2026

Thailand’s Tech Industry Outlook for 2026

Subscribe to Updates

Thailand continues to advance its legal and regulatory framework for the technology sector, with several key laws undergoing review and proposed amendments. These developments reflect Thailand’s broader efforts to ensure that its regulatory landscape keeps pace with rapid technological change and aligns more closely with international standards and best practices.

The following are key legal developments and proposed legislative reforms in 2026 that are expected to impact businesses operating in the technology sector and the broader Thai business landscape.

Data Privacy and Cybersecurity

Personal Data Protection Act B.E. 2562 (2019)

Following the full enforcement of Thailand’s Personal Data Protection Act (PDPA) in June 2022, businesses and practitioners have identified practical implementation challenges and interpretative issues. These challenges were reflected in an effectiveness assessment conducted by the Personal Data Protection Committee (PDPC) in late 2024. The PDPC published a set of principles for public consultation to identify issues and directions for potential amendments to the PDPA.

  • Key issues: Emerging issues include clarifying the definitions of “data controller,” “data processor,” and “criminal record”; revisiting the scope of sensitive personal data to better reflect Thailand’s context; proposing amendments to the hierarchy of legal bases to avoid misconceptions of consent as the default legal basis; and clarifying the required level of expressiveness for explicit consent, as well as rules for collecting personal data from other sources.
  • Current status: The first round of public consultation has concluded.
  • Next steps: The proposed amendments are proceeding to a revised draft following the consultation outcomes.

Cybersecurity Act B.E. 2562 (2019)

Thailand is moving forward with proposed amendments to enhance the effectiveness of its national cybersecurity framework, as evolving digital technologies bring new risks such as misinformation, system intrusions, and attacks on critical infrastructure, making cybersecurity a national priority.

  • Key issues: The amendments aim to clarify and strengthen the roles and duties of private entities, particularly critical information infrastructure (CII) operators, in preventing, mitigating, and responding to cyber threats. Key highlights include broadening the meaning of “cyber threat” from a narrow technical focus to a holistic assessment of potential national and public impacts; introducing defined terms such as “cyber threat incident,” “computer data,” and “computer system”; strengthening risk management and incident response by CII operators; and expanding the scope of CII organizations to include public and private entities related to industrial work.
  • Current status: The third round of public consultation has concluded.
  • Next steps: The draft amendments are being revised following the consultation outcomes.

Child Online Safety

Penal Code Amendments

Recent Penal Code amendments, effective December 30, 2025, introduced provisions on sexual harassment and revised provisions on sexual assault. Offenses under these provisions that take place through online channels may result in a court order requiring the removal of the relevant content within a prescribed period, with penalties imposed for failure to comply with such a court order. Thailand is proposing further amendments to address technology-related crimes and online platform-facilitated crimes against minors, including child grooming and sexting.

  • Key issues: The proposals introduce new offenses covering online grooming, transmission of sexually explicit content to minors, and sexual extortion, alongside stricter penalties and extended extraterritorial jurisdiction, reflecting a strengthened focus on child protection in the digital environment.
  • Current status: The first round of public consultation has concluded.
  • Next steps: The Office of the Council of State will consider the draft at the third reading in January 2026.

Artificial Intelligence

AI Regulatory Framework

The Electronic Transactions Development Agency (ETDA) has continued its efforts to develop an AI regulatory framework by opening a public hearing on draft principles for future AI legislation.

  • Key issues: The proposed principles focus on a risk-based approach to AI development and deployment while supporting innovation through measures such as data reuse and sandbox mechanisms. (See more details here.)
  • Next steps: The initiative currently remains at the drafting stage, and a further public hearing on a provision-by-provision draft is expected in 2026.

Fintech

Payment Systems Act B.E. 2560 (2017)

Thailand’s payments landscape continues to be shaped by the Payment Systems Act and an active supervisory agenda from the Bank of Thailand (BOT) focused on fraud risk, interoperability, and digital-first service models.

  • Key issues: The BOT’s Guidelines for Digital Fraud Management took effect on December 17, 2025, and impose end-to-end fraud controls across prevention, monitoring, detection, and remediation for financial institutions and operators of inter-institutional fund transfer systems, e-money, and e-fund transfer services under the Payment Systems Act.

Emergency Decree on Digital Asset Businesses B.E. 2561 (2018)

Thailand’s Securities and Exchange Commission (SEC) has released relaxed digital asset regulations that pave the way for tokenization of carbon credit and renewable energy assets, expanding financing and trading options in the environmental sector.

  • Key issues: The amended regulations permit the offering, trading, and provision of other services related to tokenized carbon credits, tokenized renewable energy certificates (RECs), and tokenized carbon allowances through licensed digital asset exchanges, brokers, and dealers. This regulatory development is aimed at facilitating the green economy and the country’s net-zero goal, while increasing the diversity of products in the regulated digital assets market.

