You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Thammapas Chanpanich

Senior Associate

Biography

Thammapas Chanpanich is a senior associate in Tilleke & Gibbins’ corporate and commercial group. She is a recognized expert in legal issues at the forefront of the digital economy, with a particular focus on digital platforms, advanced technology, artificial intelligence (AI), and data protection.

Thammapas advises clients on regulatory compliance, strategy, and governance across a wide range of industries, particularly in highly regulated sectors such as insurance and digital platform services. At Tilleke & Gibbins, she plays a key role in the technology industry group, where she has developed deep expertise in navigating complex regulatory regimes that impact today’s most innovative business tools. As a trusted adviser to both international and domestic clients, Thammapas provides strategic counsel on emerging legal challenges in areas including e-commerce, electronic business transactions, insurtech, and new innovative businesses. Her insights help clients stay ahead of regulatory developments and achieve business objectives in a rapidly evolving digital landscape.

She is also a leading author of articles on legal developments related to technology and media, personal data protection, digital platforms, and AI. Her thought leadership is widely recognized in the industry.

Thammapas holds an LLB from Thammasat University and an LLM in Law and Technology from King’s College London. She is a member of the Thai Bar Association and a lawyer licensed by the Lawyers Council of Thailand, and a qualified notarial services attorney. She is also a Certified Information Privacy Professional/Europe (CIPP/E) recognized by the International Association of Privacy Professionals.

Experience

  • Worked closely with Tsar & Tsai Law Firm to represent CTBC Bank, one of the largest privately owned banks in Taiwan, in its THB 4.2 billion (approx. USD 128 million) direct acquisition of an additional 10.99% stake in LH Financial Group Public Company Limited, which owns LH Bank, among other subsidiaries in Thailand.
  • Assisted a global financial institution, insurance companies, and other local and international companies in conducting data mapping and gap analysis in relation to Thailand’s Personal Data Protection Act.
  • Assisted a high-ranking insurance company in carrying out a full-scope Personal Data Protection Act (PDPA) compliance program, including auditing and assessing the client’s existing data collection and processing activities, drafting PDPA-related documents, and training key employees on PDPA regulations.
  • Appointed by the Thai Life Insurance Association and the Thai General Insurance Association to advise on the drafting and implementation of Thai insurance industry guidelines for compliance with data protection and cybersecurity regulations under the Personal Data Protection Act (PDPA)
  • Prepared a comprehensive handbook for a major tech company on compliance with Thai laws regulating data protection, cybersecurity, fintech, and various other key topics.
  • Designed and developed privacy policies, privacy notices, and terms and conditions for clients in various industries, including telecommunications, insurance, banking and finance, automotive, healthcare, and e-commerce.
ABOUT Thammapas

