Category: Legal Updates

on by

PDPA: Does Removing a Name Make Data Anonymous?

Organizations increasingly remove names and other obvious identifiers from datasets before using the data for analytics, research, artificial intelligence development, or sharing it with third parties. A common assumption is that once names and identification numbers have been removed, the information is no longer personal data and therefore falls outside the Personal Data Protection Act B.E. 2562 (2019) (PDPA).

That assumption can be dangerous. Recent guidance from the Personal Data Protection Committee (PDPC) provides an important reminder: removing a person’s name does not, by itself, make data anonymous.

When does data become anonymous?

The key question is not simply whether direct identifiers have been deleted, but whether an individual can still be identified from the remaining information.

The PDPC’s approach indicates that data may be treated as anonymized where the data subject cannot be identified without additional information and appropriate technical and organizational measures have been implemented to ensure that identification is not reasonably possible in practice.

This distinction is particularly important where a dataset contains multiple indirect identifiers. Removing a person’s name while retaining information such as age, date of birth, location, gender, occupation, accident location, medical information, or other characteristics may still allow that person to be identified when those data points are considered together or combined with information from other sources.

Accordingly, de-identification is a question of substance, not merely the removal of specified fields.

Pseudonymization is not anonymization:

Organizations should also distinguish anonymization from pseudonymization.

If a person’s name is replaced with a code but the organization retains a separate table linking that code to the individual’s identity, the information remains capable of being attributed to that person. The dataset is therefore pseudonymized rather than truly anonymized.

Pseudonymization can be an important security and privacy measure, but it does not automatically take the data outside the PDPA. By contrast, properly anonymized information that can no longer reasonably be linked to an identifiable individual is no longer personal data for PDPA purposes.

This distinction has significant practical consequences. An organization cannot simply label a dataset “anonymous” or remove names and assume that the PDPA no longer applies.

Research provides a useful illustration:

The issue arose in the context of research into the causes of motorcycle accidents. Such research may involve ordinary personal data as well as sensitive personal data, particularly health information concerning injured persons.

The PDPA expressly recognizes research and statistical purposes as circumstances in which personal data may be processed without relying exclusively on consent. Section 24(1) provides a basis relating to research or statistical purposes, subject to appropriate safeguards protecting the rights and freedoms of data subjects. For sensitive personal data, Section 26(5)(d) similarly permits processing where necessary for scientific, historical or statistical research, or other public-interest purposes, subject to necessity and appropriate safeguards.

The PDPC has also prescribed specific safeguards for processing personal data for research and statistical purposes.

The practical significance is that organizations should not assume that anonymization is the only way to conduct research lawfully. Personal data may remain subject to the PDPA and nevertheless be processed for legitimate research purposes where the applicable statutory requirements and safeguards are satisfied.

What should organizations do in practice?

For organizations seeking to take datasets outside the scope of the PDPA, anonymization should be treated as a risk-based technical and governance process, rather than a simple data-cleaning exercise.

Direct identifiers should be removed, but organizations should also assess combinations of indirect identifiers and consider whether information could be matched against other reasonably available datasets. Where coded identifiers have been used, organizations should consider whether any linkage mechanism remains available. If a mapping table between codes and identities continues to exist, the resulting dataset is likely to remain pseudonymized rather than anonymous.

Depending on the nature of the dataset, additional techniques may be necessary, including aggregation, generalization, suppression, masking, reducing geographic or temporal precision, and other techniques designed to reduce re-identification risk.

Organizations should also document the anonymization process, the methodology used, the potential sources of re-identification, and the conclusion reached regarding residual risk. Technical measures should be accompanied by organizational controls restricting access and preventing attempts to re-identify individuals.

Why this matters for AI, analytics and data sharing:

The distinction has implications well beyond academic research.

Businesses increasingly want to use existing customer, employee, patient, transaction, location, behavioral, and operational datasets for AI development and training, statistical analysis, product improvement, or collaboration with external service providers and research institutions.

Where the information remains identifiable, the organization must continue to consider the PDPA requirements applicable to its collection, use, disclosure, retention, security, and other processing activities.

Where information has been effectively and irreversibly anonymized so that individuals are no longer reasonably identifiable in practice, however, the resulting dataset may fall outside the scope of the PDPA.

This makes anonymization potentially valuable for data-driven businesses, but it also means that organizations should be cautious about treating anonymization as a shortcut around data protection obligations. A dataset that can realistically be reconstructed, linked, or matched back to individuals remains exposed to PDPA risk regardless of what the organization calls it.

Key Takeaways:

  • Deleting names does not automatically anonymize personal data.
  • Organizations must consider whether individuals remain identifiable from other information or combinations of information in the dataset.
  • Pseudonymized data remains personal data where a person can be re-identified using additional information.
  • Proper anonymization requires technical and organizational measures designed to make re-identification impracticable.
  • Research and statistical processing may have specific legal bases under Sections 24(1) and 26(5)(d), subject to appropriate safeguards.
  • Organizations using data for AI, analytics, research or external data sharing should conduct and document a re-identification risk assessment before treating a dataset as outside the PDPA.
  • Anonymization should be viewed as an ongoing risk-management and governance exercise, not simply the deletion of names or identification numbers.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: Disclosure of Personal Data to Third Parties for Legal Proceedings

A recurring practical question under the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) is whether an organization may disclose personal data to a third party who needs the information to pursue a legal claim. Organizations often take a conservative position that personal data cannot be disclosed without the data subject’s consent. However, consent is only one of the legal bases under the PDPA, and the fact that information constitutes personal data does not, by itself, prohibit its disclosure. A recent opinion issued in response to a consultation by the Department of Land Transport (“DLT Opinion”) provides useful guidance on this issue and is particularly relevant to requests for personal data made for the purpose of exercising legal rights or pursuing legal proceedings.

Disclosure Does Not Necessarily Require Consent:

The DLT Opinion illustrates an important distinction between two questions: whether the information constitutes personal data and, if so, whether there is a lawful basis for its disclosure. Once information falls within the definition of personal data, its collection, use, or disclosure must comply with the PDPA, but this does not mean that disclosure is prohibited unless the data subject has given consent. Section 24 recognizes several legal bases for processing personal data without consent. Depending on the circumstances, disclosure to a third party may therefore be permissible where an appropriate legal basis exists. This is particularly important where the requesting party requires information to establish or exercise a legal right, claim damages, identify a responsible party, or commence legal proceedings. For example, a person who suffers damage involving a vehicle may know the vehicle registration number but may not know the identity of the person against whom a claim should be made. Similarly, a person injured in an incident recorded by CCTV may need the footage to establish the circumstances of the incident and pursue a claim. Treating the PDPA as an absolute prohibition against disclosure in such circumstances could prevent a person from effectively exercising legitimate legal rights.