Digital Platforms

Royal Decree on the Operation of Digital Platform Service Businesses That Are Subject to Prior Notification B.E. 2565 (2022)

Thailand’s platform governance entered a more prescriptive phase in 2025-2026 as regulators moved from system registration to targeted oversight of higher-risk platform categories. In parallel, Thailand is developing a primary law, the draft Platform Economy Act (PEA), which, if enacted, is expected to supersede the royal decree and consolidate user-protection and competition tools for the platform economy.

  • Key issues: During 2025, the regulator designated online marketplaces with particular risk characteristics under section 18(2) of the royal decree and imposed additional duties focused on merchant traceability and accountability and compliance with goods standards and takedown mechanisms. With respect to the draft PEA, the principles remain under development at the Council of State, with further drafting and a subsequent hearing expected. Latest policy signals continue to envisage adoption of an EU Digital Services Act–inspired regime, with the royal decree expected to be repealed upon commencement and transitional oversight mechanisms to apply.
  • Next steps: Operators should maintain compliance with the royal decree while monitoring developments in new or amended applicable regulations, as well as the PEA’s trajectory.

Telecommunications

Foreign Satellite Operators Draft Notification

Proposed by the National Space Policy Committee (NSPC) for public consultation on August 20, 2025, with the comment period concluding on September 3, 2025, this draft aims to replace the existing notification issued in 2021 to better align with current national policies on foreign satellite usage.

  • Key issues: The draft notification permits both Thai and foreign satellite operators to use foreign satellites to operate a business providing satellite communication services within Thailand. The consideration for granting permission takes into account technical justifications, economic benefits, social benefits, and national security considerations.
  • Next steps: The draft amendments are being revised following the public consultation outcomes.

Gaming

Draft Gaming Industry Promotion Act

The draft was initially proposed by the Digital Economy Promotion Agency (DEPA) under the Minister of Digital Economy and Society (MDES) by opening a public hearing on draft principles for a future Gaming Act.

  • Key issues: The draft law aims to support the growth of Thailand’s online gaming sector while safeguarding youth and society. The draft law introduces registration requirements for developers and platforms (potentially including offshore entities), which may include a rating system. It is also expected to apply to all types of games, with particular focus on games that incorporate gambling-like features, such as lucky draw mechanisms or point-accumulation and reward-redemption systems. This reflects the Thai government’s position of combating online gambling and online scam activities.
  • Next steps: The initiative currently remains at the drafting stage, and DEPA has recently announced that it will proceed with proposing the Draft Act to the MDES for consideration and subsequent submission to the Cabinet. Further public hearing is expected within 2026.

Looking Ahead

Thailand’s technology regulatory landscape continues to develop through a combination of new legislation, subordinate regulations, regulatory guidance, and evolving enforcement priorities. Technology sector businesses should actively monitor these developments and begin preparing for possible compliance adjustments. In particular, companies should review their data governance frameworks, cybersecurity readiness, platform governance structures, and AI risk management practices to ensure they are well positioned as Thailand’s technology regulatory landscape continues to evolve.

We will continue to monitor these developments closely and provide quarterly updates to keep you informed of any significant changes or new regulatory measures impacting Thailand’s technology sector.

