The Vietnamese government has demonstrated a strong commitment to building a digital government, digital economy, and digital society through its recently issued national strategy on digital infrastructure. Under Decision No. 1132/QD-TTg dated October 19, 2024, on “Digital Infrastructure Strategy to 2025 with Orientation to 2030,” the government will create supportive conditions for both domestic and international businesses to invest in digital infrastructure with cybersecurity as a priority. Recognized as vital to the economy, this digital infrastructure will consist of four main components: (i) telecommunications and internet infrastructure, (ii) data infrastructure, (iii) physical-digital infrastructure, and (iv) digital utility infrastructure, including digital technology as a service. Key goals for 2025 include universal fiber optic access for households, 100% 5G coverage across all provinces and cities, deployment of at least two new international undersea fiber optic cables, establishment of AI data centers, development of green-standard data centers, and platforms for IoT, AI, big data, blockchain, and cybersecurity. By 2030, goals include fiber access with speeds of at least 1 Gbps, 5G coverage for 99% of the population, readiness for 6G trials, six additional international undersea fiber optic cables, development of a hyperscale data center, and positioning Vietnam as a digital hub. To achieve these goals, the government has outlined some core tasks, creating significant opportunities for both foreign and domestic investors: Developing telecommunications and internet infrastructure for widespread fiber optic and 5G access, while preparing for emerging technologies like 6G, Open RAN, satellite, and IpV6. Telecommunication enterprises will jointly invest in and share the use of international fiber optic cable routes to ensure efficient capacity utilization and optimize investment capital. Attracting foreign and domestic investment to establish hyperscale data centers and cloud computing services that meet global standards. Creating physical-digital infrastructure by integrating technology across key sectors such as transportation, energy, healthcare,

On October 31, 2024, Thailand’s Office of the Personal Data Protection Committee (PDPC) opened a public consultation period on its draft notifications—one directed at data controllers and another at data processors—regarding exemptions from the requirement to create and maintain records of processing activities (ROPAs) under the Personal Data Protection Act B.E. 2562 (2019) (PDPA). The draft notification for data controllers aims to amend and revoke certain aspects of the first ROPA exemption notification issued in June 2022 and outlines the criteria for data controllers to be exempted from the obligation to prepare and maintain such records. Although it is officially titled “Notification of the Personal Data Protection Committee on Exemption from Record-Keeping Requirements for Small Business Data Controllers,” this draft notification applies to all types of exempted data controllers (see list below), and not only small businesses. The draft notification for data processors is new and does not replace any prior notification. The criteria under both draft notifications exempt certain data controllers and data processors from the obligation to maintain ROPAs, but exempted data controllers are not free from the obligation to retain information on the rejection of data subjects’ requests to exercise certain rights under the PDPA. While these criteria remain consistent with the June 2022 ROPA exemption notification, there are a few key takeaways from the notifications, as detailed below. Types of Exempted Parties The draft notification on data controllers adds condominium and housing estate juristic persons, as well as individuals, to the list of parties eligible for an exemption, while removing internet cafes from the list. The new draft notification for data processors mirrors the corresponding list in the draft notification for data controllers. The complete list of parties eligible for ROPA exemptions under the draft notifications is as follows: SMEs according to the law on

Tilleke & Gibbins has contributed the Thailand chapter to the Franchise 2025 from the International Comparative Legal Guides (ICLG) series published by Global Legal Group. This comprehensive guide provides detailed analysis of franchise laws and regulations across multiple jurisdictions worldwide. Each chapter of the guide follows a Q&A format, organized into key sections covering critical aspects of franchise law and operations, including: Relevant legislation and rules governing franchise transactions Business organization options for franchised operations Competition law considerations Protection of intellectual property and brands Liability issues and risk mitigation Governing law and dispute resolution Real estate matters Online trading regulations Termination requirements Joint employer risks and vicarious liability Currency controls and taxation Commercial agency considerations Good faith obligations and fair dealing requirements Ongoing relationship management Franchise renewal processes Franchise migration procedures Electronic signatures and document retention The Thailand chapter, authored by Alan Adcock and Kasama Sriwatanakul, examines these topics in detail, with particular attention to recent developments like the Trade Competition Commission’s Franchising Guidelines which introduced new disclosure requirements and protections for franchisees. The complete Thailand chapter is available as a PDF below. The Thailand chapter—and the full Franchise 2025 guide—are also freely available on the ICLG website.

Thailand’s Anti-Money Laundering Office has released new guidelines on customer due diligence (CDD) for insurance companies to outline anti-money laundering and counter-terrorism financing measures based on the Anti-Money Laundering Act B.E. 2542 (1999). The previous guidelines were revoked and replaced by these guidelines. The guidelines include seven key measures: Anti-money laundering and counter-terrorism financing policy: Insurance companies must establish a policy in Thai that outlines the organization’s approach to assessing, managing, and mitigating risks related to money laundering, terrorism financing, and proliferation. Risk management framework: Insurance companies’ frameworks for risk management are to be divided into three stages: (1) internal risk management, (2) risk assessment before customer onboarding, and (3) ongoing customer risk management. CDD before engagement with customers: Insurance companies must implement a rigorous approval process to verify customers’ identities. Customer information review and transaction monitoring: Insurance companies must update customer information and the list of banned transactions to ensure compliance with current risk profiles. Enhanced CDD for high-risk clients: Insurance companies must apply a stricter level of verification and monitoring measures for high-risk clients, including reviews of financial transactions. Third-party reliance and subsidiary controls: Reliance on third parties is allowed only in processes for customer identification and verification of identity. Internal controls and policies for subsidiaries or affiliates must be updated regularly. Suspicious transaction reporting: Insurance companies must report any suspicious transactions, particularly whenever CDD is not available. For more details on the CDD guidelines, or on any aspect of insurance and anti-money laundering regulations in Thailand, please contact Athistha (Nop) Chitranukroh at [email protected], Witchupong Chittchang at [email protected], Ajaree Trachukul at [email protected], or Sireethorn Wijan at [email protected].