Thailand Cybersecurity Report Calls for Organizational Readiness

September 6, 2022

Thailand Cybersecurity Report Calls for Organizational Readiness

The Thai National Cybersecurity Committee (NCSC), as required by the Cybersecurity Act, reported to the cabinet in mid-August on trends and developments regarding cyber incidents in Thailand. According to the NCSC, the top five most common cyber incidents involve website phishing, website defacement, data leakage, data security vulnerabilities, and ransomware.

Reported incidents of cyberattacks have increased in recent years. The report stated that affected organizations primarily responded to cyber incidents and attacks by notifying the NCSC about the incident and the remedial actions planned or taken, and conducting internal training to increase awareness of cyber threats. Only two organizations chose to conduct IT risk assessments and vulnerability tests as preventive measures against future cyber threats.

The NCSC report also showed that aside from telecom infrastructure, energy and utilities, and education operators falling victim to cyberattacks, healthcare, webhosting, and data center operators have also become “more common victims” of cyber incidents.

The NCSC recommended that all organizations prepare for inevitable future cyber incidents. This includes ensuring that businesses and organizations comply with international standards, which includes measures that are recognized and incorporated in Thailand’s Personal Data Protection Act (PDPA) and Cybersecurity Act.

Conducting internal training for employees as well as directors and officers is also recommended by the NCSC, as this can help prevent cyber incidents and ensure that businesses comply with the minimum required security standards issued by the Personal Data Protection Committee (PDPC) in their Notification Re: Security Measures of the Data Controller B.E. 2565 (2022), which came into effect on June 21, 2022. Industry-specific minimum required security standards (e.g., those regulated by the Bank of Thailand, Office of Insurance Commission, etc.) should also be considered in conjunction with those in this PDPC notification—particularly when sectoral requirements are more stringent than the PDPC’s recommended measures.

PDPA statutory penalties include civil liabilities with punitive damages, administrative fines, and criminal penalties targeting both businesses and their directors and officers. However, proving that these parties have complied with the applicable requirements and implemented the minimum required standards for data protection can greatly reduce the exposure, potential liabilities, and fines resulting from cyberattacks—especially incidents involving personal data and sensitive personal data.

Tilleke & Gibbins is experienced in helping companies set up protocols to protect themselves and their personnel from these liabilities. For more details, or for assistance understanding any aspect of cybersecurity or personal data protection laws in Thailand, please contact our data protection, privacy, and security team at [email protected], [email protected], or [email protected].

Related Professionals

Athistha (Nop) Chitranukroh

Partner and Director, Corporate and Commercial

Thailand

+66 2056 5600

Email

Nopparat Lalitkomon

Thailand, Vietnam,

+66 2056 5646

Email

Napassorn Lertussavavivat

Thailand

+66 2056 5662

Email

RELATED INSIGHTS

November 15, 2024

Changes to Domain Name Dispute Resolution Under Vietnam’s New Internet Decree

Vietnam’s new Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”), which will come into effect on December 25, 2024, replacing Decree No. 72/2013/ND-CP (“Decree 72”), introduces several changes to the regime for domain name dispute resolution. The new decree aims to clarify the legal framework and address some longstanding inconsistencies between Vietnam’s laws on intellectual property and information technology. The main changes related to domain name dispute resolution under Decree 147 are summarized below. Removal of Prescriptive Actions Decree 147 no longer lists specific actions for resolving domain name disputes. Decree 72 had outlined three methods: negotiation/mediation, arbitration, and court. However, IP practitioners had long criticized this approach, arguing it conflicted with the IP Law, which additionally allows administrative action. By omitting these methods, the new decree implies an acceptance of administrative action as provided in the IP Law. However, Decree 147 remains silent on establishing a dispute resolution forum aligned with the CPTPP’s requirement for a UDRP-like model. Currently, Vietnam’s available forums do not fully conform to the UDRP framework. An anticipated circular may provide further guidance on this aspect. Deactivation of Domain Names Decree 72 does not have any provision on the deactivation of a domain name. However, Decree 147 has stipulated some situations where domain names will be deactivated, such as when there is a request from an authority, or when it is discovered that incorrect information was used for registration. Clearer Criteria for Dispute Resolution Article 16 of Decree 147 sets out three clear criteria that must be met for domain name dispute resolution to proceed: (i) confusing similarity with the plaintiff’s trademark, trade name, or personal name; (ii) the defendant’s lack of legitimate rights or interests in the domain name; and (iii) bad faith. Previously,