Legitimate Interests and Legal Claims:

One potentially relevant legal basis is legitimate interests under Section 24(5) of the PDPA. This provision permits processing where it is necessary for the legitimate interests of the controller or another person, except where those interests are overridden by the fundamental rights of the data subject. A genuine need to obtain information for the establishment, exercise, or defense of a legal claim may constitute a significant legitimate interest. However, merely stating that information will be used in litigation should not automatically entitle a requester to obtain another person’s personal data. The controller should consider whether the claimed legal interest is genuine, whether disclosure of the requested information is necessary to pursue that interest, and whether the interests of the requester outweigh the privacy interests and fundamental rights of the data subject. In practical terms, this can be approached through a purpose–necessity–balancing analysis. The controller should first identify the legal purpose for which the information is requested; determine whether disclosure is reasonably necessary to achieve that purpose; and then balance that interest against the potential impact on the data subject. Supporting documents, such as a police report, evidence of damage, a demand letter, court documents, or other evidence demonstrating an actual or reasonably contemplated legal claim, may assist the controller in making and documenting this assessment.

The same reasoning has broader significance beyond vehicle-registration information. Government guidance discussing requests for CCTV footage has referred to the DLT Opinion by analogy when considering whether personal data may be disclosed to enable an injured person to exercise legal rights. This suggests that the Opinion may become an important reference point for third-party disclosure requests generally. Comparable issues arise frequently in the private sector: condominium juristic persons receive requests for CCTV footage following accidents or disputes; employers receive requests concerning former employees; insurers may hold information concerning parties to an accident; property owners may receive requests concerning tenants; and online service providers may receive requests for information identifying persons alleged to have committed a civil wrong. In each case, the correct question should not simply be whether the requested information is personal data, but whether the proposed disclosure has an appropriate legal basis and satisfies the requirements of necessity and proportionality.

Disclosure Should Be Limited to What Is Necessary:

Even where a lawful basis exists, the controller should not assume that all information in its possession may be disclosed. The scope of disclosure should be limited to information reasonably necessary for the stated legal purpose. If a requester needs information to identify a person against whom proceedings may be commenced, disclosure of the person’s name and information necessary for the relevant legal process may potentially be justified, while disclosure of unrelated information—such as identification numbers, telephone numbers, dates of birth, historical records, or other data not required for the claim—may not be. Redaction, partial disclosure, controlled access, or other safeguards should therefore be considered where appropriate. This distinction can be expressed simply as two separate questions: “Can the information lawfully be disclosed?” and “How much information is necessary to disclose?” Establishing a legal basis answers only the first question; the principles of necessity, proportionality, purpose limitation, and data minimization remain relevant to the second.

Organizations should also distinguish ordinary personal data under Section 24 from sensitive personal data under Section 26. Section 26 contains specific exceptions relating to processing necessary for the establishment, compliance, exercise, or defense of legal claims. Where sensitive personal data is involved, the requirements of Section 26 should therefore be considered separately rather than assuming that the legal basis applicable to ordinary personal data automatically applies. In all cases, organizations should consider implementing a documented Third-Party Personal Data Disclosure Request Procedure requiring verification of the requester’s identity, the purpose of the request, evidence supporting the claimed legal interest, the categories of information genuinely required, possible effects on the data subject, appropriate redaction or other safeguards, and a record of the reasons for approving or rejecting the request. Such documentation can be particularly important where the controller relies on legitimate interests and must subsequently demonstrate how the competing interests were assessed.

Key Takeaways:

The DLT Opinion is significant because it reinforces that the PDPA should not be treated as an automatic barrier to disclosure whenever personal data is involved. Consent is not the only legal basis for disclosure, and a genuine need to obtain information for the establishment, exercise, or defense of legal rights may support disclosure where the applicable requirements of the PDPA are satisfied. At the same time, an assertion that information is required for litigation does not create an unrestricted right of access to another person’s personal data. Controllers should assess the purpose, necessity, and balancing of interests, require appropriate evidence where necessary, limit disclosure to the minimum information reasonably required, and document the decision-making process. The broader lesson is that the PDPA is not intended to make personal data permanently inaccessible; rather, it establishes a framework for determining when disclosure is lawful, why it is necessary, and how much information may appropriately be disclosed.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

PDPA: Applicability to a Facebook User’s Posting of Personal Data – Key Takeaways

Thailand’s Personal Data Protection Act B.E. 2562 (PDPA) regulates systematic personal data handling, with exemptions for personal or familial use. The Ad Hoc Subcommittee under the Personal Data Protection Committee has evaluated whether a Facebook user’s posting of an allegedly defamatory image and text qualifies them as a data controller under PDPA, as raised by Police Station F in a criminal investigation. This analysis outlines the facts, the subcommittee’s rulings, and the compliance implications.

Factual Background:

Police Station F received a complaint alleging that a Facebook user posted an image of the complainant with text causing insult or hatred, prompting a criminal case. The prosecutor’s office (C) requested the station to investigate: (1) whether the post’s visibility settings (public symbols like a globe or people) made it accessible to the general public or a specific group, and (2) whether the suspect qualifies as a data controller under PDPA Section 6 for posting the complainant’s image and text.

Subcommittee Decisions:

The subcommittee addressed the issues as follows:

  1. Post Visibility (Issue 1)
    • The question of whether the suspect’s Facebook post—with a globe or people symbol—was visible to the public or a limited group falls outside PDPA’s direct scope. PDPA defines “personal data” under Section 6 as information identifying a living individual, directly or indirectly (e.g., the complainant’s image). However, visibility settings pertain to evidence in a criminal investigation, not PDPA enforcement. The subcommittee deemed this a factual matter for the police to assess independently, unrelated to PDPA compliance.
  2. Data Controller Status (Issue 2)
    • Under PDPA Section 6, a “data controller” is a person or entity with authority to decide on the collection, use, or disclosure of personal data, subject to duties like lawful bases (Sections 24, 26), notification (Section 23), security (Section 37), and rights responses (Sections 30–36). The law targets systematic or regular data processing, not isolated acts, per its intent and Section 4(1) exemption for personal or family use. The suspect, a natural person posting on Facebook, isn’t a data controller if the act was for personal purposes (e.g., expression) without systematic intent. Absent evidence of regular, organized data handling, PDPA doesn’t apply, per Section 4(1). However, the act may violate other laws (e.g., Computer Crime Act B.E. 2550, Penal Code defamation, or Civil Code torts under Section 420), which the police should pursue separately.

Implications for Compliance:

The suspect’s posting likely falls outside PDPA’s ambit as a one-off personal act, not subjecting them to data controller obligations (e.g., consent, security measures). Police Station F must focus on criminal or tort laws for liability, using post visibility as evidence, not a PDPA issue. PDPA applies to entities with structured data practices, not casual social media use.

Key Takeaways:

  • PDPA Targets Systematic Use: The suspect isn’t a data controller under Section 6 unless their posting reflects regular, purposeful data management, per Section 4(1) exemption.
  • Personal Acts Are Exempt: One-time social media posts for personal ends fall outside PDPA, per Section 4(1), unlike organizational data handling.
  • Other Laws Apply: Privacy breaches or defamation may trigger liability under the Computer Crime Act, Penal Code, or Civil Code, not PDPA.
  • Visibility Is Investigative: Post accessibility (public vs. private) is a factual issue for criminal evidence, not a PDPA concern.

