While much attention has been paid to the data localization requirements for foreign enterprises under Vietnam’s 2018 Cybersecurity Law (“CSL”) and the recently issued Decree 53 guiding its implementation, the corresponding requirements for domestic enterprises are often overlooked, despite being potentially more troublesome. Under Decree 53, “domestic enterprises” are defined to mean enterprises established or registered for establishment under Vietnamese law and having their head offices in Vietnam (Article 2.11), so this designation includes not only Vietnamese companies, but foreign-invested enterprises as well. Background Before analyzing the stipulations in Articles 26 and 27 of Decree 53 further guiding the data localization/storage requirements, it is worth restating the very problematic Article 26.3 of the CSL, which reads: “Domestic and foreign enterprises providing services on telecommunication networks or the internet or value-added services in cyberspace in Vietnam with activities of collecting, exploiting, analyzing, and/or* processing personal information data, data on the relationships of service users, or data generated by service users in Vietnam must store such data in Vietnam for the period prescribed by the government. Foreign enterprises mentioned in this clause must open branches or representative offices in Vietnam.” [* Note: The Vietnamese text simply uses a comma here, without specifying whether this should be “and” or “or,” leading to additional problems in interpretation.] Because of this very broad and ambiguous wording, Article 26.3 of the CSL required further guidance from the government and remained unenforced for more than three years after the CSL took effect on January 1, 2019. Decree 53 guiding the implementation of the CSL was finally issued on August 15, 2022, and provides additional clarity on this matter. But does Decree 53 provide sufficient guidelines for implementation with regard to domestic enterprises? Scope of Application With regard to foreign enterprises, although there remains some ambiguity, Decree

The Thai National Cybersecurity Committee (NCSC), as required by the Cybersecurity Act, reported to the cabinet in mid-August on trends and developments regarding cyber incidents in Thailand. According to the NCSC, the top five most common cyber incidents involve website phishing, website defacement, data leakage, data security vulnerabilities, and ransomware. Reported incidents of cyberattacks have increased in recent years. The report stated that affected organizations primarily responded to cyber incidents and attacks by notifying the NCSC about the incident and the remedial actions planned or taken, and conducting internal training to increase awareness of cyber threats. Only two organizations chose to conduct IT risk assessments and vulnerability tests as preventive measures against future cyber threats. The NCSC report also showed that aside from telecom infrastructure, energy and utilities, and education operators falling victim to cyberattacks, healthcare, webhosting, and data center operators have also become “more common victims” of cyber incidents. The NCSC recommended that all organizations prepare for inevitable future cyber incidents. This includes ensuring that businesses and organizations comply with international standards, which includes measures that are recognized and incorporated in Thailand’s Personal Data Protection Act (PDPA) and Cybersecurity Act. Conducting internal training for employees as well as directors and officers is also recommended by the NCSC, as this can help prevent cyber incidents and ensure that businesses comply with the minimum required security standards issued by the Personal Data Protection Committee (PDPC) in their Notification Re: Security Measures of the Data Controller B.E. 2565 (2022), which came into effect on June 21, 2022. Industry-specific minimum required security standards (e.g., those regulated by the Bank of Thailand, Office of Insurance Commission, etc.) should also be considered in conjunction with those in this PDPC notification—particularly when sectoral requirements are more stringent than the PDPC’s recommended measures. PDPA statutory penalties

On June 2, 2022, Thailand’s Office of Insurance Commission (OIC) issued Notification No. 6 Re: Investments in Other Business Operations for both life and non-life insurance companies. The two notifications, which took effect upon issuance, strengthen the OIC’s supervision of investments by insurance companies, with a focus on basic infrastructure relevant to the promotion of business competition and sustainability, and also allow and regulate additional investment types. Internal Governance of Investment Activities An insurance company’s board of directors is required to appoint a credit committee when engaging in credit activities. These activities include providing loans (excluding personal loans to employees or loans made under a guarantee by its insurance policies), car leasing services, avals for bills of exchange, and letters of guarantee for project performance. The credit committee has the following duties: Preparing the credit policy framework for the credit activities described above for further board approval; Supervising the credit activities; Overseeing good corporate governance, transparency, and prevention of conflict of interest in relation to credit activities; Ensuring that the work system, manpower, and data in relation to credit activities are sufficient; and Regularly reporting to the board of directors regarding credit activities. Credit policies must at least cover: Procedures and conditions for credit transactions. These include risk management, internal controls, data storage, and written reporting requirements. The procedures and conditions must comply with the relevant OIC regulations and the Bank of Thailand’s minimum standards for financial institutions. Persons responsible for operations relating to credit work, risk management for credit transactions, and verification of credit transactions. These roles include (1) the credit analyst, (2) the person who approves appropriate credit transactions, (3) the verifier of work accuracy after a credit transaction is approved, (4) the person in charge of reporting credit transaction risks, and (5) the person responsible for

Thailand’s Draft Climate Change Act Countries around the world have given significant attention to climate change legislation, with many national, regional, and global attempts to slow the momentum of climate change. The most notable of these multilateral efforts is the Paris Agreement, a legally binding international treaty on climate change currently adopted by 193 parties. Its goal is to limit the global average temperature to well below 2°C (preferably below 1.5°C) above preindustrial levels, and the treaty’s coordinated efforts to combat climate change are much more ambitious than previous global agreements and discussions. Article 4 of the Paris Agreement requires countries to provide “nationally determined contributions” (NDCs), consisting of their action plans for climate action. Thailand, as a party to the Paris Agreement, has put forth an NDC that pledges to achieve an unconditional greenhouse gas (GHG) emission reduction target of 20% from the business-as-usual projection for 2030, with the possibility of increasing that target to 25% subject to adequate and enhanced access to technology development and transfer, financial resources, and other support. To enable the accomplishment of this pledge, Thailand is looking to enact climate change legislation that functions as a key mechanism for domestic climate action. In 2018, the Office of Natural Resources and Environmental Policy and Planning (ONEP) under the Ministry of Natural Resources and Environment was assigned to prepare a draft Climate Change Act. The draft is now complete, and according to news reports it is set to be submitted to the cabinet for further consideration. The draft Climate Change Act lays out Thailand’s action plan for climate change mitigation and adaptation, including emissions reductions. Some of the key sections in the draft law involve citizen rights, the National Climate Change Policy Committee, and a national GHG database. Rights of Citizens The draft establishes the