On January 8, 2025, Thailand’s Office of the Personal Data Protection Committee published two notifications in the Government Gazette—one for data controllers and the other for data processors—concerning exemptions for data controllers and data processors from the requirement to create and maintain records of processing activities (ROPAs) under the Personal Data Protection Act B.E. 2562 (2019). The notification for data processors took effect on January 9, 2025, the day after its publication. The notification for data controllers will take effect on April 8, 2025. The content of these notifications is identical to that in the draft versions of the notifications previously released for public consultation in October 2024. For more information on the ROPA exemptions for data controllers and data processors, or on any aspect of personal data protection in Thailand, please contact Nopparat Lalitkomon at [email protected] or Wilin Somya at [email protected].

On January 1, 2025, Myanmar’s State Administration Council enacted Cybersecurity Law No. 1/2025, which aims to regulate various aspects of digital security and online activities. The law has not yet been implemented and will come into force on a date specified by the Myanmar president, who will also provide an official adoption and compliance timeline for individuals and organizations impacted by the new regulations. Below are some of the key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The Cybersecurity Law introduces two types of

Thailand’s Fiscal Policy Office (FPO) has released a draft of its planned Financial Business Hub Act, which is in line with the government’s aim of positioning Thailand as a regional financial hub and a critical player in the global economy. The draft act, on which the FPO is accepting comments until January 9, 2025, details the framework for promoting and attracting international financial businesses and related services to operate in Thailand, proposes various incentives, and outlines supervisory guidelines. This article examines key elements of the draft Financial Business Hub Act relevant to financial business operators. Incentivized Financial Businesses The draft act identifies the financial businesses to be promoted and incentivized. These target businesses include: Commercial banking businesses, Payment service businesses, Securities businesses, Derivatives businesses, Digital assets businesses, Insurance and reinsurance brokerage businesses, and Other financial-related businesses as determined by the Committee for the Supervision and Promotion of Financial Centers. Thailand’s finance minister explained that initially, the draft law intends to target businesses using an “out-out” model, which describes the raising of capital abroad for investment abroad, before expanding to an “out-in” model, in which capital is raised abroad for investment domestically. Therefore, the draft law currently specifies that the target businesses must only provide services to nonresidents without soliciting residents of Thailand to use their services. Authorization Targeted financial business operators will need to receive authorization from the Committee for the Supervision and Promotion of Financial Centers. The main eligibility criteria for authorization are the incorporation an entity (e.g., a company registered in Thailand, a branch of a foreign juristic person) with an office in designated areas to be specified in a royal decree (currently expected to be Bangkok and adjacent provinces) and the possession of other qualifications as prescribed in the draft act. Target businesses in Thailand will be exempted from complying with the relevant industry-specific Thai laws (e.g., Financial Institution Business

Thailand’s Board of Investment (BOI) has issued regulations revising its criteria for certain foreign companies that receive promotional privileges to own land under limited circumstances. The revised allowance is detailed in the Notification of the Board of Investment No. 16/2567 Re: Criteria for Permitting Foreign Juristic Persons Receiving Investment Promotion to Hold Land Ownership for Office and Residence, which was published in the Government Gazette on December 9, 2024, after having been officially issued on November 1, 2024. The notification was made in conjunction with the subordinate Notification of the Office of the Board of Investment No. Por. 8/2567 Re: Criteria and Conditions for Permitting Foreign Juristic Persons Receiving Investment Promotion to Own Land for Office and Residence for Operational-Level Workers to Operate Business Granted Investment Promotion, dated November 4, 2024. Under the new BOI notification and subordinate notification, foreign juristic persons that receive promotional privileges from the BOI, with paid-up registered capital of at least THB 50 million, are eligible to own land for office use or residential purposes, subject to certain criteria and conditions: Office use. Land used for this purpose must be for an office of the relevant BOI-promoted business, with an area limit of 5 rai (8,000 square meters). Residential use. Land used for this purpose must be for the residences of operational-level workers (i.e., unskilled laborers), with an area limit of 20 rai (32,000 square meters). In addition, there must be common facilities (e.g., parking, first-aid room, kitchen, and other amenities, as approved by the BOI). The land must be located within 10 kilometers of the place of business operation, and the number of rooms must be consistent with the number of workers. For more information on this notification, or on any aspect of property law in Thailand, please contact Chaiwat Keratisuthisathorn at  [email protected], Supranee Arjjit at [email protected], Chanchai Jhongsathit

Myanmar’s Ministry of Commerce (MOC) announced a significant policy change allowing foreign companies incorporated in Myanmar under the Myanmar Companies Law 2017 to export eight categories of locally produced commodities, with effect from December 17, 2024. Notification 93/2024 allows eligible foreign companies—companies with more than 35% of their shares held by foreign entities or individuals—to export, manufacture, or trade the following additional commodities: Value-added meats, fish, and fishery products Value-added agricultural products Pulp and various papers Seeds Refined metals Semifinished or finished horticultural products, including fruits and vegetables Wood-based furniture Products supporting environmental conservation The notification, which was issued under the Export and Import Law 2012, does not set a minimum capital requirement for foreign companies taking advantage of these opportunities. Any type of foreign company can apply to export the eight commodities listed above. Companies permitted or endorsed by the Myanmar Investment Commission (MIC) that wish to engage in these opportunities must also adhere to the rules and regulations set by the MIC. To facilitate the export process, the notification specifies that foreign companies must obtain an export recommendation from the relevant government departments and an export license from the MOC’s Department of Trade for each of these commodities. For more information on this announcement, the relevant licensing authorities for different commodities, or any other aspect of import and export matters in Myanmar, please contact Tilleke & Gibbins at [email protected].

