Regulationsby GlyphJurisdiction
Thailand: data, AI and cyber laws
Part of APAC.
Regulations
Add to calendar
Thailand Cybersecurity ActThailand's cybersecurity framework for government agencies and critical information infrastructure (CII) operators. It creates the National Cyber Security Committee and the National Cyber Security Agency (NCSA). It also sets codes of practice and standards, incident reporting and response duties, and escalating powers for serious and critical cyber threats. The Committee issues binding standards under the Act, such as the Website Security Standard B.E. 2568.In effect since May 28, 2019Thailand PDPAThailand's GDPR-style data protection law: lawful bases including explicit consent for sensitive data, data subject rights, DPOs for large-scale or sensitive processing, breach notification to the PDPC within 72 hours, and cross-border transfer restrictions. Main obligations applied from 1 June 2022 after two postponements.In effect since Jun 1, 2022
Past deadlines
Thailand Cybersecurity ActWebsite Security Standard B.E. 2568 enforcedThe website security standard announced on 16 September 2025 becomes enforceable for government agencies, regulators and CII organisations.ThailandThailand PDPAPDPA main obligations take effectCore data protection obligations and penalties apply after postponement Royal Decrees.ThailandThailand Cybersecurity ActCybersecurity Act in forceNCSA states the Act took effect on 28 May 2019.Thailand