Tilleke & Gibbins has contributed the Thailand chapter to Data Protection 2025, a newly published comparative guide from Global Legal Post’s Law Over Borders series. This comprehensive Q&A-style resource provides insights into data protection regulations across multiple jurisdictions worldwide, offering valuable guidance for businesses navigating the complex landscape of global data privacy requirements. The Thailand chapter offers a detailed analysis of the country’s data protection framework, with particular focus on the Personal Data Protection Act (PDPA) that came into full effect in 2022. The chapter addresses key aspects of data protection in Thailand through the following topics: Regulatory framework: National laws governing personal data, scope of application, territorial reach, and regulated operations. Data categories and protection: Types of personal data covered, special categories subject to enhanced protection, and processing requirements. Compliance obligations: Requirements for lawful processing, organizational responsibilities, and data subject rights. Marketing and cross-border considerations: Rules for commercial communications and international data transfers. Enforcement mechanisms: Regulatory powers, investigation procedures, sanctions, and remedies for noncompliance. Tilleke & Gibbins also contributed the Vietnam chapter to Data Protection 2025. Readers can access the complete Data Protection 2025 guide through Global Legal Post’s Law Over Borders platform.

On February 4, 2025, Thailand’s Board of Investment (BOI) issued Announcement No. Por. 3/2568, introducing updated qualifications, criteria, and conditions for long-term resident (LTR) visas. The updated requirements took effect immediately upon issuance of the announcement. The LTR program is intended to stimulate the economy and attract high-potential foreign nationals to Thailand, and these latest updates aim to expand access to a wider range of experts, investors, and executives to reinforce Thailand’s foreign talent pool and enhance its competitiveness. The recent updates primarily affect three categories under the LTR visa program: work-from-Thailand professionals, wealthy global citizens, and high-skilled professionals, as detailed below. Work-from-Thailand Professionals The updated LTR visa program includes some changes to the eligibility criteria for visa applicants in the work-from-Thailand professionals category: The revenue requirement for visa applicants’ employers is now USD 50 million over a three-year period, down from USD 150 million previously. Eligible foreign employers now include wholly owned subsidiaries of: companies listed on any stock exchange in any country; or private companies that have been in operation for at least three years and have generated a combined revenue of at least USD 50 million over the past three years. There are no longer work experience requirements. The other requirements remain the same. Wealthy Global Citizens For the wealthy global citizens category, the latest updates remove the requirement to have an annual personal income of USD 80,000, while the other criteria remain. Highly Skilled Professionals For the highly skilled professionals category, the latest updates expand eligibility to include lecturers in vocational or higher education, and remove work experience requirements. Other categories The updated LTR visa program does not introduce any changes for the wealthy pensioners category. However, the announcement does expand the scope of eligible dependents of LTR visa holders to cover parents and a broader range of family members.

On January 31, 2025, the Bank of Thailand (BOT) announced a new Notification re: Responsible Lending, replacing a similar notification from 2023. This new notification provides updated measures to assist debtors in different circumstances and clear implementation guidelines for lenders, with the aim of resolving household debt issues. Scope The service providers covered by the notification include banks and nonbanks (e.g., credit card companies, asset management companies, licensed personal loan providers, and nano finance operators) that conduct lending business. New Requirements The notification’s core focus remains loan management throughout the lifecycle of a loan—from credit product development to legal proceedings and debt transfers to other creditors—but with further clarification and detail compared to the 2023 notification. The key revisions in the new notification are summarized below. Advertising standards: The notification tightens requirements in some areas and relaxes them in others. Stricter requirements: It is now clearly stipulated that the BOT oversees taglines that may encourage excessive borrowing. More examples of noncompliant statements are also added (e.g., “Elevate your lifestyle now, pay later”; “Get approved, even with credit challenges”). In addition, advertising material that contains multiple credit products should provide clear minimum and maximum interest rates, especially when there are significant differences in the interest rates of each product. Relaxed requirements: The required information for some marketing activities is now reduced. For example, in marketing events with staff promoting loan products and offering free giveaways, service providers have the discretion to provide effective interest rate information in the manner they deem appropriate, and the advertisement material can display only the mandatory warning statements without providing interest rate details. Encouraging customer financial discipline: The notification requires service providers to implement more elaborate and extensive tools to influence customer behavior (termed “nudging” by the BOT) at every stage of the lending cycle. This includes (1) increasing the nudging activities before loan

