As part of its membership in Lex Mundi, Tilleke & Gibbins has published an updated edition of its Guide to Doing Business in Thailand for 2023. This guide outlines the key factors for starting and operating a business in the Thai market. Issues covered include: Investment incentives Financial facilities Exchange controls Import and export regulations Structures for doing business Requirements for the Establishment of a Business Operation of the Business Cessation or Termination of the Business Labor legislation, relations, and supply Tax Immigration requirements This publication is part of Lex Mundi’s Country Guides series prepared by member firms in more than 100 jurisdictions worldwide. The guides serve as a useful resource for planning international business strategy and researching new markets. The full Guide to Doing Business in Thailand is available through the button below.

On December 15, 2022, Thailand’s Personal Data Protection Committee (PDPC) issued the Notification on the Criteria and Procedures for Handling Personal Data Breaches. What Constitutes a “Data Breach”? A “personal data breach” refers to a breach of security measures that causes unlawful or unauthorized loss, access, use, modification, or disclosure of personal data, resulting from an intentional, willful, negligent, accidental, unauthorized, or unlawful act, or an act related to computer crimes, cyber threats, mistakes or accidents, or any other act. The notification also classifies personal data breaches into three categories: confidentiality breach, integrity breach, and availability breach. Upon being informed of an actual or suspected personal data breach, a data controller must take the following actions: To the extent possible, assess the reliability of the information and investigate the facts related to the personal data breach, including all aspects concerning security measures, such as organizational measures, technical measures, and physical measures; Conduct a data breach assessment to consider whether the personal data breach is likely to result in a risk to an individual’s rights and freedom; Notify the Office of the PDPC, any affected data subjects, or both as required; and Take necessary and appropriate action to prevent further consequences resulting from the personal data breach. Breach Assessment When conducting a data breach assessment, the following factors must be taken into account if there is a risk to an individual’s rights and freedom. Nature and the type of data breach; Nature, type, and volume of personal data involved; Nature, type, and status of the affected data subject; Severity of the consequences of the personal data breach for any affected data subjects, and the effectiveness of the measures taken to prevent the data breach; Impact of the data breach on the operation of the business or on the public; Storage

As part of its membership in Lex Mundi, Tilleke & Gibbins has published an updated edition of its Guide to Doing Business in Thailand for 2021. This guide outlines all of the key factors for starting and operating a business in the Thai market. Issues covered include: Investment incentives Financial facilities Exchange controls Import and export regulations Structures for doing business Requirements for the Establishment of a Business Operation of the Business Cessation or Termination of the Business Labor legislation, relations, and supply Tax Immigration requirements This publication is part of Lex Mundi’s Guides to Doing Business series prepared by member firms in more than 100 jurisdictions worldwide. The guides serve as a useful resource when planning an international business strategy or researching a new market.