Thailand’s Office of Insurance Commission (OIC) has issued orders announcing the premium rates for insureds who purchase insurance policies directly from life and non-life insurance companies. The orders, which were issued on September 2, 2024, allow insurance companies to set lower premium rates for insureds who purchase insurance policies directly from them, compared to those approved earlier by the OIC. Under the orders, both life and non-life insurance companies selling insurance policies directly to insureds may set the premium rate below the premium rate earlier approved by the OIC, but the discount may not exceed: 30% of the insurance premium for all types of insurance policies; and 35% of the insurance premium for insurance policies that utilize innovation or are sold through electronic channels. Here, “insurance policies that utilize innovation” means insurance policies that are currently being tested or have successfully met the objectives of the Insurance Regulatory Sandbox or the Product Innovation and Tailor-Made Sandbox, as approved by the OIC. The insurance companies may set the above two premium rates under the following conditions: The insurance contract must be entered into between September 1, 2024, and November 15, 2024; and The coverage start date of the insurance policy must not be later than December 31, 2024. For more details on the OIC’s orders regarding premium rates for insureds who purchase insurance policies directly from life and non-life insurance companies, or on any issue concerning insurance regulations in Thailand, please contact Athistha (Nop) Chitranukroh at [email protected], Witchupong Chittchang at [email protected], Ajaree Trachukul at [email protected], or Sireethorn Wijan at [email protected].

The first draft of Vietnam’s new Personal Data Protection Law (“Draft PDPL”) was released for public consultation on September 24, 2024, and is open for comments until November 24, 2024. (See further details here.) It is expected that the draft will be presented to the National Assembly before the end of 2024 and will be submitted for adoption in May 2025, with a tentative entry into force on January 1, 2026. As the Draft PDPL incorporates most of the provisions of Decree No. 13/2023/ND-CP on Personal Data Protection (“PDPD”), which has been the primary legal instrument on personal data protection since it took effect on July 1, 2023, it is likely that it will supersede the PDPD when it takes effect. [Please contact our Vietnam data protection team to request a detailed comparison of the Draft PDPL to the PDPD.] Noting that there might be further changes to the draft once the public consultation period closes, the Draft PDPL proposes new specific requirements for a number of services. Some highlights of the current version include the following: Marketing services: Although marketing services are already regulated under the PDPD, the Draft PDPL now recognizes that the use of personal data for marketing must comply with anti-spam regulations. The current draft does not clarify whether organizations are exempted from the consent requirement for the purpose of the initial call or message under the anti-spam regime. Marketing service providers are not allowed to outsource the services to another organization to perform or support the implementation of marketing business, which may prevent the sharing of personal data. Behavioral advertising: Behavioral advertising (targeted personalized advertising based on a user’s activity or personal data) requires the consent of the data subject in a modifiable manner that allows the data subject to refuse to share data

The Indonesian food and drug authority, also known as “BPOM,” issued a draft regulation on September 9, 2024, proposing standard labeling disclosing the sugar, salt, and fat content of packaged food products sold in the country. The draft Regulation on Nutritional Value Information on Food Labels to implement Government Regulation No. 28 of 2024 on the Implementation of the Health Law seeks to mandate “Nutri-Level” front-of-pack nutrition labeling to indicate the amount of sugar, salt, and fat at four possible levels, with a modified stoplight-color system: Level “A” (lowest amount) has a dark green background Level “B” has a light green background Level “C” has a yellow background Level “D” (highest amount) has a red background These levels are shown in the following sample image: The requirements for sugar, salt, and fat content for each level are based on amounts per 100 milliliters of ready-to-eat processed food as follows: Further requirements relating to nutrients reflected in the Nutri-Level labeling include: Foods labeled as level A are not allowed to contain natural or artificial sweetening food additives, either through direct addition or carried over from other ingredients. Foods labeled as level B may only contain natural sweetening food additives. Foods labeled as level C or D may use natural and artificial sweetening food additives. “Sugar” includes all monosaccharides and disaccharides, excluding lactose. Processed plain liquid milk and plain milk powder are exempt from the requirement to declare total fat content on the Nutri-Level label. Labeling Implementation The implementation of Nutri-Level labeling must comply with the following requirements: The Nutri-Level label must list all four letters (as shown in the examples below) unless the package meets the criteria for display of a simplified format label. The Nutri-Level of the processed food must be indicated by enlarging the relevant letter, as shown

On September 24, 2024, the government of Vietnam issued the first draft of a new Law on Personal Data Protection (“Draft PDPL”). As foreshadowed in our previous legal update, the Ministry of Public Security has been very active in developing this draft law. With this draft, they promise to continue their considerable efforts to establish a robust personal data protection culture in Vietnam, as the Draft PDPL indicates a tentative entry into force on January 1, 2026. With a tentative adoption by the National Assembly in May 2025, the Draft PDPL does not include any transition period, save for micro-enterprises, SMEs, and startups, which are only exempted from appointing a data protection department in their first two years of existence, while the timeline to comply with other obligations under the PDPL remains the same as for other enterprises. The Draft PDPL includes 68 articles, divided into seven chapters, making it more extensive than last year’s Decree No. 13/2023/ND-CP on Personal Data Protection (“PDPD”), and expressly addresses personal data protection in many fields, including marketing services, behavioral advertising, big-data processing, AI, cloud computing, labor monitoring and recruitment, financial and credit information, health and insurance, and others. It remains unclear how the PDPL will interact with the PDPD (whether it will replace its predecessor or coexist with it), although the Draft PDPL provides that it will prevail over any laws that have provisions on personal data protection that differ from the provisions of the PDPL. Among the important new developments of the Draft PDPL when compared to the PDPD, we note: Consent remains the main legal basis for processing, with limited exceptions (still not including “legitimate interest”). However, consent for cross-border transfer is further regulated under the Draft PDPL, including for intra-group sharing. Data processing impact assessment dossiers for controllers and