On January 6, 2025, the government of Vietnam issued Decree No. 05/2025/ND-CP amending and supplementing Decree No. 08/2022/ND-CP detailing the Law on Environmental Protection (“Decree 05”). Decree 05 came into effect immediately upon issuance and provides several changes to the regulations governing extended producer responsibility (“EPR”) for applicable manufacturers and importers, outlining their obligations concerning the recycling and treatment of discarded products and packages. (See our previous article on Vietnam’s EPR regulations here.) Outlined below are some critical amendments in Decree 05. Entities Subject to EPR Regulations Previously, Decree 08 limited the responsibility for recycling to manufacturers and importers of products and packaging specified in statutory lists. Decree 05 expands this scope by also including entities responsible for the quality and labeling of the regulated products and goods in Vietnam. Decree 05 inherits the regulations from Decree 08 that manufacturers and importers, if they produce and import products and packaging as stipulated by law, must fulfill their responsibility to recycle or support waste treatment activities. However, Decree 05 amends the lists of products/packaging that must be recycled or undergo waste treatment, and new products/packaging and recycling methods. Notably, rechargeable batteries (including those used in vehicles or for electrical and electronic devices) have been added to the list of regulated products and self-propelled vehicles and construction machinery have been removed from the list. Decree 05 also not only streamlines the recycling methods required for each type of product/packaging, but also removes the minimum requirement on the mass of products/packaging that must be recovered when recycling. Manufacturers and importers now have more flexibility in selecting recycling methods that are more suitable for actual recycling conditions in Vietnam. Decree 05 has revised the cases of exemption from recycling and waste treatment obligations, clarifying that both packaging manufacturers and importers with annual product sales revenue below VND 30 billion are

As Vietnam continues its government restructuring, including the merging of several key ministries, the country is signaling that mergers of provinces could be next. Conclusion 126-KL/TW of the Politburo and Secretariat, issued on February 14, 2025, sets out several tasks for continuing to streamline the political system in 2025, notably including, among others, the following: Elimination of intermediate administrative levels, and mergers of provincial units: The Government Party Committee is tasked with researching and planning for the elimination of intermediate administrative levels (district levels); reorganizing the commune level with structures, functions, duties, powers, and responsibilities aligned with the new organizational model; and proposing the merging of some provincial administrative units. A report to the Politburo is required by Q3 2025. Reorganization of police structure: The Central Public Security Party Committee is tasked with leading and coordinating the implementation of a three-tier police organization, eliminating the district-level police. Judicial system reforms: The Central Party Committees of the Supreme People’s Court and the Supreme People’s Procuracy are tasked with researching and advising on the organizational model for courts and procuracies, and proposing amendments and supplements to relevant party mechanisms and state laws, with the aim of eliminating the district level. A report to the Politburo is required by Q2 2025. Implications of Merging Provinces The merging of provinces could bring positive impacts as well as new challenges. The expected benefits include: Administrative efficiency and cost saving: Reducing the number of administrative units could lead to more efficient governance and decision-making processes, as well as lower administrative costs due to fewer government offices and personnel. Economic development: Larger administrative areas can benefit from better allocation of resources and infrastructure development. Larger provinces may also attract more investment due to increased economic potential and market size. Improved service delivery: Public services could improve due to better resource management. However, while the results

