On May 2, 2024, Vietnam’s Ministry of Justice published on its online platform the most recent version of the draft decree on administrative sanctions for violations in the field of cybersecurity (“Draft Sanction Decree”) to gather feedback and contributions from the community and stakeholders. After receiving the Ministry of Justice’s assessment, the Ministry of Public Security (“MPS”), in charge of drafting the Draft Sanction Decree, may make further revisions before submitting it to the government for review and final decision on enactment. The decree is expected to have an effective date of June 1, 2024. The stringent penalties for infringements involving personal data of the previous draft version remain in this Draft Sanction Decree—a sign of the proactive stance of the MPS in enforcing the Personal Data Protection Decree (“PDPD”). Effective Date and Transitional Provisions It is important to note that the Draft Sanction Decree does not impose any new obligations on organizations or individuals, and only sets out the administrative sanctions that could be imposed on violators as soon as June 1, 2024, which is indicated as the effective date in Article 49. This signals the MPS’s eagerness to begin taking enforcement actions against recalcitrant organizations and individuals that have not complied with the various obligations imposed on them under the Law on Network Information Security (enacted in 2015), the Law on Cybersecurity (enacted in 2018) and its guiding decree (Decree 53 – enacted in 2022), and the most recent PDPD (enacted in 2023). Article 50.1 of the Draft Sanction Decree outlines the transitional provisions regarding administrative violations in the cybersecurity field. It clarifies that the decree does not have retroactive effect, by stating that violations occurring before its effective date, but discovered or under review after such effective date will be subject to the regulations on administrative sanctions in force at

Thailand’s Board of Investment (BOI) has issued a notification granting investment privileges to qualified new residential projects for low-income individuals. Notification No. Sor. 1/2567 Re: Promotion of Residential Activities for Low-Income People was published in the Government Gazette on May 3, 2024, and came into effect the following day. To be eligible for BOI promotion, at least 80% of the total residences in a project must meet the requirements for usable area and price. The minimum usable area is 24 square meters for condominium units and 70 square meters for town houses and detached houses. The residences can only be sold to individuals, and the sale price for each of these condominium units or houses (including the price of any land) must not exceed THB 1.5 million. Projects must also meet the following criteria: Projects must include a car park, closed circuit television (CCTV) throughout the project, a 24-hour security guard, cleaning staff, a common area, and other facilities in an appropriate proportion. The building plan and layout must be approved by the BOI. A permit for the construction of a building under building control laws and other relevant laws must be obtained. Approval must also be obtained from the Government Housing Bank prior to submission of the application to the BOI. However, ISO 9000, ISO 14000, or other similar international standard certification is not required. Under the notification, applications for such promotion must be submitted to the BOI by the end of 2025. New low-income residential projects promoted by the BOI will be granted a corporate income tax exemption for a period granted for A4-promoted activities (typically three years). For corporate income tax exemptions, the investment will only be calculated based on the construction costs for roads, other facilities, or public utilities that are commonly used within the project. The construction costs for the residences, houses, buildings,

This is the first in a series of quarterly articles prepared by Tilleke & Gibbins’ capital markets practice group in Thailand, with a view to providing periodic updates on material changes to the relevant rules and regulations pertaining to securities laws in Thailand. Here are some of the key updates for the first quarter of 2024. Amendments to “investment company” prohibition The Securities and Exchange Commission (SEC) has amended the rules on the offering of securities and information disclosure where listed companies operating as an investment company would face consequences from regulatory arbitrage. The amended rules, which took effect on January 1, 2024, can be summarized as follows: A company (excluding financial institutions) will be deemed an investment company if it invests in securities, derivatives, or digital assets without active participation in the management of the target business, and the total of the passive portfolio exceeds 40 percent of the company’s total assets according to its most recent financials. Listed companies falling under the above definition of an investment company must disclose information related to their investments in the notes to their financial statements until the passive investment portfolio is less than 40 percent of their total assets. The Stock Exchange of Thailand (SET) will publish a warning label (either “C” for caution or “SP” for trading suspension) next to the ticker symbol of any listed company that is deemed an investment company. Once this is done, the company will be unable to offer any securities under the Securities and Exchange Act of 1992 (as amended) (SEC Act), such as shares, warrants, and underlying shares, as well as debt instruments. Amendments on offering of newly issued bonds by foreign issuers Rules on the offering of newly issued bonds in Thailand by foreign issuers were revised by the SEC with a view to ensuring that the