Related Professionals

Industries

Fintech

Technology

Location

RELATED INSIGHTS​ 

August 1, 2025
On July 21, 2025, Thailand’s National Cyber Security Agency (NCSA) released a draft amendment to the Cybersecurity Act B.E. 2562 (2019) for public hearing, aiming to address the rapid evolution of technology and increasing complexity of cyber threats. The proposed changes to the country’s cybersecurity framework would extend regulatory oversight to cloud service providers and data center operators hosting data for critical information infrastructure (CII) organizations regulated under the Cybersecurity Act. The NCSA will accept comments on the draft until August 5, 2025. Following the close of the public consultation period, the draft amendment will be subject to further revision during the legislative process. Key proposed amendments are discussed below. Expanded Critical Infrastructure Scope The Cybersecurity Act currently applies only to state agencies, supervising or regulating organizations, and designated CII organizations as announced by the National Cyber Security Committee (NCSC). It defines CII organizations as public or private organizations related to or providing national security, significant public services, banking and finance, information technologies, telecommunications, transportation and logistics, energy and public utilities, or public health. The draft amendment expands the scope of CII organizations to include public and private organizations related to or providing industrial work (to be further defined in subregulations) as well as service providers that store or possess data for CII organizations, such as cloud and data center service providers. CII organizations must comply with cyber threat reporting requirements and are subject to the NCSA’s interception powers. Updated Definitions and New Terminology The draft amendment more clearly distinguishes between “cyber threats” (which have yet to occur but have the potential of causing damage or impact) and “cyber incidents” (which have already occurred and have caused or are expected to cause damage or impact). The draft amendment also expands the definition of “cybersecurity” to explicitly cover both prevention
Read More
July 30, 2025
Artificial intelligence (AI) model training and data scraping are essential processes in the development of modern AI systems. AI model training involves using large datasets to teach machine learning algorithms to recognize patterns, make predictions, or generate new content. Data scraping refers to the automated extraction of information from websites or digital sources, often to assemble the vast datasets required for effective AI training. As these practices become more widespread, questions about the legality of using third-party content—especially copyrighted works—have become increasingly important. In Thailand, the legal landscape for AI developers is shaped primarily by the Copyright Act, which presents unique challenges due to the absence of a fair-use exception. This article examines the copyright-related risks and legal uncertainties facing AI developers under Thailand’s current copyright law and practices, offering strategic guidance for navigating this complex environment. Copyright Risks in AI Scraping and Training Thailand’s Copyright Act does not provide a broad fair use or fair dealing exception, unlike some other jurisdictions, such as the United States. This absence has significant consequences for AI developers: No general defense for AI training: Any use of copyrighted material for AI model training is presumed to be infringing unless a specific, narrow statutory exception applies or explicit permission is obtained from the rights holder. There is no general legal basis for using copyrighted works in AI training without authorization. Increased rights clearance burden: Developers must identify and secure licenses for every copyrighted work included in their training datasets. Given the scale and diversity of data required for effective AI models, this process can be both impractical and costly. Legal ambiguity and litigation risk: The lack of clear statutory guidance or case law leaves developers in a legal gray area. There is no established precedent clarifying whether certain uses of copyrighted material for
Read More
July 24, 2025
Thai authorities have escalated efforts to block unlawful cross-border digital asset business operators. On June 19, 2025, the Ministry of Digital Economy and Society (MDES) issued a notification empowering it to ban internet access to operations or services offered by digital asset business operators who lack licenses from the Thailand Securities and Exchange Commission (SEC) under the Emergency Decree on Digital Asset Businesses B.E. 2561 (2018). This ban, issued under the 2023 Royal Decree on Measures for the Prevention and Suppression of Technology Crime, particularly aims to block Thai users’ access to services offered by unlicensed offshore digital asset providers via their own apps or websites or through public social media platforms. Compliance Requirements The notification requires internet service providers and social media platforms selected by MDES to immediately impose internet access restrictions on identified apps, websites, and IP addresses of illegal operators upon receiving MDES orders. Takedown Orders There are two tracks for competent officials at MDES to issue orders to operators: If the competent official is notified by the SEC of licensing noncompliance by a particular digital asset business operator, the competent official can issue a takedown order to the operator upon approval from the permanent secretary of MDES. If the competent official independently discovers, or receives a complaint from any third party other than the SEC, that a digital asset business operator may have violated licensing requirements, the competent official can ask the SEC to verify and confirm the relevant facts and noncompliance before seeking approval from the permanent secretary of MDES to issue the takedown order. Streamlined Enforcement Prior to this notification, the SEC could obtain takedown orders only from Thai courts under the 2007 Computer Crime Act to take down or block access to unlicensed digital asset platforms and apps. This was a relatively
Read More
July 24, 2025
Vietnam’s Ministry of Public Security recently released a draft version of the 2025 Cybersecurity Law, which is intended to replace both the existing 2018 Cybersecurity Law and the 2015 Law on Network Information Security (LNIS). This consolidation reflects a broader effort by the Vietnamese government to streamline and centralize the legal framework governing cybersecurity, data protection, and information security to be under the sole authority of the Ministry of Public Security, moving away from the previous sharing of responsibility with the former Ministry of Information and Communications (which ceased operations earlier this year and merged with the Ministry of Science and Technology). This shift aims to eliminate overlaps and improve enforcement efficiency. The draft law is built upon the foundation of principles and provisions of both the 2018 Cybersecurity Law and the 2015 LNIS, while also introducing a wide range of amendments and new regulations. By merging the two laws, the government seeks to reduce legal fragmentation and ensure consistency in definitions, obligations, and enforcement mechanisms across related domains like data protection, IT system classification, and cybercrime prevention. The newly introduced amendments include enhanced obligations for service providers, stricter controls on information transmission, classification of IT systems, designation and protection of nationally important information systems, and sector-specific violations and compliance requirements. Highlights of the draft law are discussed below. Definition and Obligations of Service Providers The draft law clearly defines and significantly broadens the scope of entities considered “service providers” under its jurisdiction. This now includes businesses and individuals offering products or services in cyberspace, including both infrastructure and content online services, such as: Internet service providers (ISPs) and providers of telecommunications, hosting, servers, domain names, VPNs, proxy services, and cloud computing; Providers of social networks, websites, and online gaming; Financial institutions, banks, foreign bank branches in Vietnam, e-wallet
Read More