This ruling clarifies PDPA’s scope, excluding personal social media acts from its framework, directing Police Station F to pursue alternative legal avenues for the complainant’s grievance.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Consumer Protection: Proposed Labeling Rules for Solar Panels, Inverters and Energy-Storage Batteries

The Office of the Consumer Protection Board (OCPB) has opened a public consultation on three draft notifications of the Committee on Labels covering solar panels, inverters used with solar panels, and batteries for storing energy generated from solar panels. The consultation runs from 13–27 August 2026. Although, the notifications remain in draft form, they are an important development for manufacturers, importers, distributors, dealers, installers, and businesses supplying rooftop-solar and energy-storage systems.

The Proposed Labeling Rules:

The three draft notifications would regulate labeling requirements for the principal components of a solar-energy system: solar panels, inverters, and energy-storage batteries. The initiative follows increased regulatory attention to consumer protection in the solar sector, including concerns regarding the quality and safety of solar equipment and installations.

Designation of these products as label-controlled products is significant because labeling under the Consumer Protection Act is more than a product-branding requirement. The regulatory framework is intended to ensure that consumers receive sufficient and accurate information about the products they purchase, including information prescribed by the Committee on Labels. The precise disclosures, language requirements, and presentation requirements will ultimately depend on the final wording of each notification.

For solar products, compliance can be particularly complex because consumers frequently purchase an entire rooftop-solar or solar-plus-storage system rather than individual components. The panels, inverter, and battery may be manufactured by different companies, imported by different entities, and supplied to the consumer through a distributor or installer. As a result, businesses should consider labeling compliance across the entire supply chain rather than treating it solely as a manufacturer’s responsibility.

Key Compliance Issues for Businesses:

Manufacturers and importers should be particularly attentive to the proposals because they generally control product specifications, labels, packaging, and accompanying documentation. Imported equipment may present additional challenges where the original labels and manuals are prepared for international markets. Importers should therefore assess whether Thai-language supplementary labels will be required and whether information on those labels is consistent with the manufacturer’s original product information.

This review should extend beyond literal translation. Product names, model numbers, technical specifications, manufacturer and importer details, instructions, warnings, and other required disclosures should be consistent across the product label, packaging, manuals, technical specifications, warranties, and other customer-facing materials. Inconsistencies between these materials can create both regulatory and consumer-dispute risks.

Distributors, dealers, and installers should also monitor the proposals closely. A rooftop-solar provider may purchase panels, an inverter, and a battery from different suppliers and then offer them to the consumer as a single installed system. Businesses operating this model should consider incorporating label verification into their procurement and installation procedures, including checking that required labels are present, correspond to the correct product model, and are not removed or obscured during installation.

The proposals may therefore have consequences beyond the physical product label. Depending on the final requirements, businesses may need to review packaging, Thai-language disclosures, product specification sheets, user instructions, warranties, quotations, sales proposals, online product descriptions, and information provided by dealers and installers. Not all of these materials will necessarily constitute regulated labels, but consistency between mandatory product information and commercial representations should form part of the compliance review.

Supply-Chain Contracts and Existing Inventory:

Businesses should also review how responsibility for labeling compliance is allocated contractually. Supply, import, distribution, dealer, and installation agreements often contain general obligations to comply with applicable law but may not specifically address responsibility for preparing Thai-language labels, verifying technical information, implementing regulatory changes, or bearing the cost of relabeling noncompliant products.

For importers dealing with overseas manufacturers, this can be commercially important. Changes to factory-applied labels or packaging may require manufacturing lead times and additional costs. Agreements should therefore be reviewed to determine who must implement regulatory changes, who bears the associated costs, and what remedies apply where products supplied into the market do not satisfy mandatory labeling requirements.

Existing inventory will be another important issue when the final notifications are issued. Businesses may already hold substantial stocks of solar panels, inverters, and batteries bearing existing labels, while additional products may be in transit or subject to outstanding purchase orders. Companies should monitor the final rules for their effective dates and any transitional provisions, including whether existing inventory can continue to be sold or whether supplementary labeling will be permitted. Businesses should not assume that existing products will automatically be grandfathered.

Labeling, Product Safety, and Enforcement:

The proposed rules should also be considered alongside broader product-safety regulation. The OCPB has previously highlighted consumer concerns relating to allegedly substandard solar installations and has emphasized the importance of consumers being able to identify relevant product, manufacturer, importer, origin, and standards information.

Labeling compliance and technical compliance should therefore be managed as related but distinct requirements. A product’s compliance with an applicable industrial or technical standard does not necessarily establish compliance with consumer-labeling requirements, while a correctly labeled product may still fail to satisfy separate product-safety requirements.

Noncompliance with labeling requirements can carry criminal consequences under the Consumer Protection Act. The OCPB has stated that a seller of a label-controlled product without the required label, or with an incorrect label where the seller knows or ought to know of the noncompliance, may face imprisonment for up to six months, a fine of up to THB 100,000, or both. For manufacturers producing goods for sale and persons ordering or importing goods for sale, the potential penalty may increase to imprisonment for up to one year, a fine of up to THB 200,000, or both.

What Businesses Should Do Now:

As the notifications remain in draft form, immediate changes to product labels may be premature. However, businesses can begin preparing by identifying affected product models and collecting their current labels, packaging, manuals, and Thai-language product information. Importers should determine which labeling changes can be made locally and which would require cooperation from overseas manufacturers.

Businesses should also map responsibility throughout their distribution networks, review supply and dealer agreements, and identify existing inventory that could be affected by the new requirements. Once the final notifications are issued, particular attention should be given to the exact product scope, mandatory disclosures, Thai-language requirements, effective dates, and transitional arrangements.

Key Takeaways:

  • The OCPB is consulting on three draft labeling notifications covering solar panels, solar inverters, and batteries used for solar-energy storage.
  • The proposals are relevant to manufacturers, importers, distributors, dealers, installers, and integrated rooftop-solar and energy-storage providers.
  • Businesses should review not only physical labels but also packaging, Thai-language product information, technical documentation, sales materials, and downstream dealer practices.
  • Importers should assess whether existing global labels and packaging can satisfy the proposed requirements or whether local supplementary labeling or factory changes may be necessary.
  • Supply-chain agreements should clearly allocate responsibility and costs for labeling compliance and regulatory changes.
  • Businesses holding substantial inventory should monitor effective dates and transitional provisions carefully.
  • Companies can use the consultation period to conduct a preliminary product and labeling audit so they are prepared to implement the final requirements efficiently.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Generative AI and Music: Copyright Risks Highlighted by the DIP

The growing use of generative artificial intelligence (AI) to create music is raising increasingly important copyright questions. AI tools can now generate songs, modify voices, create remixes and produce new musical content by reference to existing works, making the boundary between technological creation and the use of protected material increasingly significant.

The Department of Intellectual Property (DIP) has recently highlighted the copyright implications of using generative AI in music. While the DIP’s comments do not introduce new legislation or a separate legal regime for AI-generated content, they provide a useful practical signal: the use of AI does not remove the need to consider copyright in the material used as part of the creative process.

For businesses using generative AI for music, advertising and other commercial content, this has implications not only for copyright clearance but also for contracts with AI providers, internal policies and the management of infringement risk.