On December 24, 2024, the government of Vietnam issued Decree No. 163/2024/ND-CP, providing guidelines for implementing the new Telecommunications Law that took effect on July 1, 2024 (“Decree 163”). This new decree replaces Decree No. 25/2011/ND-CP and its amendments (“Decree 25”) and took effect immediately upon issuance, with regulations on data center services, cloud computing services, and basic telecom services over the internet (“over-the-top” or OTT telecom services) having an official effective date of January 1, 2025. Decree 163 introduces substantial changes across the telecom sector, covering various aspects including service provision, licensing, standards and technical regulations, quality, passive infrastructure planning, dispute resolution, and more. Hence, it is necessary for enterprises to conduct a compliance review to identify gaps between the new decree and their business models, and take necessary steps to ensure lawful business operations in Vietnam. Below are some highlights of Decree 163. Expanded Scope of Services For basic telecom services, Decree 163 has introduced machine-to-machine (M2M) communication and classified it as a basic telecom service. This establishes a regulatory framework for IoT device communication, previously unregulated in Decree 25. For value-added telecom services, in light of the new Telecommunications Law, Decree 163 provides more detailed regulations for new telecom services such as data center services, cloud computing services, and OTT telecom services, which were not addressed in Decree 25. Regulation of Three New Telecom Services Expanding on the Telecommunications Law’s definitions of data center services, cloud computing services, and OTT telecom services, Decree 163 applies a light-touch management approach to regulate these three new services, as follows: Offshore providers: Cross-border service providers are exempt from signing commercial agreements with licensed local telecom companies. They only need to notify the Vietnam Telecommunications Authority (VNTA) using the prescribed procedures and forms before offering services. Onshore providers: The foreign ownership cap is removed, allowing 100% foreign-owned enterprises in

Thailand has adopted the OECD’s global minimum tax framework through the Emergency Decree on Top-Up Tax B.E. 2567 (2024). Published in the Government Gazette on December 26, 2024, this legislation implements a 15% global minimum effective tax rate for large multinational enterprise (MNE) groups. The emergency decree took effect on January 1, 2025. The emergency decree was enacted through expedited procedures to implement “pillar two” of the OECD’s Base Erosion and Profit Shifting (BEPS) 2.0 project’s Global Anti-Base Erosion (GloBE) Rules. This swift implementation ensures Thailand can collect relevant tax revenues and prevents potential revenue losses from MNEs that might otherwise shift profits to jurisdictions with lower tax rates or to countries that have already implemented similar top-up tax legislation. Key aspects of Thailand’s implementation of the global minimum tax through the emergency decree are described below. Top-Up Tax The emergency decree introduces a dual mechanism for collecting additional top-up tax from MNEs whose effective tax rate falls below 15%. The first mechanism is a domestic top-up tax that targets MNEs operating within Thailand when their local effective tax rate is lower than 15%. The second mechanism is the income inclusion rule, which determines when a company’s foreign income should be included in the parent (main) company’s taxable income. This rule applies to Thai-based entities—including ultimate parent entities (UPE), intermediate parent entities, and partially owned parent entities—that hold ownership stakes in low-tax foreign jurisdictions. Scope MNEs subject to Thailand’s implementation of the global minimum tax framework are defined in the emergency decree as those whose UPEs report consolidated revenue of at least EUR 750 million (approximately THB 28 billion) in at least two of the four accounting periods preceding the relevant fiscal year. Reporting and Payment In-scope MNEs must comply with specific reporting obligations to the Thai Revenue Department. The filing deadline is set at 15 months after the UPE’s accounting period

On December 27, 2024, a new minimum daily wage rate in Thailand was published in the Government Gazette, taking effect on January 1, 2025. With these changes, the minimum daily wage in 2025 ranges from THB 337 to THB 400, up from the previous THB 330 to THB 370, depending on the province. For most provinces, these rates reflect an increase of THB 7 per day, except for the following provinces and districts, which have increases of THB 9–55 per day: Bangkok Chon Buri Hat Yai District in Songkhla Ko Samui District in Surat Thani Mueang Chiang Mai District in Chiang Mai Nakhon Pathom Nonthaburi Pathum Thani Phuket Rayong Samut Prakan Samut Sakhon The full table of minimum daily wage rates is below. For more details on the new minimum wages, or any aspect of labor and employment in Thailand, please contact Pimvimol (June) Vipamaneerut at [email protected], Ketnut Pukahuta at [email protected], Dusita Khanijou at [email protected], or Chomanut Arif at [email protected].