Thailand Unveils New Draft Data-Sharing Law: What Businesses Need to Know

Thailand’s Big Data Institute (BDI) has launched a public consultation on a proposed draft law that promises to establish the country's first comprehensive data-sharing framework. The initiative aims to create a secure, transparent, and structured regime linking government agencies, private enterprises, and consumers to foster research, innovation, and evidence-based policymaking.

Five Key Dimensions of Data Sharing

The proposed legislation outlines five primary channels through which data can be shared:

• Government-to-Business (G2B): Private entities can request government datasets specifically for research and development (R&D). The BDI will evaluate the applicant's data governance and privacy standards before forwarding requests within 90 days.

• Government-to-Government (G2G): Public agencies will connect via a central Data Integration and Intelligence Platform (D2) managed by the BDI to exchange information under standardized procedures.

• Business-to-Government (B2G): In declared national emergencies involving public safety or disaster response, the Minister of Digital Economy and Society can order private companies to supply necessary data, limited strictly to what is essential.

• Business-to-Consumer (B2C): Sector-specific royal decrees may mandate companies in fields such as banking, insurance, e-commerce, and telecommunications to share customer data with users or authorized third parties under "smart data" concepts.

• Business-to-Business (B2B): B2B data sharing remains grounded in freedom of contract while complying with data protection and competition laws. To build trust, the government will introduce a voluntary certification regime and official trust mark for data service providers.

Privacy Protection and Enforcement

The draft framework fully aligns with Thailand’s Personal Data Protection Act (PDPA). Data shared under the regime must be deidentified, consented to, or backed by a valid legal basis. Non-compliance with emergency B2G requests or sector-specific B2C rules will carry civil fines (pinai) rather than criminal penalties. Additionally, organizations executing data-sharing agreements must disclose basic agreement details to the BDI within 15 days for public transparency.

Key Takeaway for Businesses

While this framework unlocks valuable public sector data for private-sector R&D and commercial innovation, it also introduces potential mandatory data-sharing obligations in emergencies and specific regulated sectors. Companies operating in Thailand should audit their internal data governance structures and monitor regulatory developments to ensure full compliance as the law moves toward final enactment.