Existing copyright rules continue to apply:

The starting point is that generative AI does not operate outside the existing copyright framework. Under the Copyright Act, copyright owners have exclusive rights in relation to protected works, subject to applicable limitations and exceptions. Depending on the circumstances, reproducing, adapting or otherwise using a protected work without authorization may therefore constitute infringement.

The DIP has emphasized that where copyrighted material is used in connection with generative AI, users should consider whether they have the necessary rights and obtain permission where required. This is particularly relevant where an AI workflow involves identifiable existing material—for example, where a user supplies an existing song, recording or other protected content to an AI system to generate or modify musical content. The fact that AI technology performs part of the transformation does not, by itself, provide authorization to use the underlying copyrighted work.

AI-assisted music can involve several layers of rights:

Music-related AI applications can be legally complex because a single piece of music may involve multiple protected elements. A song may involve rights in the musical composition and lyrics, while a particular recording may involve separate rights in the sound recording. Depending on how an AI tool is used, more than one category of rights may therefore need to be considered.

For example, using an existing recording as an input for an AI-generated remix may raise different questions from merely instructing an AI system through text to create music of a particular genre. Similarly, an AI voice-conversion tool that processes an existing recording may involve different copyright considerations from a system generating an entirely new recording without the user supplying an existing protected work. Businesses should therefore avoid treating “AI-generated music” as a single legal category. The relevant copyright analysis depends significantly on what material enters the AI workflow, what the system does with that material and how the resulting content is subsequently used.

Copyright clearance should begin with the input:

For businesses, one of the most immediate implications of the DIP’s position is the importance of reviewing the material supplied to AI systems. Before employees, agencies or contractors upload music, recordings or other content to a generative AI platform, businesses should consider whether they own the relevant rights, have obtained an appropriate license or can otherwise lawfully make the intended use.

This is particularly important in advertising and marketing, where AI tools may be used to generate background music, modify existing tracks or rapidly produce multiple versions of creative content. A business may ultimately be responsible for content distributed under its name even where an external advertising agency, production company or AI provider performed much of the underlying creative work. Copyright clearance should therefore form part of the AI-content production process rather than being addressed only after the content has been generated.

AI provider contracts deserve closer scrutiny:

The copyright analysis should not stop with the underlying content. Businesses should also review the contractual terms governing the AI tools they use. Terms of service can differ considerably between platforms, particularly in relation to material uploaded to the platform, the provider’s ability to use customer content and the rights granted in generated outputs.

For commercial use, relevant contractual issues include rights and permissions relating to material submitted to the AI system, permitted use of customer-provided content by the AI provider, rights to use and commercialize generated outputs, intellectual property representations and warranties, indemnification for infringement claims, and procedures for responding to copyright complaints. Similar protections may be appropriate in agreements with advertising agencies, production companies and other contractors creating AI-assisted content.

Internal AI policies should address copyrighted content:

Businesses increasingly permit employees to use generative AI tools without necessarily treating that use as a formal intellectual property process. This can create risk where employees upload commercially released music or other third-party content to an AI platform, use copyrighted material as a reference, or use AI to modify content without considering whether the business has the necessary rights.

Internal AI policies should therefore address intellectual property alongside confidentiality, personal data and cybersecurity concerns. Organizations should consider establishing rules governing the types of third-party content that may be uploaded to AI systems, when copyright clearance is required and which AI platforms may be used for commercial content creation. For higher-risk uses, an internal approval process may also be appropriate before AI-generated material is released publicly or incorporated into a commercial campaign.

What the DIP’s position does—and does not—resolve:

The significance of the DIP’s comments should not be overstated. They provide a useful indication of how existing copyright principles should be approached when generative AI is used to create or modify music and reinforce the practical importance of obtaining authorization before using copyrighted works where permission is required.

However, the comments should not, without further legal or regulatory authority, be treated as establishing a definitive position on whether and under what circumstances copyrighted works may be used to train generative AI models. Nor should they be treated as conclusively determining whether, or under what circumstances, AI-generated output qualifies for copyright protection or who may own rights in such output. Those questions involve distinct legal issues concerning reproduction, exceptions to copyright, authorship, originality and the degree of human creative contribution.

Practical implications for businesses:

Companies using generative AI to create music or other commercial content should consider incorporating copyright review into their AI governance framework. A risk-based approach may be appropriate: generating content from text instructions without supplying identifiable third-party works may present a different risk profile from uploading existing songs or recordings, generating remixes or adaptations, or using protected material as a direct input or reference in the generation process.

Particular caution is appropriate where AI-generated content will be used in advertising, distributed commercially or incorporated into products. Businesses should also consider the complete contractual chain. An organization commissioning AI-generated music from an agency or contractor may wish to require appropriate warranties concerning the lawful use of source material rather than assuming that copyright compliance rests exclusively with the creator.

Key Takeaways:

  • Generative AI does not displace copyright law: Using an AI tool does not, by itself, authorize the reproduction, adaptation or other use of copyrighted material.
  • Inputs matter: Businesses should understand what copyrighted material is being supplied to an AI system and whether the necessary rights or permissions have been obtained.
  • Music can involve multiple rights: Compositions, lyrics and sound recordings may involve separate rights and require separate analysis.
  • Contracts should allocate AI-related copyright risk: Businesses should review AI-provider and agency agreements for input rights, output rights, warranties, indemnities and restrictions on the provider’s use of uploaded material.
  • Internal AI policies should cover intellectual property: Rules governing employee use of generative AI should address copyrighted inputs and commercial use of AI-generated content.
  • Important questions remain unresolved: The DIP’s comments should not be interpreted more broadly than their stated scope, particularly regarding AI training and copyright ownership of AI-generated output.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

From Grants to Equity: Government Innovation Agency Can Now Invest in Startups

A significant change to the legal framework for government support of innovation has opened the door to direct public-sector investment in startups and innovation businesses. The National Innovation Agency (Public Organization), the government agency responsible for promoting and supporting innovation (the “NIA”), has been granted expanded statutory powers to hold shares, become a partner, co-invest with other persons or entities, and participate in certain venture capital structures. This marks an important shift from the NIA’s traditional role as a provider of grants and financial support toward a model under which it may participate as an investor and acquire an economic interest in the businesses it supports.

The change was introduced by the Royal Decree Establishing the National Innovation Agency (Public Organization) (No. 3) B.E. 2569 (2026). In addition to expanding the NIA’s objectives to cover the development of innovation beyond the research and development stage toward commercialization, the amendment expressly authorizes the NIA to hold shares, become a partner, or participate in joint investments with individuals or legal entities in businesses connected with its statutory objectives. It may also invest in trusts established to conduct venture capital activities. Importantly, however, the NIA’s principal purpose in holding shares or participating in investments must not be the pursuit of profit, and the exercise of these investment powers is subject to criteria prescribed by the Council of Ministers.

From Funding Agency to Investor:

The distinction between a grant and an investment is significant. Under the traditional grant model, government funding supports a project or business without the government ordinarily acquiring an ownership interest. Equity investment creates a different relationship: the government agency may become part of the company’s capital structure, with its interest potentially affected by valuation, dilution, subsequent financing rounds, corporate restructurings, and an eventual exit. The amendment therefore does more than create another source of funding. It establishes the legal basis for the NIA itself to participate in the investment relationship.

