On July 31, 2026, Thailand’s Big Data Institute (BDI) launched a public consultation on the principles of a proposed new data-sharing law, with comments accepted until August 31, 2026. If enacted, the law would establish Thailand’s first comprehensive framework for government and private-sector data sharing, creating a systematic, secure, and transparent regime to support analytics, policymaking, research, and innovation.

Central Data-Sharing Platform

The draft law establishes a central system for data sharing, managed by the BDI. Government agencies would be required to connect to the BDI’s Data Integration and Intelligence Platform (also referred to as D2), in accordance with the BDI’s rules and procedures.

Five Dimensions of Data Sharing

The draft law covers five key types of data sharing between government (G), businesses (B), and consumers (C):

• G2B: Private organizations may request government data specifically for research and development purposes. The BDI will assess the applicant’s data governance, security, and privacy capabilities whether such measures meet prescribed standards before forwarding the request to the relevant government agency within 90 days. Any dispute may be escalated to a newly established Data-Sharing Promotion Committee for final determination.
• G2G: Government agencies may request data from other agencies through the central system. The data-holding agency must respond within 90 days, taking legality, necessity, proportionality, public interest, and personal data protection into account. Disputes may be referred to the Data-Sharing Promotion Committee for adjudication.
• B2G: In emergency situations involving public safety, economic security, or disaster response, the Minister of Digital Economy and Society may require private entities to provide data through the central data-sharing system. Government agencies must specify the data requested, demonstrate its necessity and expected benefits, and request only data reasonably available to the data holder. Requests for personal data must be limited to the minimum amount necessary.
• B2C: Royal decrees may require businesses in designated sectors to share customer data or business data with consumers or authorized third parties to promote consumer rights and competition. The relevant royal decree must specify at least the covered sectors, categories of data to be shared, eligible recipients, technical standards, exemptions, conditions for disclosure, and oversight mechanisms.
• B2B: Data sharing between businesses is governed by freedom of contract and is subject to applicable laws, including data protection and competition laws. To promote trust, the government will issue a nonbinding framework on trusted data-sharing and a voluntary certification system for providers of data-sharing services, under which certified providers may display a recognized trust mark indicating compliance with prescribed standards.

Key Provisions of the Draft Law

The draft law addresses several additional areas of note:

• Personal data protections. Where government data requested for sharing contains personal data, the data-holding agency must either deidentify the data, obtain data-subject consent, or confirm that a lawful basis for disclosure under the Personal Data Protection Act applies. In B2G emergencies, pseudonymized personal data may only be requested if nonpersonal data is demonstrably insufficient, and the Office of the Personal Data Protection Committee must be promptly notified.
• Documentation and transparency. Government agencies and private organizations that receive and use government data in accordance with the law must submit details of the relevant data sharing agreement to the BDI within 15 days executing it. The BDI will make details of such agreements publicly available.
• Data-Sharing Promotion Committee composition. The new Data-Sharing Promotion Committee mentioned above will be chaired by the Minister of Digital Economy and Society and comprises 10 ex-officio members and six expert members. The committee will issue regulations and policy recommendations, resolve disputes, oversee the voluntary certification of data-sharing service providers, and monitor implementation of the data-sharing regime.
• Enforcement. Noncompliance is classified as a pinai (civil fine) offense. Civil fines apply to private entities that refuse to share data following a ministerial emergency order, and to designated business operators that fail to share consumer or business data as required by royal decree. No criminal penalties are imposed under the draft law.
• Voluntary certification for data-sharing service providers. The draft law introduces a voluntary certification regime for data-sharing service providers, including data intermediaries, deidentification service providers, and secure access data service providers. Providers that meet prescribed standards may register with the Data-Sharing Promotion Committee and obtain a trust mark.

Impact on Private Sector

Companies operating in Thailand should be aware of several key implications:

• Emergency data-sharing obligations. Private entities may be required by ministerial order to connect their systems and share data during declared national emergencies, with civil fines for noncompliance.
• Sector-specific consumer data-sharing mandates. Businesses in sectors designated by royal decree—such as banking, insurance, e-commerce, or telecommunications—may be required to share customer data and business data at the request of consumers, comparable to “smart data” schemes in the UK and other jurisdictions. Such royal decrees may impose additional compliance requirements and designate a regulator for oversight and enforcement.
• New opportunities for data-driven innovation. The new framework may enable qualifying businesses to access government data for research and development, creating opportunities to develop new products, services, and analytical capabilities.

Companies and other stakeholders should review the draft principles of the proposed data-sharing law and consider submitting comments during the public consultation period, which is open through August 31, 2026.