Thailand: technology regulation at a glance

Framework: Emergency Decree on Digital Asset Businesses B.E. 2561 (2018), administered by the Securities and Exchange Commission (SEC) of Thailand under the Ministry of Finance; supplemented by Bank of Thailand (BOT) rules for payments/stablecoins and Revenue Department tax rules.

Crypto is legal in Thailand and operates under a comprehensive licensing regime established by the 2018 Emergency Decree on Digital Asset Businesses. The Thai SEC licenses exchanges, brokers, dealers, ICO portals, custodians and fund managers, while the BOT restricts crypto as a means of payment and is preparing a baht-backed stablecoin framework. Enforcement is active: in 2025 five unlicensed offshore exchanges (Bybit, OKX, CoinEx, 1000X, XT.COM) were blocked, and the SEC/BOT are tightening oversight of USDT and grey-money flows in 2026.

Framework: Draft Principles for AI Legislation (ETDA, 2025); National AI Strategy and Action Plan 2022-2027; AI Governance Center (AIGC) under ETDA

Thailand has no comprehensive AI law in force as of May 2026. The Electronic Transactions Development Agency (ETDA) circulated Draft Principles for AI Legislation in mid-2025, a risk-tiered framework modelled on the EU AI Act, with a full AI Act bill expected to be prepared in 2026. In the interim, AI governance is addressed through sectoral guidance from the Bank of Thailand and the Personal Data Protection Committee, and the non-binding National AI Strategy and Action Plan (2022-2027).

Framework: Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), supervised by the Personal Data Protection Committee / Office of the PDPC

Thailand has a comprehensive, GDPR-style data-protection regime under the Personal Data Protection Act B.E. 2562 (2019), which entered into full force on 1 June 2022. It is administered and enforced by the Personal Data Protection Committee (PDPC) and its Office, which issue subordinate regulations and have, since August 2025, begun imposing substantial administrative fines after an initial awareness-building period.

Framework: Payment Systems Act B.E. 2560 (2017), administered by the Bank of Thailand (BOT); Ministry of Finance issues designated payment service licenses on BOT recommendation

Thailand has a comprehensive, operational licensing regime for digital payments and fintech anchored in the Payment Systems Act 2017, with the Bank of Thailand as the primary prudential and oversight authority. Payment service providers, including e-money issuers, credit/debit card operators, and bill-payment services, must obtain a Designated Payment Service License from the Ministry of Finance on BOT recommendation, or register with the BOT depending on scope. The framework was significantly extended in June 2025 when the Ministry of Finance approved three virtual bank applicants, and BNPL remains the principal gap, with formal guidelines expected in 2026.

Framework: Destination Thailand Visa (DTV) issued by Ministry of Foreign Affairs / Immigration Bureau; Long-Term Resident (LTR) Visa administered by Board of Investment (BOI); both updated 2024-2025

Thailand operates two explicit long-stay pathways for remote workers. The Destination Thailand Visa (DTV), launched June 2024, is a 5-year multiple-entry visa for digital nomads and freelancers earning income from abroad, requiring 500,000 THB (~USD 14,000) in savings. The LTR Visa 'Work-from-Thailand Professionals' category provides a 10-year renewable permit for higher-earning remote employees of qualifying foreign companies. Cabinet reforms in January 2025 relaxed income and employer thresholds across the LTR program.

Framework: Computer Crimes Act B.E. 2550 (2007, amended 2017); Emergency Decree on Technology Crime B.E. 2566 (2023, amended April 2025); Royal Decree on Digital Platform Services B.E. 2565 (2022); ETDA Notification on Social Media Measures (July 2025), enforced by MDES and ETDA

Thailand regulates online content through a layered, fragmented set of laws rather than a single omnibus framework. The Computer Crimes Act and Emergency Decree on Technology Crime form the core content-restriction regime, supplemented by the 2022 Royal Decree on Digital Platform Services that imposes registration and transparency duties on platforms. A July 2025 ETDA notification introduced a 24-hour takedown obligation for social media platforms, marking a significant shift toward active platform governance, though civil-society groups warn it enables overbroad censorship.

Framework: Cybersecurity Act B.E. 2562 (2019), administered by the National Cyber Security Committee (NCSC) and National Cyber Security Agency (NCSA); complemented by the Personal Data Protection Act B.E. 2562 (2019) for data-breach duties and sector regulators (e.g. Bank of Thailand) for financial services.

Thailand has an in-force, dedicated cybersecurity regime under the Cybersecurity Act B.E. 2562 (2019), which entered full effect on 24 May 2019 and creates a national governance structure (NCSC and NCSA), a three-tier threat classification, and binding obligations on Critical Information Infrastructure (CII) operators across designated sectors. These general obligations are layered over a personal-data breach-notification duty in the PDPA (notify the PDPC within 72 hours) and sector-specific rules such as the Bank of Thailand's IT-risk and security notifications for financial institutions. Subordinate regulation is actively maturing, including a September 2025 Royal Gazette notification revising the official CII sector list and detailing CII operators' incident-reporting duties.

Framework: Foreign Business Act B.E. 2542 (1999) (Ministry of Commerce); Civil and Commercial Code (company formation); administered by the Department of Business Development (DBD), Ministry of Commerce

Thailand permits foreigners to register private limited companies through the DBD, which moved to a fully digital platform (DBD Biz Regist) from 1 January 2026. However, the Foreign Business Act caps foreign equity at 49% in most sectors; majority foreign ownership requires either a Foreign Business Licence, BOI promotion, or a bilateral treaty exemption. Cabinet approved FBA amendments in April 2025 and May 2026 to delist up to ten restricted categories, with implementation expected mid-to-late 2026.