This development may be particularly relevant for startups that have progressed beyond the stage at which grants alone can support their growth but remain too early or risky to attract sufficient private capital. The financing gap can be particularly significant for deep-tech and other innovation-driven businesses, where substantial capital may be required for product development, testing, regulatory approvals, manufacturing scale-up, intellectual property protection, and market entry before sustainable revenues are generated. Government equity or co-investment can potentially help bridge this gap and, by sharing part of the investment risk, encourage private investors to participate.

The NIA has announced that it intends to implement its expanded investment role through an initiative referred to as “NIA Venture,” using government funding as catalytic capital to encourage additional private investment. The announced framework includes investment through PE Trust structures, strategic investment through holding companies and other fund structures, and Corporate Co-Funding alongside qualified private investors, particularly for Seed to Series A businesses. The NIA has also announced an initial allocation model of approximately 40% for PE Trust, 30% for Holding Company, and 30% for Corporate Co-Funding. These investment channels and allocations are implementation measures announced by the NIA and should be distinguished from the statutory powers established by the Royal Decree itself.

What This Means for Startups and Investors:

The new powers do not give the NIA unrestricted authority to invest public funds in any startup. Investments must relate to the NIA’s statutory objectives, its principal purpose in participating in an investment must not be profit-seeking, and the relevant investment activities are subject to criteria prescribed by the Council of Ministers. Accordingly, the Royal Decree establishes the legal authority to invest, while the practical availability of NIA investment will depend on the applicable eligibility requirements, investment limits, approval procedures, governance arrangements, and other implementing conditions.

For founders, having a government organization on the cap table may create opportunities but also raises issues that should be considered at the outset. The investment terms will need to address valuation and dilution, the class and rights of shares acquired by the NIA, governance and information rights, and the company’s ability to raise subsequent financing. This is particularly important because later-stage venture capital investors may require preferred shares, liquidation preferences, anti-dilution protection, board representation, reserved matters, and other investor protections. An early government investment should therefore be structured in a way that does not unnecessarily complicate future financing rounds.

Exit arrangements may also require particular attention. Unlike a conventional venture capital fund, a public organization operates within a statutory and administrative framework governing its investments and assets. The ability of the NIA to sell, transfer, or otherwise realize its investment may therefore need to be considered when drafting shareholders’ agreements and investment documents, particularly in anticipation of a trade sale, secondary transaction, restructuring, or public offering. Startups should also anticipate potentially greater due diligence, reporting, and compliance requirements where public funds are involved.

The amendment is equally relevant to venture capital funds, corporate venture capital investors, and other private investors. Co-investment with the NIA could allow public and private capital to be combined in transactions that might otherwise be difficult to finance. However, the parties will need to consider how valuation is determined, whether investors subscribe for the same class of shares, how governance rights are allocated, how follow-on rounds are handled, and how exit decisions are made. Any conditions attached to government investment should also be assessed carefully to ensure that they do not unnecessarily restrict the company’s future operations, restructuring, overseas expansion, intellectual property arrangements, or ability to raise additional capital.

A New Model for Innovation Financing:

The amendment reflects a broader shift in the government’s approach to innovation financing. Grants and other forms of financial assistance remain important, particularly during research and early product-development stages, but they may not provide sufficient capital to take successful innovation from research to commercial scale. Allowing the government innovation agency to use equity and venture investment structures provides an additional tool for addressing that financing gap and may enable public capital to attract rather than replace private investment.

At the same time, the framework deliberately distinguishes the NIA from an ordinary commercial venture capital investor. Its investment activities must advance its statutory objectives, and profit cannot be the principal purpose of its participation. The success of the new model will therefore depend on achieving a balance between protecting public funds and providing sufficient commercial flexibility for startups to raise capital, grow, restructure, and eventually provide an exit for their investors.

Key Takeaways:

  • The government innovation agency now has express statutory authority to hold shares, become a partner, co-invest with other parties, and participate in specified venture capital structures.
  • This represents a shift from a model centered on grants and financial assistance toward one that can also include equity and co-investment.
  • The investment authority is subject to important limitations: investments must relate to the agency’s statutory objectives, profit must not be its principal purpose, and the exercise of the relevant powers is subject to criteria prescribed by the Council of Ministers.
  • The announced NIA Venture initiative includes PE Trust, Holding Company, and Corporate Co-Funding channels, but these are implementation arrangements rather than investment structures prescribed by the Royal Decree itself.
  • Startups should consider the effect of government investment on their cap table, governance, future fundraising, reporting obligations, and exit arrangements.
  • Private investors considering co-investment should assess how public-sector investment conditions interact with conventional venture capital terms and future financing rounds.
  • The practical impact of the reform will ultimately depend on the implementing criteria and the investment structures adopted under the new statutory framework.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Cabinet Approves Major Expansion of Home Worker Protections

The Cabinet has approved a draft amendment to the Home Workers Protection Act that would significantly expand the scope of protection for individuals performing work outside an employer’s or business operator’s premises.

The proposed amendments are particularly significant for businesses using remote workers, home-based workers, freelancers, and other individuals who perform assigned work away from business premises. Importantly, the proposed framework is intended to address modern working arrangements, including work assigned or performed through online systems.

The draft has been approved by the Cabinet but has not yet become law. It must proceed through the legislative process before enactment.

Broader Scope of Protected Work:

The existing Home Workers Protection Act principally focuses on work assigned by an industrial business operator to individuals or groups to produce or assemble goods outside the operator’s establishment.

The proposed amendments would substantially broaden this framework.

The concept of “work taken to be performed at home” would extend beyond traditional industrial production and cover work associated with a wider range of economic activities, including:

  • agriculture;
  • industry;
  • services; and
  • commerce.

The amendments would also expressly accommodate work arrangements involving electronic or online systems.

This change is potentially important for businesses operating through digital platforms or engaging individuals remotely. The relevant question may no longer be limited to whether a person physically takes materials or manufacturing work home. Businesses may need to consider whether work assigned digitally and performed outside their premises falls within the expanded statutory definition.

The legislation should therefore not be viewed as regulating only traditional home manufacturing or piecework. Its potential application could extend considerably further into the modern service and digital economy.

Minimum Compensation Protection:

The draft strengthens the statutory protection relating to compensation.

Compensation payable to a home worker would be required to meet the statutory minimum applicable under the legislation and could not fall below the minimum wage standard under labor protection law.

The amendments also reinforce the requirement that compensation be paid in Thai currency.

For businesses that calculate compensation on a project, output, piece-rate, or task basis, compliance may therefore require more than simply agreeing on a lump-sum fee with the worker. The compensation structure should be reviewed to ensure that it satisfies the statutory minimum requirements applicable to the work.

This could be particularly relevant to businesses using high-volume outsourcing models where individual workers are compensated according to completed tasks or units of production.

Increased Financial Consequences for Non-Payment:

The proposed amendments would strengthen the financial consequences for failing to make payments required under the Act.

Where a business fails to pay compensation or other amounts owed to a home worker, or fails to return security that it is legally required to return, the business may be required to pay interest at a rate of 15% per annum.

The relatively high statutory interest rate creates a significant incentive for businesses to establish reliable payment and reconciliation procedures.

