Thailand’s National Cyber Security Committee (NCSC) released three notifications under the Cybersecurity Act on January 18, 2024, setting cybersecurity-related requirements for key organizations and assets. While one of these notifications already took effect, the two most notable will take effect on January 18, 2025 (i.e., one year from their publication in the Government Gazette). These two are the NCSC Notification Re: Standards for Defining the Security Category for Data or Information Systems B.E. 2566 (2023) (“Notification on Security Category”) and the NCSC Notification Re: Minimum Standards for Data and Information Systems B.E. 2566 (2023) (“Notification on Minimum Standards”). These notifications apply to: State agencies; Supervising or regulating organizations (i.e., state organizations, private organizations, or persons designated by law to regulate or supervise the affairs of state organizations or critical information infrastructure organizations); and Critical information infrastructure organizations (i.e., organizations related to or providing national security, significant public services, banking and finance, information technologies and telecommunications, transportation and logistics, energy and public utilities, and public health). Collectively these are defined as “Organizations” under the notifications. Notification on Security Category The Notification on Security Category sets forth risk-based security classifications—or “security categories”—for Organizations’ data or information systems. For security category assessment purposes, Organizations are required to perform a self-assessment of their data or information systems based on three key security objectives: confidentiality, integrity, and availability. Each of these objectives is further categorized into three risk levels (low, medium, and high), taking into account the assessment of potential impact in the following areas: Organizations’ financial value or reputation; Organizations’ number of service users; Organizations’ ability to perform their duties; State stability or public order. The risk levels for the three objectives are determined by considering whether there are “minimal,” “severe,” or “serious severe” effects, as described below: Confidentiality (not including data classified

Thailand is preparing to implement new rules on drug importation for clinical studies. The Medicines Regulation Department of Thailand’s Food and Drug Administration (Thai FDA) first issued the Notification Re. Detailed Requirements for Drug Importation into Thailand for Clinical Studies almost a year ago, and the notification is expected to come into effect on March 1, 2024. Key Provisions The notification aims at enhancing the efficiency of conducting clinical studies while ensuring the protection of human subjects participating in such studies within Thailand. Some of its key provisions include: Definition of Clinical Study. The notification defines a “clinical study” as a study of a medicine involving human subjects, conducted to provide supporting evidence for the registration of a medicinal product in Thailand or other countries, including for additional indications or variations of a registration dossier. Compliance with ICH GCP. Clinical studies conducted in Thailand must adhere to the current edition of the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use (ICH) Good Clinical Practice (GCP) guidelines. Clinical Trial Application. Sponsors are required to submit a clinical trial application along with supporting documents to the Thai FDA for approval before commencing a clinical study. The permit remains valid for five years and is renewable. Supply of Investigational Drugs. Sponsors must obtain investigational drugs from manufacturers compliant with Good Manufacturing Practice (GMP) standards as recognized by the Thai FDA. Postapproval Obligations. The secretary-general of the Thai FDA may impose postapproval conditions or order investigators to conduct or suspend certain activities to ensure human subject protection and regulatory compliance. Regulatory Oversight. The Thai FDA is responsible for inspecting and overseeing the regulatory compliance of clinical studies, including during prestudy, ongoing, and poststudy phases. The Thai FDA may also conduct inspections of clinical studies conducted overseas. The Thai FDA

Attorneys in Tilleke & Gibbins’ regulatory affairs team have produced the Cannabis and Hemp Business Guide – Thailand, a primer on the rapidly developing cannabis industry in Thailand.

The pervasive global issue of illicit personal data trading has extended its reach into Vietnam, where such sensitive information is being sold at minimal costs. A 2023 report from the Ministry of Public Security revealed that over two-thirds of the Vietnamese population has fallen victim to unlawful data collection and distribution. In the past two years, authorities have pressed charges on five criminal cases involving the buying and selling of billions of items of personal data, encompassing a wide range of sensitive information such as names, phone numbers, email addresses, and more. Notably, a person’s profile can be acquired for just USD 1, while profiles of millions of business customers can be obtained for a mere USD 100. Recognizing the severity of the problem, Vietnam has made serious efforts to combat illicit personal data trading by criminal means, encompassing both the legal framework and practical implementation.   Understanding the Criminal Legal Framework Vietnam’s 2015 Criminal Code, as amended in 2017, functions as a pivotal legal instrument delineating offenses and their corresponding punishments. Under Section 2 of Chapter XXI of the Criminal Code (“Offenses Against Regulations on Information Technology and Telecommunications Networks”), individuals engaging in the illicit trading of personal data, depending on the nature of the data (e.g., information about phone number, address, or—more dangerously—bank account) and the nature of the infringing acts, may be charged under different crimes. The sanctions can include monetary fines; non-custodial reform; imprisonment; and/or prohibition from holding certain positions, practicing certain professions, or doing certain jobs. For example, for the illicit trade of private information of an individual on a computer or telecommunications network, Article 288 of the Criminal Code specifies penalties including a monetary fine of up to VND 1 billion (equivalent to around USD 41,000); non-custodial reform of up to three years;