As non-cash payments continue to surge in Vietnam, the requirement for strong security standards and a clear legislative framework for intermediary payment services (“IPS”) is becoming more and more critical. Recognizing this, the State Bank of Vietnam (“SBV”) has been working on a draft decree to supersede the outdated Decree No. 101/2012/ND-CP dated November 22, 2012, on non-cash payments (“Draft Non-Cash Payment Decree”), which will lay the groundwork for non-cash payments in general and the provision of IPS in particular. Building upon this, the SBV recently issued a draft circular to replace Circular No. 39/2014/TT-NHNN dated December 11, 2014, on IPS (“Circular 39”) (“Draft IPS Circular”), which will offer more detailed guidance on the provision of IPS in Vietnam on top of the Draft Non-Cash Payment Decree. The Draft IPS Circular will be applicable to (i) IPS providers; (ii) foreign organizations providing IPS in Vietnam; and (iii) organizations and individuals involved in the provision of IPS. Some key updates regarding the Draft IPS Circular are as follows: Scope of Application The Draft IPS Circular sets out further guidance for the provision of IPS as listed under the Draft Non-Cash Payment Decree, including: (i) electronic clearing services; (ii) electronic wallet (“e-wallet”) services; (iii) collection and payment support services; (iv) financial switching services; (v) international financial switching services; and (vi) electronic payment gateway services. Notably, the Draft IPS Circular has explicitly excluded from its scope of application the provision of accounts by goods/service providers to their customers solely for the purpose of payment within the systems of such providers (e.g., cards/coupons or service/transaction accounts of online game service providers, transportation service providers, or securities companies, etc.). Requirements on the Provision of IPS Electronic Clearing Services: The Draft IPS Circular introduces regulations to cover certain elements of electronic clearing services that have not been explicitly outlined in Circular 39.

On April 29, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) issued the master plan for personal data protection, which outlines the PDPC’s strategies for developing and enhancing the data protection framework in Thailand from 2024 to 2027. A draft of this four-year plan had previously been released for a public hearing on November 27, 2023. Overview The master plan sets out the long-term direction for the protection of personal data in Thailand, analyzing the current landscape, challenges, and obstacles encountered since the full enactment of the Personal Data Protection Act B.E. 2562 (2019) (PDPA). It aims to align with Thailand’s National Security Policy and Plan for 2024–2027 and focuses on key sectors in its initial two years. These sectors are: Public security and key government services; Retail and e-commerce; Information and communication technology and telecommunications; Finance, investment, and insurance; Public health; Tourism; and Education. Objectives The master plan’s goals include increasing organizational compliance with the PDPA, reducing data breaches, updating the PDPA to reflect current circumstances, introducing various PDPC e-services, and enhancing Thailand’s global competitiveness in data privacy and personal data protection. It sets targets and indicators of the plan’s success, such as achieving a 100% PDPA compliance rate across all sectors in Thailand and raising Thailand’s digital competitiveness to at least 30th in the World Digital Competitiveness Rankings from the IMD World Competitiveness Center. Strategic Initiatives To achieve these objectives, the master plan introduces four strategic initiatives: Effective and balanced PDPA enforcement: Develop standards, principles, criteria, tools, indicators, and data privacy governance, including law enhancements. A recent example of this is the PDPC’s launch of the Personal Data Protection Surveillance Centre (PDPC Eagle Eye) to monitor data breaches. Knowledge and trust enhancement: Build human capacity and trust by enhancing knowledge through initiatives like the forthcoming data protection officer (DPO) course that is certified by the PDPC. Digital economy and society promotion:

Vietnam’s Ministry of Public Security (MPS) recently published on its website a dossier of the Draft Law on Data (the “Draft Law”) for public feedback, initiating a consultation period from February 26 to March 26, 2024. The dossier comprises a Policy Impact Assessment Report and a Summary Report on the implementation of existing legal documents governing data. An outline of the Draft Law was later circulated to relevant organizations for their input and commentary. The MPS drafted this legislation with several objectives, including bolstering national data infrastructure, advancing digital government while streamlining administrative procedures, fostering growth in the digital economy and building a digital society, and establishing a National Data Center. Comprising 65 articles across 6 chapters, the Draft Law is slated for implementation on January 1, 2026. The Draft Law currently is very preliminary, resembling a framework document. It features numerous provisions akin to policy mandates, yet only presents introductory concepts without further elaboration. Scope of Application The Draft Law applies to agencies, organizations, and individuals involved in data activities in Vietnam. This scope of application appears excessively broad and ambiguous, without a clear definition of “data activities”, leaving uncertainty regarding the breadth of this term’s coverage. Key Policy Groups The Draft Law focuses on four key policy groups: 1. Regulations on development, processing, and management of data This policy group focuses on matters relating to the collection, digitalization, and creation of data; assurance of data quality; data classification; data storage; data combination, adjustment, and updating; data strategy; data management; data sharing; provision of data to state agencies; data analysis and synthesis; data verification and authentication; data disclosure; access and retrieval of data; data encryption and decryption; data copying, transmission, and transfer; data revocation, deletion, and destruction; application of science and technology in data processing; identification and management of risks in data processing; the National Data

On May 1, 2024, Myanmar’s Intellectual Property Department (IPD) issued its first publication of trademark applications under the country’s 2019 Trademark Law. Parties are now able to oppose any of the applied-for marks in the publication, which is accessible from the IPD’s website, in accordance with stipulations of Myanmar law. This is a substantial development showing progress toward the registration of marks under the Trademark Law. The online publication of the applications provides the details of each mark, applicant, and representative. In addition, it discloses relevant information such as disclaimers, color claims, mark translations or transliterations, applicable priority dates, as well as specifications of goods and services under the Nice Classification. Any person (individual or legal entity) can file an opposition against an applied-for mark within 60 days of publication by citing significant absolute or relative grounds as specified in the relevant sections of the Trademark Law. Oppositions must use the official form specified in the Trademark Rules, and the filing fee is MMK 150,000 per mark (regardless of the number of classes) plus a MMK 300 bank charge. Anyone, including interested parties or their local representatives, can file the opposition at the IPD. If an opposition is not filed within the stipulated 60-day period, the IPD will proceed with the trademark registration without conducting any substantive examination for similarity or priority. Thus, mark owners, rights holders, and other interested parties should closely monitor the IPD’s publication of applied-for marks so they can take any necessary actions and potentially file oppositions to protect their rights and interests. There has not yet been any official announcement on how often these publications will be issued. For more information on the IPD’s mark publication activities, or on any aspect of protecting intellectual property in Myanmar, please contact Tilleke & Gibbins at [email protected].

The Thai Arbitration Institute (TAI) announced on April 19, 2024, that it has jointly set up an in-court arbitration pilot project with five courts in Thailand—namely, the Civil Court, Taling Chan Civil Court, Central Intellectual Property and International Trade Court, Samut Prakan Provincial Court, and Samut Prakan Khwaeng Court. The pilot project launched on May 1, 2024. Pilot Project This project is designed to encourage the parties in cases submitted to these courts to consider having parts of the case, or even the entire case, heard and determined by arbitrators under the Civil Procedural Code (CPC). The objective of the project is to provide faster and more efficient judicial services to the public by reducing the number of cases to be fully tried in the courts through providing an option for parties to engage in in-court arbitration. Still, the court remains largely involved in the process, as the court will consider the award in detail before determining whether to render a judgment in accordance with the award without any edits. Therefore, in-court arbitration favors parties who prefer to have a court judgment instead of an out-of-court arbitral award, which could lead to enforcement challenges under the Arbitration Act. Parties who participate in this pilot project will pay the TAI a fee for its administrative assistance and related services. The TAI will assist in setting up and facilitating meetings, witness hearings, and the necessary logistics pertaining to case files involving the arbitrators, the parties, and the court. After the arbitrators hear the case, the case files, including the witness statements, exhibits, and reports during the arbitration proceedings, are collected and sent back to the respective court along with the award. Under the pilot project, the arbitrators will issue awards within 30 days of the last day of the trial or the date the