Businesses that require workers to provide deposits or other forms of security should also review when such security must be returned and ensure that internal processes allow this to occur within the statutory requirements.

Stronger Protection Against Child Labor:

Another significant amendment concerns child labor.

The draft would prohibit the engagement of children under 15 years of age to perform homework.

This represents a material strengthening of the existing framework. Under the current legislation, the prohibition concerning children under 15 is focused on work that may be hazardous to their health and safety. The proposed amendment would establish a broader prohibition against engaging children below that age for home work.

Violation of the prohibition could result in substantial criminal penalties, including imprisonment for up to two years, a fine ranging from THB 400,000 to THB 800,000, or both.

Businesses using subcontractors, intermediaries, community production networks, or multi-tier outsourcing arrangements should pay particular attention to this requirement. Compliance mechanisms should extend beyond the immediate contractual counterparty where work may ultimately be distributed to individuals performing it at home.

Implications for Online and Platform-Based Work:

Perhaps the most consequential aspect of the proposed amendments is their potential application to work performed through online systems.

Traditional distinctions between employees, contractors, freelancers, platform workers, and home workers have become increasingly difficult to apply as businesses adopt remote and digitally mediated working models.

The amendments indicate a legislative intention to bring at least some forms of digitally assigned work within the home-worker protection framework.

This does not necessarily mean that every freelancer or remote contractor will automatically become a protected home worker. Whether the Act applies will depend on the statutory definitions and the particular structure of the working arrangement.

Nevertheless, businesses should avoid assuming that describing an individual as an “independent contractor,” “freelancer,” or “service provider” will by itself determine the legal position.

The substance of the arrangement—including how work is assigned, where it is performed, how compensation is calculated, and the relationship between the work and the business’s activities—may become increasingly important.

What Businesses Should Review:

Businesses that outsource work to individuals outside their premises should begin assessing their arrangements before the amendments become effective.

Particular attention should be given to:

  1. Worker classification – identifying individuals who may fall within the expanded definition of home workers.
  2. Digital work arrangements – reviewing work assigned, managed, submitted, or delivered through websites, applications, platforms, messaging systems, or other electronic channels.
  3. Compensation structures – ensuring that piece-rate, task-based, project-based, and similar payment arrangements satisfy applicable minimum compensation requirements.
  4. Payment procedures – establishing systems to ensure timely payment and avoid exposure to statutory interest.
  5. Security and deposits – reviewing whether security is collected from workers and establishing procedures for its lawful and timely return.
  6. Age verification – implementing appropriate controls to prevent individuals under 15 from being engaged to perform covered home work.
  7. Subcontracting arrangements – reviewing contractual protections and compliance mechanisms where work is distributed through agents, contractors, subcontractors, or other intermediaries.
  8. Contract documentation – updating contractor, outsourcing, and home-work agreements to reflect the expanded statutory requirements.

Effective Date:

The Cabinet-approved draft provides for the amendments generally to take effect 180 days after publication in the Government Gazette, although certain provisions concerning the preparation of subordinate legislation would take effect from the day following publication.

Businesses will therefore have a transition period once the legislation is enacted, but organizations with substantial outsourcing, home-working, or platform-based workforces may benefit from conducting an impact assessment before that period begins.

The draft remains subject to the legislative process, and its provisions may be revised before enactment.

Key Takeaways:

  • The proposed amendments represent a significant modernization of the home-worker protection regime.
  • Most importantly, protection would no longer be centered primarily on traditional industrial homework. The expanded framework would cover work connected with agriculture, industry, services, and commerce and would expressly respond to work arrangements conducted through online systems.
  • Businesses engaging individuals to perform work outside their premises should therefore reassess whether arrangements currently treated simply as outsourcing or freelance relationships could fall within the expanded legislation.
  • The proposed minimum compensation requirements, 15% statutory interest exposure, strengthened child labor prohibition, and potentially broader application to online work make this an important compliance development for businesses using decentralized or digitally managed workforces.
  • As the legislation remains in draft form, businesses should continue monitoring the legislative process and review the final text when enacted before implementing definitive compliance changes.      

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Thailand’s Response to the 12.5% U.S. Section 301 and the request for Further Exemptions

Introduction

On July 23, 2026, the Office of the United States Trade Representative (“USTR”) issued its final action under Section 301 of the Trade Act of 1974 in the Forced Labor Investigation, covering approximately 60 trading partners. Thailand was placed in the higher 12.5% tariff band, effective July 24, 2026, alongside Vietnam, the Philippines, and Singapore. Thailand received this rate because the United States found it had not adopted, committed to, or partially implemented a prohibition on the import of goods produced with forced labor, unlike a smaller group of trading partners assigned a 10% rate.

A separate and still-ongoing USTR proceeding, the Excess Capacity Investigation, covers 16 trading partners, including Thailand, and examines alleged structural excess capacity in manufacturing sectors. This investigation has not concluded and no tariff has yet been imposed under it. If the United States ultimately takes action on this second track as well, Thai exporters could face a further tariff, with some commentators estimating a combined exposure of up to 25% across both proceedings.

Domestically, Prime Minister Anutin Charnvirakul has directed six ministries and the Royal Thai Police to address both issues. Externally, the Ministry of Commerce (“MOC”) continues to negotiate an Agreement on Reciprocal Trade (“ART”) with the United States and has requested exemptions for a further 78 tariff lines, while stating that its negotiating position will not compromise the interests of farmers, the public, or businesses.

Key Concerns and Thailand’s Response

Following the Cabinet meeting of July 27, 2026, the Cabinet Secretariat issued an urgent instruction to the Ministries of Finance, Foreign Affairs, Agriculture and Cooperatives, Commerce, Labor, and Industry, and to the Commissioner-General of the Royal Thai Police. Each agency has been directed to prepare supporting data and response measures, identify the units responsible for each task, and set clear implementation timeframes.

1. Forced Labor

The United States has emphasized the need for stronger measures against goods produced with forced labor, including enhanced Human Rights Due Diligence (“HRDD”) and supply-chain traceability. The Ministry of Labor leads this response, together with the Ministries of Commerce and Industry. Their tasks are to accelerate enforcement of existing laws and regulations, compile lists of at-risk products and industries, and develop origin-certification and traceability systems covering the full production chain, so that Thailand can substantiate its position in discussions with the United States and other trading partners.

Thailand does not yet have directly enforceable legislation on this point. Thailand’s Ministry of Justice has been developing a draft Act on the Promotion of Responsible Business Conduct (also referred to as the mandatory Human Rights and Environmental Due Diligence, or “HRDD/mHREDD,” bill) since 2025, intended to align with the UN Guiding Principles on Business and Human Rights. The bill remains under development, and its legislative timeline, including submission to Parliament, has not been firmly fixed as of this update. Businesses should not wait for enactment before building supply-chain records.

2. Structural Excess Capacity

This issue is the subject of the separate, ongoing USTR Excess Capacity Investigation described above. It did not itself determine Thailand’s placement in the 12.5% forced-labor tariff band, though it could result in additional measures. The MOC leads Thailand’s response, with the Ministries of Industry, Agriculture and Cooperatives, and Finance. The agencies must compile risk lists at the product and industry level, integrating data on production capacity, inventory levels, government subsidies, price structures, export volumes, and country of origin. They must also investigate false origin claims and the use of Thailand as a trans-shipment point to evade trade measures imposed by importing countries.

