Thailand’s Personal Data Protection Act came into full effect on 1 June 2022 and various subordinate regulations have since been issued by the Personal Data Protection Committee. These include regulations on security measures to be implemented by data controllers, data breach notification requirements, a mandatory obligation to appoint a data protection officer when the processing activity requires regular monitoring of personal data or a system due to the large scale of personal data, administrative measures and data processors’ record of processing activities. As some areas under the PDPA still require further clarifications, a series of public consultations for the remaining draft subordinate regulations is anticipated in 2024. Potential areas include data protection impact assessments and cross-border transfers of personal data, which are crucial for organizations and particularly for entities with establishments in other jurisdictions. PDPA enforcement by Thai regulators was silent until the last quarter of 2023, when the PDPC published details about complaints that have been lodged to the Expert Committee. The committee is designated by virtue of the PDPA and has the power to make determinations related to imposing administrative fines and other penalties. Enforcement in 2024 is expected to become more active and potentially more serious, which means organizations should pay closer attention to ensure compliance with the PDPA. Similar to the GDPR, the PDPA also has extraterritorial effect. Once the subordinate regulation on international cooperation has been issued by the PDPC, this should clarify how PDPA enforcement against organizations located outside of Thailand will be conducted by Thai regulators. With respect to sector-specific data protection legislation, in September 2023, Thailand’s National Broadcasting and Telecommunications Commission issued the Notification of the NBTC Re: Measures to Protect Telecommunications Service Users’ Rights in regard to Personal Data, Privacy Rights, and Freedom of Telecommunications, which replaces the previous notification.

On November 24, 2023, the National Assembly of the Socialist Republic of Vietnam adopted Law No. 24/2023/QH15 on Telecommunications (“Telecom Law 2023”) after a lengthy period of extensive discussions and revisions. The Telecom Law 2023 is set to take effect on July 1, 2024, except for the requirements relating to basic telecom services on the internet (otherwise known as over-the-top services, or “OTT”), data center services, and cloud computing services, which will take effect on January 1, 2025. Some important highlights of the Telecom Law 2023 are discussed below. Updates on Telecom License Requirements With a few exceptions and save for certain types of telecom services, enterprises in Vietnam are required to obtain Telecom Licenses in order to provide telecom services. There are two types of Telecom Licenses: licenses for the provision of telecom services, and licenses for telecom operations. Telecom Licenses can be granted in two forms. The first is separate licensing, which is for telecom services with network infrastructures that use radio frequencies or operate in areas with special requirements set by the government. The second is group licensing, which covers telecom services with network infrastructure (except in certain cases), telecom services without network infrastructure (except in certain cases), and telecom operations. New Regulations for OTT, Data Center, and Cloud Computing Services The Telecom Law 2023 provides the definitions for OTT services, data center services, and cloud computing services, recognizing them as different types of telecom services. It also outlines the rights and obligations of service providers in these fields. Regarding market-entry conditions, foreign direct investments in OTT services, data center services, and cloud computing services are subject to no restrictions on share ownership ratio or capital contribution. Foreign investors can establish 100% foreign-owned enterprises in Vietnam to offer these services. Enterprises offering these services are not

Thailand’s Revenue Department (RD) has issued a notification requiring electronic platforms to report their revenue from business operators on their platform. With this information, the RD intends to track business operators’ income from the sale of goods and services through electronic platforms in order to facilitate accurate and efficient tax collection. The notification, which was enacted on December 27, 2023, took effect on January 1, 2024. Under the notification, electronic platforms are required to compile a “special account” containing information on the revenue received from each business operator on their platform and submit it to the RD through the department’s electronic reporting system within 150 days of the end of the fiscal year. The notification defines “electronic platforms” as entities that intermediate between business operators (i.e., sellers of goods or providers of services via the electronic platform) and consumers for the purpose of enabling electronic transactions between the parties. This covers online marketplace operators, ride-hailing operators, food delivery operators, and so on. This reporting requirement applies to electronic platforms registered in Thailand that have (or previously had, starting from the notification’s effective date) annual revenue exceeding THB 1 billion (approx. USD 28.5 million), except for electronic platforms under the supervision of the Bank of Thailand or the Office of the Securities and Exchange Commission, such as payment service providers and cryptocurrency exchanges. Electronic platforms can appoint a third party to prepare and submit the required special account information to the RD on their behalf. Compliance Steps As the requirements established by this notification mean that the RD will now have direct access to information on the income earned by vendors and merchants on electronic platforms, these business operators—whether corporate or individual—should ensure that they faithfully disclose their earnings, submit tax payments correctly, and file income tax returns in a

In December 2023, Thailand’s Office of Insurance Commission (OIC) presented draft amendments to the country’s laws for life and non-life insurance, pointing to significant modifications ahead for the laws governing insurers. These amendments primarily aim to: Elevate governance standards within the insurance industry. Support compliance with the Financial Sector Assessment Program (FSAP) of the International Monetary Fund and the World Bank. Address current regulatory enforcement issues. Harmonize governance standards for insurance businesses with those for financial institutions. The draft amendments involve changes to a wide range of regulatory areas; key changes include the following: Corporate Governance Expanding the definition of directors to include representatives of foreign insurers’ branches in Thailand. Imposing the same standards of care and obligations on “persons having the authority to manage the company” as on directors. Requiring OIC approval for appointment and reelection of directors. Expanding the list of prohibited connected transactions to include lease of property. Shareholding Requirements Requiring mandatory reporting to the OIC for individuals holding 5% or more of shares in an insurance company. Requiring regulatory approval for 10% shareholding and prohibiting exceeding the limit without OIC approval or compliance with subregulations. Dividend Payments Empowering the OIC to issue subregulations on dividend payments from both life and non-life insurance companies. Products and Distribution Permitting directors, staff, and employees to sell insurance products after obtaining relevant training from the OIC. Granting insurers discretion to set group insurance premium rates following regulations, methods, and conditions set out by the OIC without having to obtain OIC approval. Allowing insurers to underwrite foreign currency-based insurance. Allowing insurers to offer additional benefits beyond policy stipulations in compliance with the relevant OIC subregulations. Capital Fund and Finance Establishing minimum capital fund requirements of approximately THB 1 billion for non-life and THB 5 billion for life insurers. Imposing sanctions