November 15, 2024

Vietnam Issues New Decree Governing Internet Services and Online Information

On November 9, 2024, the government of Vietnam promulgated Decree No. 147/2024/ND-CP on the management, provision, and use of internet services and online information (“Decree 147”). This decree supersedes the previous Decree No. 72/2013/ND-CP dated July 15, 2013, on the same topic (“Decree 72”) and its amending regulations, and will take effect on December 25, 2024. Spanning over 200 pages, with an appendix of 62 forms, Decree 147 addresses a wide range of key internet and online topics, including internet services; domain names; cross-border information provision; social network services; aggregated information websites; online game services; app store services; information content services on mobile telecom networks; responsibilities of telecom, internet, web hosting, data center, and telecom application service providers; and measures to handle illegal content. This decree is expected to have a significant impact on both onshore and offshore service providers in the respective fields, and will potentially tighten the regulatory landscape for internet services and online information provision in Vietnam. Some highlights from the new Decree 147 compared to its predecessor are detailed below. Cross-Border Information Provision Offshore service providers, including offshore social network service providers and offshore app store service providers, who provide services on a cross-border basis and either lease data storage in Vietnam or meet a threshold of 100,000 or more total visits per month from Vietnam for six consecutive months must adhere to stricter requirements than other providers. Notable obligations of these regulated cross-border providers include: Notifying the Authority of Broadcasting and Electronic Information (ABEI) of their contact information. Monitoring and removing illegal content. Storing and managing user data as required. Authenticating social network user accounts using Vietnamese mobile number or ID number. Reporting to the ABEI annually as well as on an ad hoc Handling user complaints. Only cross-border providers who have notified the

November 13, 2024

Thailand to Set Additional Obligations for Specific Digital Marketplaces

Thailand’s Electronic Transactions Committee has publicized a new draft notification detailing additional duties for specific marketplace digital platform service operators under Section 18(2) of the Royal Decree on Operation of Digital Platform Service Businesses Subject to Prior Notification B.E. 2565 (2022). The draft notification, which is open for public comments until November 30, 2024, aims to provide enhanced protection for users of “specific marketplace platforms” (defined below). Some key points of the draft notification are detailed below. Scope The draft notification applies to “marketplace digital platform services,” which refers to digital platform services that serve as an intermediary for buying or exchanging goods and provide services to facilitate sale transactions, such as providing communication systems (e.g., chat features), shopping carts, delivery arrangements, and supplemental payment processing facilitation. “Specific marketplace platforms” refers to Section 18(2) of the Royal Decree on Digital Platform Services, which covers digital platform services that pose risks to financial and commercial security, the reliability and credibility of data messaging systems, or potential harm to the public, and that have a high level of potential impact based on the criteria for assessing the impact of digital platform service operations. Key Obligations Registration. The draft notification requires the marketplace operators mentioned above to be registered as legal entities in Thailand. Terms and conditions. The draft notification details additional obligations relating to marketplace operators’ terms and conditions: In addition to existing obligations prescribed in the Royal Decree and the relevant subordinate laws, the draft notification emphasizes that the terms and conditions must be in Thai, clear, accessible, and understandable, and may include graphical elements to aid explanation. The terms and conditions must prescribe conditions relating to the sale of products subject to specific standards, such as those restricted under the Food Act, the Drugs Act, and the Industrial Product

November 11, 2024

Vietnam’s Digital Hub Aspirations Will Open Opportunities for Investors

The Vietnamese government has demonstrated a strong commitment to building a digital government, digital economy, and digital society through its recently issued national strategy on digital infrastructure. Under Decision No. 1132/QD-TTg dated October 19, 2024, on “Digital Infrastructure Strategy to 2025 with Orientation to 2030,” the government will create supportive conditions for both domestic and international businesses to invest in digital infrastructure with cybersecurity as a priority. Recognized as vital to the economy, this digital infrastructure will consist of four main components: (i) telecommunications and internet infrastructure, (ii) data infrastructure, (iii) physical-digital infrastructure, and (iv) digital utility infrastructure, including digital technology as a service. Key goals for 2025 include universal fiber optic access for households, 100% 5G coverage across all provinces and cities, deployment of at least two new international undersea fiber optic cables, establishment of AI data centers, development of green-standard data centers, and platforms for IoT, AI, big data, blockchain, and cybersecurity. By 2030, goals include fiber access with speeds of at least 1 Gbps, 5G coverage for 99% of the population, readiness for 6G trials, six additional international undersea fiber optic cables, development of a hyperscale data center, and positioning Vietnam as a digital hub. To achieve these goals, the government has outlined some core tasks, creating significant opportunities for both foreign and domestic investors: Developing telecommunications and internet infrastructure for widespread fiber optic and 5G access, while preparing for emerging technologies like 6G, Open RAN, satellite, and IpV6. Telecommunication enterprises will jointly invest in and share the use of international fiber optic cable routes to ensure efficient capacity utilization and optimize investment capital. Attracting foreign and domestic investment to establish hyperscale data centers and cloud computing services that meet global standards. Creating physical-digital infrastructure by integrating technology across key sectors such as transportation, energy, healthcare,

You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

Industries

Practices

September 6, 2022