Government support policy is also shifting direction. Future assistance is intended to target productivity, cost reduction, technology adoption, value addition, and greater use of local content. Subsidies that expand production capacity or increase supply beyond market demand are to be avoided, as they could themselves be cited as evidence of excess capacity. In discussions with USTR, Thailand has represented that domestic capacity utilization in the targeted industries generally runs between 70% and 90%, with no industry operating below 60%.

Exposure and Exemptions Secured

Thailand has obtained exemptions for 2,120 tariff lines under Annex II, Part A, representing approximately 61.6% of tariff lines and US$56.2 billion in exports, or roughly half the value of Thai goods exported to the United States. This is a substantial increase from the 471 items exempted under an earlier, preliminary list. Goods already subject to duties under Section 232 of the Trade Expansion Act of 1962 (for example, automobiles, steel, aluminum, and copper) are not subject to duplicate Section 301 duties. This overlap covers roughly US$7 billion of the remaining non-exempt goods.

Taking both the exemption list and the Section 232 overlap into account, the MOC estimates that approximately 28% of Thai exports to the United States remain exposed to the additional 12.5% tariff. Leading non-exempt industrial products include car and truck tires, machinery, cameras, air conditioners, and vehicle wheels and rims. Products such as jewelry, milled rice, pet food, canned tuna, and processed shrimp likewise remain outside the current exemption list and are among the items for which Thailand is now seeking relief (see below).

Solar cells and modules face particularly high cumulative exposure. In addition to the Section 301 tariff, U.S. antidumping duties on Thai-origin solar cells have been assessed at rates of up to approximately 203%, and countervailing duties at rates of up to approximately 800%, reflecting separate U.S. Commerce Department determinations on dumping and subsidization. Combined with the Section 301 tariff, total cumulative duties on affected solar shipments can substantially exceed 800%, and in the highest cases run well over 1,000%.

The Request for 78 Additional Tariff Lines

The MOC has submitted a proposal covering seven product groups and 78 tariff lines, which are agriculture and food security, consumer and household goods, medical and public-health products, electronics and semiconductors, vehicles and parts, machinery components and industrial equipment, and handicrafts and value-added products. Illustrative items include rice and Thai hom mali (jasmine) rice, maize, coconuts, orchids, cassava and cassava starch products, and fishery products, alongside jewelry, dog and cat food, milled rice, medical rubber gloves, tuna, processed bonito, fresh and cooked shrimp, and sauces and seasonings. The Commerce Ministry has separately referenced a further proposal covering 13 additional items, though it has not clarified whether these form part of the 78-line request or a distinct submission.

Thailand’s negotiating position is subject to three limits. It will not cross the interests of farmers, the interests of the public, or the rights of businesses. Thailand has indicated it is prepared for technical-level ART talks and is awaiting a determination from USTR, after which the MOC has suggested negotiations could conclude within a matter of weeks.

Key Takeaways

  • Solar cells are a particular outlier, combined Section 301, antidumping, and countervailing duties can push cumulative exposure well above 800%, in some cases exceeding 1,000%.
  • The 12.5% tariff under Section 301 currently in effect stems from the Forced Labor Investigation only. The separate Excess Capacity Investigation remains open and could result in an additional tariff if concluded against Thailand.
  • After accounting for the Annex II exemption list and the Section 232 overlap, approximately 28% of Thai exports to the United States remain exposed to the 12.5% tariff.
  • Six ministries and the Royal Thai Police have been directed to address forced labor and excess capacity concerns, with traceability and origin certification central to the response.
  • A mandatory human rights and environmental due diligence bill is under development by the Ministry of Justice, and its legislative timeline is not yet fixed. Businesses should not wait for enactment before building supply-chain records.
  • A request for 78 further exemption lines across seven product groups remains pending, and technical-level ART talks await a USTR determination.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

on by

Class-Action Signal Raises the Stakes for Online Consumer Complaints

Background:

Thailand’s Office of the Consumer Protection Board (OCPB) has announced that it is developing a national action plan to strengthen consumer protection for products sold through online channels. The initiative is intended to improve coordination among government agencies responsible for digital commerce, online marketplaces, direct-selling businesses, and consumer protection, while establishing clearer responsibilities and performance indicators.

Although the proposed action plan itself does not introduce new legal obligations, one aspect deserves particular attention from businesses. The OCPB has been directed to study the broader use of class-action proceedings where large numbers of consumers suffer substantially similar losses.

Thailand already recognizes class actions under the Civil Procedure Code, but they have historically been used relatively infrequently. The latest policy initiative indicates that consumer regulators are considering greater reliance on collective litigation as an enforcement mechanism where systemic consumer harm is identified, particularly in the rapidly expanding digital marketplace.

Why this matters:

The announcement does not create a new statutory cause of action or impose additional regulatory requirements on online platforms. However, it signals a possible shift in enforcement priorities.

Traditionally, consumer complaints have often been addressed individually through customer service channels or administrative dispute resolution. A greater emphasis on class actions would instead encourage regulators and claimants to examine recurring patterns of similar complaints across multiple consumers.

This approach could significantly increase litigation exposure where businesses fail to identify or address systemic issues affecting multiple customers.

Practical implications for businesses:

Online marketplaces, e-commerce operators, social-commerce platforms, direct-marketing businesses, manufacturers, importers, brand owners, payment providers, logistics companies, and merchants should consider strengthening internal governance before any formal policy changes occur.

Particular attention should be given to:

  • identifying recurring complaints involving the same product, seller, advertisement, or defect;
  • maintaining reliable seller identification and beneficial ownership information;
  • preserving documentation relating to product origin, regulatory approvals, and compliance certifications;
  • implementing effective notice-and-takedown procedures for unlawful or unsafe products;
  • escalating recurring safety or quality issues through documented internal processes;
  • reviewing refund, replacement, recall, and remediation procedures;
  • preserving evidence, including listings, livestreams, advertisements, customer communications, payment records, and delivery information; and
  • reviewing merchant agreements to ensure appropriate cooperation, indemnification, and information-sharing obligations.

Repeated complaints that appear insignificant when viewed individually may later be relied upon collectively to establish knowledge of defects, inadequate remediation, misleading advertising, or broader compliance failures.

Intellectual property considerations:

The proposed enforcement direction is also relevant for intellectual property owners.

Counterfeit and unauthorized products frequently give rise to overlapping legal issues extending beyond trademark or copyright infringement. A single product listing may simultaneously involve misleading advertising, product safety concerns, inaccurate labeling, warranty issues, and consumer protection violations.

Accordingly, brand owners should avoid treating online enforcement as solely an intellectual property exercise. Internal coordination between IP, consumer protection, product compliance, marketplace enforcement, and litigation teams will become increasingly important where multiple consumer complaints concern the same products or sellers.

Data privacy considerations:

Any increase in collective consumer litigation is likely to require broader preservation and analysis of personal data.