Location

Languages

    Thai

    English

Education

    LLM, King's College London

    LLB, Thammasat University

Insights

August 25, 2026
Thailand’s Electronic Transactions Development Agency (ETDA) is studying potential new regulatory measures for digital platform services that could significantly expand the country’s digital platform governance framework. The ETDA has already conducted one public consultation session on the proposed measures and will hold additional sessions on August 25 and September 2, 2026, covering five types of platform services under the Royal Decree on Digital Platform Services B.E. 2565 (2022). The measures under study are preliminary and may be changed based on consultation outcomes. Foundational Measures Applicable to All Platform Types Seven baseline obligations would apply across all digital platform categories: Transparency reports. Platforms must prepare and publish statistical reports on platform governance activities, including the number of content items removed or restricted and appeal outcomes, in a comparable format. Notice and action mechanism. Platforms must establish minimum standards for channels to report potentially illegal content or goods, conduct case-by-case review, provide explanations when content is removed or restricted, and maintain an internal appeals channel. Rights over automated decision-making. Users significantly affected by automated decisions are granted rights to request an explanation, request human review, and contest the decision. Service level agreements (SLAs). Platforms must publish minimum standards for response times, processing timelines, progress notifications, and remedies for incidents on the platform. Labeling of AI-generated content. Content generated or modified by AI must carry visible labels and machine-readable metadata, with exceptions for creative works that disclose AI use in a nonmisleading manner. Prohibition of dark patterns. User interface designs that deceive, coerce, or distort user decision-making are prohibited, including hiding critical information, creating false urgency, or making service cancellation unreasonably difficult. Business user fairness. Platforms must meet minimum standards for the treatment of sellers, workers, and content creators, including advance notice of term changes, explanation of account suspensions or visibility reductions,
August 20, 2026
Thailand has established a new cross-ministerial committee to oversee data center operations nationwide. On August 5, 2026, the Thai cabinet approved the Prime Minister’s Office Regulation on the Data Center Business Policy Committee, which was published in the Government Gazette on August 13, 2026, and is now in effect. The regulation reflects the government’s policy to elevate Thailand’s digital economy and promote investment in digital infrastructure and AI. The key features of the new committee are outlined below. Definition of “Data Center” Under the regulation, “data center” is defined as a building, premises, or structure that uses electronic equipment to provide services related to the collection, storage, processing, hosting, or transmission of data by electronic means to third parties that are not affiliates, as further determined by the Data Center Business Policy Committee. Committee Composition The committee will be chaired by a deputy prime minister designated by the prime minister, and will have three vice-chairs comprising the ministers of digital economy and society, interior, and energy. The committee also includes 12 ex-officio members: the permanent secretaries of finance, agriculture, natural resources, energy, interior, digital economy, industry, and commerce; the secretaries-general of the Board of Investment (BOI), Energy Regulatory Commission, National Broadcasting and Telecommunications Commission (NBTC), and National Water Resources Office; and the director of the Energy Policy and Planning Office. Up to three expert members may be appointed by the prime minister for two-year terms, renewable once. The secretary-general of the National Economic and Social Development Council (NESDC) serves as member and secretary, with up to two NESDC officials serving as assistant secretaries. Powers and Duties The committee is empowered to: Propose policies, standards, and operational frameworks for government agencies in approving, licensing, issuing investment promotion certificates, or providing services to data center operators in Thailand; Study, analyze, and
August 20, 2026
As part of its membership in Lex Mundi, Tilleke & Gibbins has released the latest edition of its Guide to Doing Business in Thailand, providing an overview of the legal, regulatory, and commercial considerations for companies establishing or expanding operations in Thailand. The 2026 edition offers practical insight into the country’s business environment, investment framework, and operational requirements. The guide covers a wide range of topics relevant to foreign and domestic investors, including: Investment incentives and promotion schemes Financial facilities and banking regulations Exchange controls and money transfers Import and export regulations Business structures and incorporation options Requirements for establishing a business Operational and compliance considerations Business cessation and insolvency procedures Employment and labor laws Taxation Immigration and visa requirements Prepared by Tilleke & Gibbins lawyers across multiple practice areas, the publication outlines key aspects of doing business in Thailand, including foreign investment restrictions, regulatory compliance obligations, corporate structures, employment requirements, and recent legal and economic developments affecting investors. The publication forms part of Lex Mundi’s Country Guides series, a global collection of jurisdiction-specific reference materials prepared by member firms around the world. Together, these guides help companies evaluate opportunities, compare regulatory environments, and plan international business activities across multiple markets. The full Guide to Doing Business in Thailand 2026 is available through the button below.
August 18, 2026
The Bank of Thailand (BOT) is seeking public comment on proposed amendments that would significantly expand know-your-customer (KYC) and customer due diligence (CDD) requirements for cash-related transactions at financial institutions (FIs) and specialized financial institutions (SFIs). Released on August 5, 2026, the proposed regulation would supersede BOT Notification No. 16/2569, which focused primarily on cash withdrawal transactions. The public comment period is open through September 3, 2026. The amendments reflect concerns that FIs and SFIs may be used to facilitate the movement, concealment, and conversion of criminal proceeds, potentially damaging institutional operations and public confidence in the financial system. Expanded Scope of Covered Transactions The most significant change is the broadening of the definition of “cash-related transactions.” Previously, the regulation covered only cash withdrawals and uncrossed check withdrawals. The amended regulation extends coverage to include: Cash deposits, check deposits, or receipt of funds from the public not in the form of deposit accounts; Thai baht (THB) banknote exchange (different denominations); Receipt of cash for issuing checks and drafts; and Purchase, sale, or exchange of foreign banknotes. Mandatory Identity Verification and Risk Management For all cash-related transactions, FIs and SFIs must require customers, or authorized or delegated persons, to present identification or verify their identity before every transaction, including one-time (walk-in) transactions. Specific identification requirements vary by transaction type, customer nationality, and channel (branch vs. electronic). FIs and SFIs must also establish comprehensive risk management processes and procedures for cash-related transactions. These requirements include identifying customers or authorized representatives in accordance with transaction-specific verification standards, analyzing customer behavior, implementing risk-management measures proportionate to the customer’s risk profile, and recording abnormal behavior in relevant systems. The BOT also encourages institutions to proactively guide customers toward transaction channels that offer greater traceability than cash. For corporate customers in high-risk business sectors—including foreign

Awards & Rankings

August 13, 2026
Tilleke & Gibbins has been recognized in the inaugural Asia Top Cybersecurity & Data Law Firms 2026 list from Asian Legal Business (ALB), published in the magazine’s August 2026 edition. The new ranking highlights leading law firms across Asia with dedicated cybersecurity, privacy, and data regulation practices, recognizing firms with a proven track record of advising clients on complex cybersecurity and data law matters. Tilleke & Gibbins is one of only 21 firms included in the inaugural list, reflecting the firm’s strength in data privacy, cybersecurity, technology, and regulatory matters throughout Southeast Asia. According to ALB, the firms selected for inclusion are recognized for their capabilities in areas such as privacy compliance, incident response, digital investigations, and technology-enabled client service. The recognition underscores the continued growth and regional prominence of Tilleke & Gibbins’ data privacy and cybersecurity practice, which advises clients across a broad range of industries on data protection compliance, cybersecurity preparedness and response, technology transactions, digital platform regulation, and emerging regulatory developments. This latest honor reflects the firm’s commitment to helping clients navigate an increasingly complex digital and regulatory landscape and reinforces its reputation as a leading adviser on technology, privacy, and cybersecurity issues across the region.
July 22, 2026
Tilleke & Gibbins has been named Best Insurance Law Firm in Thailand in the InsuranceAsia News Country Awards for Excellence 2026. This is the firm’s first recognition from InsuranceAsia News, and Tilleke & Gibbins was the sole law firm honored in the Thailand awards. The award recognizes the strength of Tilleke & Gibbins’ insurance practice and the team’s work advising clients in the sector. InsuranceAsia News selected the winners based on submission reviews, independent research, market knowledge, and analysis by the publication’s judging panel. InsuranceAsia News provides news, analysis, and market intelligence for insurers and related organizations across Asia. For more information and to view the full list of winners, please visit the InsuranceAsia News website.
April 3, 2026
Tilleke & Gibbins is pleased to announce that the firm has been shortlisted in two categories at the Financial Times (FT) Innovative Lawyers APAC 2026 awards: Innovative Lawyers in Cyber and Data Privacy – “Digital Identity & Cryptocurrency Compliance” Innovative Practitioner – Athistha (Nop) Chitranukroh The FT Innovative Lawyers APAC Awards recognize law firms and practitioners who are driving innovation in legal services and delivering innovative client solutions across the Asia-Pacific region. This recognition marks our third acknowledgment in the Innovative Lawyers category and, notably, our first-ever nomination in the Innovative Practitioner category at the FT Innovative Lawyers APAC awards. It reflects our team’s continued ability to support clients on groundbreaking, forward-looking projects across the region. The awards ceremony will take place on May 14, 2026, in Hong Kong. To learn more about the FT Innovative Lawyers APAC 2026 awards and to view the full list of shortlisted organizations, please visit the FT website.

Other Professionals