Vietnam’s Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (Decree 147) was issued on November 9, 2024, and came into effect on December 25, 2024. Decree 147 represents a more stringently regulated digital landscape in Vietnam, creating challenges not only for offshore service providers offering cross-border services but also for onshore providers. As these new regulations impose stricter requirements, particularly in areas like content control, user authentication, data storage, and service license/notification, companies will need to adapt quickly to maintain compliance and minimize legal risks. The following are some of the key topics covered by Decree 147. [Note: Shortly after the issuance of Decree 147, Vietnam began a government restructuring process, with the aim of streamlining the government by consolidating and eliminating various ministries and agencies. Thus, the decree’s references to authorities such as the Authority of Broadcasting and Electronic Information (ABEI) and the Ministry of Information and Communications (MIC) are subject to change.] 1. Cross-Border Information Provision Cross-border information provision is defined broadly as the provision by overseas organizations and individuals of information and online information content services for service users in Vietnam to access or use. This wide-ranging definition encompasses various types of cross-border services, including social network services, online game services, and app store services. However, cross-border provision of online game services remains prohibited under Decree 147 (see further details below). Offshore providers of services on a cross-border basis who lease data storage in Vietnam or meet a threshold of 100,000 or more total visits per month from Vietnam for six consecutive months (“regulated cross-border providers”) must adhere to stricter requirements. Specifically, they are required to, among other requirements: Notify the relevant authority of their contact information, including the location of the main server providing the service, within 60 days of reaching the total visit

On January 3, 2025, the Bank of the Lao PDR (BOL) issued Decision No. 11/BOL on the Use of Foreign Currency in Lao PDR, taking effect on the same date. This decision sets out the rules for using foreign currency in Laos and ensures the Lao kip (LAK) remains the primary currency while allowing flexibility for international transactions. Key points in the decision are outlined below. Permissible Activities for Foreign Currency The decision provides that authorized entities can use foreign currency as a secondary currency to LAK in the setting of cost and pricing structures, announcing and advertising prices, and making or receiving payments for goods and services that are imported or have manufacturing inputs imported from other countries. Otherwise, LAK is the only permitted currency. The decision also stipulates that foreign exchange must be conducted only via authorized commercial banks or foreign exchange markets. The exchange rate for setting costs, pricing structures, announcing and advertising prices, and making and receiving payments for goods and services in foreign currency must match the exchange rate announced by commercial banks from time to time. Businesses Allowed to Use Foreign Currency The decision allows certain businesses and organizations to use foreign currency. These entities are divided into two groups: those that need approval before using foreign currency, and those that can use it immediately. Enterprises that can use foreign currency with BOL approval include: Businesses that export goods or services and entities that lease or obtain concessions from the government, generating revenue in foreign currency through commercial banks. Enterprises that provide international freight and passenger transportation services. Enterprises that provide services related to cross-border logistics and warehousing. Enterprises located at international borders and airports, such as duty-free shops and restaurants. Enterprises that have obligations to make payments in foreign currency to other countries and suppliers of goods and services to exporters that generate

Thailand’s draft Emergency Decree on Technology Crimes Suppression, which we covered in a client alert in January 2025 primarily addressed to telecom operators and financial institutions, is expected to have significant implications for a wide range of business operators.  The draft emergency decree has already been approved by the cabinet but may undergo further developments as it continues in the legislative process. In this article, we will highlight the material impacts of the draft emergency decree on overseas and local fintech operators. Expanded Definition of “Technology Crimes” The definition of “technology crimes” now includes the following acts of forgery or alteration: Forging or altering the identity of individuals and biometric characteristics by utilizing computer or communication systems or other electronic means to commit offenses. Forging or altering symbols, trademarks, or seals of groups (e.g., foundations, community enterprises) or juristic persons, including acts by juristic persons using individuals or juristic persons as nominal directors or shareholders, regardless of whether such individuals or legal juristic persons reside in Thailand. Forging or altering digital or online platforms, regardless of the platform’s location or legal status. Individuals who conspire, utilize, assist, or support the commission of these offenses will face the same penalties as the principal offender. Business Operator Definition The scope of “business operators” is now expanded to cover various fintech and digital asset operators beyond those under the Payment Systems Act (PSA). The draft emergency decree now includes the following operators, whether they are legally authorized or not: Business operators under the PSA and business operators who operate “as if” they are payment system operators Business operators under the Royal Decree on Digital Asset Businesses or business operators who operate “as if” they are digital asset business operators. Foreign exchange business operators. Disclosure and Exchange of Information Business operators must disclose or exchange information on accounts and transactions linked to technology crimes and notify a