Businesses may need to process information relating to customers, merchants, payment transactions, logistics providers, communications, complaint histories, and digital evidence. Such processing should continue to comply with Thailand’s Personal Data Protection Act.

Organizations should therefore review:

  • legal bases supporting evidence preservation and regulatory disclosures;
  • access controls for complaint and investigation datasets;
  • secure information-sharing procedures with regulators and external advisers;
  • contractual obligations imposed on processors, including marketplaces, call centers, logistics providers, and cloud service providers;
  • document retention policies and litigation-hold procedures; and
  • incident response plans addressing potential personal data breaches involving consolidated claimant information.

Importantly, the prospect of consumer enforcement should not be interpreted as permitting unrestricted disclosure of customer or merchant data. Any disclosure should remain subject to applicable legal authority, proportionality, security safeguards, and appropriate documentation.

Looking ahead:

The OCPB’s announcement remains a policy initiative rather than a binding regulatory change. Nevertheless, it provides an early indication that consumer enforcement may increasingly focus on systemic patterns of misconduct affecting multiple consumers rather than isolated disputes.

Businesses that rely on digital sales channels should therefore begin assessing whether existing compliance, complaint-handling, and evidence-preservation processes would adequately support regulatory investigations or collective litigation involving large groups of consumers.

Key takeaways:

  • Organizations should ensure that complaint investigations and evidence preservation continue to comply with Thailand’s Personal Data Protection Act, particularly where large volumes of personal data are involved.
  • The OCPB is considering greater use of class-action proceedings for widespread consumer harm arising from online commerce.
  • No new legal obligations have been introduced, but the initiative signals a potentially significant shift in enforcement priorities.
  • Businesses should strengthen systems for identifying recurring complaints and preserving evidence relating to products, sellers, and customer interactions.
  • Online platforms and brand owners should integrate consumer protection, product compliance, and intellectual property enforcement rather than treating them as separate functions.

Author: Panisa Suwanmatajarn, Managing Partner

Other Articles

on by

Thailand-Australia Strategic Partnership 2026–2029: Advancing Cybersecurity, Economic Resilience, Cross-Border Crime Cooperation, and Support for SMEs and Startups

Earlier, Thailand’s Cabinet approved the Joint Plan of Action to Implement the Thailand-Australia Strategic Partnership for 2026–2029. The four-year framework succeeds the 2022–2025 Plan and will be signed during the Thai Prime Minister’s official visit to Australia on 17–20 August 2026. It reaffirms the Strategic Partnership elevated in 2020 and provides a practical roadmap for cooperation across five pillars: political and security affairs; economic and trade relations; sectoral collaboration; people-to-people links; and regional and sub-regional engagement (including ASEAN, the Mekong, and the Indo-Pacific).

Two accompanying Joint Statements—one on combating transnational crime and one on strengthening economic cooperation—were approved in parallel. Together they signal a pragmatic, results-oriented deepening of ties with direct relevance for businesses, technology firms, and innovation ecosystems in both countries.

Cybersecurity and Digital Cooperation within the Security Pillar:

The political and security pillar explicitly covers defense cooperation, non-traditional security challenges (including cyber), good governance, and critical technologies. This builds on the existing Memorandum of Understanding on Cyber and Digital Cooperation between Thailand’s Ministry of Digital Economy and Society and Australia’s Department of Foreign Affairs and Trade. That MoU promotes information exchange, best-practice sharing on cybersecurity strategies and laws, protection of critical infrastructure, and a secure, open internet that supports digital trade and innovation.

The new Plan is expected to operationalize these commitments further, creating opportunities for Australian cybersecurity providers, Thai digital-security firms, and joint public-private initiatives focused on threat intelligence, capacity building, and resilience of critical infrastructure. In a region facing rising cyber risks, closer bilateral alignment also strengthens Thailand’s position within ASEAN and Indo-Pacific cyber frameworks.

Joint Statement on Transnational Crime: Targeting Online Scams and Related Threats

The dedicated Joint Statement on combating transnational crime prioritizes online scams/fraud, narcotics trafficking, human trafficking, and money laundering. Cooperation will proceed through bilateral channels and ASEAN mechanisms. This reflects the reality that sophisticated cyber-enabled crime—particularly large-scale online investment and romance scams operating from the region—has become a shared security and economic threat.

Existing operational links between the Royal Thai Police and the Australian Federal Police, including intelligence sharing and joint operations against cybercrime and financial crime networks, provide a foundation. The new Statement is likely to expand structured coordination, capacity building, and disruption of illicit financial flows. For the private sector this translates into stronger expectations around know-your-customer and anti-money-laundering compliance, potential public-private partnerships on fraud detection, and reduced exposure of legitimate businesses and consumers to scam ecosystems.

Economic and Trade Pillar: Resilience, Clean Energy, and Multilateral Trade:

The economic pillar emphasizes growth, resilient supply chains capable of withstanding global volatility, the clean-energy transition, and a robust multilateral trading system. It sits alongside long-standing instruments—the Thailand-Australia Free Trade Agreement (TAFTA), the Regional Comprehensive Economic Partnership (RCEP), and the Strategic Economic Cooperation Arrangement (SECA), which was renewed in late 2025 through 2028.

Two-way goods and services trade reached approximately A$32.4 billion in 2025, underscoring the commercial weight of the relationship. The Plan and the parallel Joint Statement on economic cooperation are expected to facilitate further trade facilitation, agricultural collaboration, and digital-economy linkages while supporting diversification of supply chains.

Opportunities for SMEs and Startups:

Although the full Plan has not yet been published in detail, official summaries highlight support for startups and SMEs, particularly through science, technology, innovation, and digital cooperation. This continues themes already present in the original Strategic Partnership Declaration, which called for extensive digital-economy collaboration to accelerate business growth, including for startups and SMEs, and to develop a digital-ready workforce.

Sectoral cooperation under the Plan spans agriculture, education, climate action, energy, infrastructure, science and innovation, public health, environment, disaster management, and gender equality/social welfare. For technology-oriented SMEs and startups these areas open concrete avenues:

•  Digital and cyber solutions for agriculture, supply-chain resilience, and clean-energy systems.

•  Innovation partnerships, research collaboration, and technology transfer with Australian counterparts.

•  Access to capacity-building, skills development, and potential co-investment or market-entry support under SECA and related mechanisms.

•  Participation in people-to-people exchanges that build networks and talent pipelines.

Australian firms offering cybersecurity tools, digital platforms, agritech, cleantech, or fintech solutions, and Thai startups seeking capital, technology, or export pathways to Australia and the broader Indo-Pacific, stand to benefit from the clearer policy framework and high-level political endorsement.

Looking Ahead

The Joint Plan of Action is a political framework rather than a legally binding treaty. Its value will be realized through concrete projects, dialogues, and private-sector engagement after the formal signing in mid-August 2026. Businesses and legal practitioners should monitor implementing arrangements under the cyber MoU, SECA work programs, and any new working groups on digital economy, innovation, or transnational crime.

For companies operating at the intersection of technology, trade, and compliance, the 2026–2029 Plan reinforces Thailand-Australia cooperation as a practical platform for managing cyber risk, building resilient commercial relationships, and accessing opportunities in a strategically important bilateral partnership.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles