Thailand has issued the Royal Decree on Digital Platforms, which was published in the Government Gazette on December 22, 2022. The royal decree provides a grace period of 240 days from its publication for digital platform providers to take the actions necessary to ensure compliance. The key requirements are outlined below. Definitions After going through various amendments in its draft stages, the published royal decree’s definition of “digital platform” refers to the provision of an electronic intermediary platform that manages information to create connections between “merchants,” “consumers,” and “users” via a computer network in order to create electronic transactions—regardless of whether payment is actually made. However, this does not include digital platforms that offer goods or services of the digital platform operator or an affiliated company acting as its representative, regardless of whether the goods or services are offered to third parties or to affiliated companies. Notification Exemption Under the royal decree, a digital platform provider under the supervision of other authorities, such as the Bank of Thailand and the Securities and Exchange Commission, or falling under the Electronic Transactions Commission’s list of exempted digital platform providers is exempted from the requirement to notify the Electronic Transactions Development Agency (ETDA) of the operation of its digital platform. The commission may also exempt any other digital platform service as it sees fit. Extraterritorial Effect Certain digital platforms located outside Thailand are subject to the royal decree and must appoint a coordinating person in Thailand. This requirement to appoint a local coordinator does not mean that overseas digital platforms have to establish their business in Thailand. Digital Platform Certification Mark The royal decree introduces an ETDA certification mark for digital platforms. Display of the mark appears not to be mandatory, but more specific rules, procedures, and other details will be prescribed

Tilleke & Gibbins’ insurance specialists in Yangon have contributed the Myanmar overview to the Insurance and Reinsurance Global Guide, published by Thomson Reuters Practical Law. The guide is a Q&A-style overview of insurance and reinsurance law, with entries from legal experts in 47 jurisdictions worldwide. Tilleke & Gibbins’ Myanmar contribution provides a comprehensive look at the market for insurance and reinsurance in the country, and it covers the following topics: Market trends Regulatory framework Authorization – Laws and bodies, insurance intermediaries, exemptions and foreign insurers, fronting, legal forms, restrictions and insurance activities Ownership restrictions Ongoing requirements Penalties for noncompliance Sales and marketing Transfer of risk Reinsurance contracts and risk Contracts and policies – Content requirements and common clauses, implied terms, customer protections, standard policies or terms Claims – Establishing a claim, time limits, subrogation, third-party claims, insurance of punitive damages, remedies for breach of policy Dispute resolution Insolvency Tax Insurtech The Q&A closes with a brief update on the new draft Insurance Business Law to reform the Myanmar insurance market. Practical Law brings together guides to key legal practice areas around the world for business lawyers. Tilleke & Gibbins contributes many overviews on various legal practice areas for all of the firm’s jurisdictions in Southeast Asia. To read the full Myanmar overview, please visit the Practical Law website.

On December 15, 2022, Thailand’s Personal Data Protection Committee (PDPC) issued the Notification on the Criteria and Procedures for Handling Personal Data Breaches. What Constitutes a “Data Breach”? A “personal data breach” refers to a breach of security measures that causes unlawful or unauthorized loss, access, use, modification, or disclosure of personal data, resulting from an intentional, willful, negligent, accidental, unauthorized, or unlawful act, or an act related to computer crimes, cyber threats, mistakes or accidents, or any other act. The notification also classifies personal data breaches into three categories: confidentiality breach, integrity breach, and availability breach. Upon being informed of an actual or suspected personal data breach, a data controller must take the following actions: To the extent possible, assess the reliability of the information and investigate the facts related to the personal data breach, including all aspects concerning security measures, such as organizational measures, technical measures, and physical measures; Conduct a data breach assessment to consider whether the personal data breach is likely to result in a risk to an individual’s rights and freedom; Notify the Office of the PDPC, any affected data subjects, or both as required; and Take necessary and appropriate action to prevent further consequences resulting from the personal data breach. Breach Assessment When conducting a data breach assessment, the following factors must be taken into account if there is a risk to an individual’s rights and freedom. Nature and the type of data breach; Nature, type, and volume of personal data involved; Nature, type, and status of the affected data subject; Severity of the consequences of the personal data breach for any affected data subjects, and the effectiveness of the measures taken to prevent the data breach; Impact of the data breach on the operation of the business or on the public; Storage

The updated Thailand chapter of The Pharma Legal Handbook, published by Pharma Boardroom, is a comprehensive guide to the legal framework regulating the healthcare and life sciences industries in Thailand. The latest Thailand chapter was authored by four of Tilleke & Gibbins’ life sciences specialists in Bangkok: Alan Adcock, partner and and head of the firm’s regional life sciences practice; Dr. Atthachai Homhuan, director of regulatory affairs; San Chaithiraphant, senior associate; and Kittiya Nopparatrunroj, regulatory affairs consultant. The handbook is a must-read for healthcare and life sciences companies that are interested in exploring expansion into the Thai market. The guide is broken into ten easy-to-read sections that delve into various aspects of local regulations: Regulatory, Pricing, and Reimbursement Overview Preclinical and Clinical Trial Requirements Marketing, Manufacturing, Packaging and Labeling, Advertising Traditional Medicines and Over-the-Counter Products Product Liability Patents and Trademarks Regulatory Reforms Cannabinoid Drugs, Medical Cannabis, and Opioid Drugs Orphan Drugs and Rare Diseases Localization Biosimilars and Biologics A preview of the Thailand chapter is provided via the PDF button below, and the complete guide is available for purchase on the Pharma Boardroom website (use promotional code Tilleke10 for a 10% discount).