Digital Trust in Action: ETDA’s Key Priorities for 2027

The Electronic Transactions Development Agency (ETDA) has set out its key priorities for 2027, signaling a significant transition in the development of Thailand’s digital regulatory environment. While much of ETDA’s work in recent years has focused on building regulatory frameworks, technical standards and trusted digital infrastructure, the emphasis for 2027 is increasingly on putting those mechanisms into actual use.

ETDA describes its evolving role as a “Co-Creation Regulator & Facilitator” reflecting an approach that combines regulation with collaboration, experimentation and facilitation. Its 2027 agenda focuses on four principal areas: Digital ID and verifiable digital credentials, AI governance, digital transformation of SMEs, and stronger oversight of digital platform services. The common thread is a shift from establishing digital trust frameworks to demonstrating how those frameworks work in practice.

Digital ID: from proving identity to proving rights and authority:

Digital ID has become one of the most developed components of Thailand’s digital infrastructure. ETDA reports that 28 Digital ID service licenses have been issued, while 1,797 government e-services were connected to Digital ID as of June 2026. Accumulated user accounts reached approximately 162.63 million. Digital ID is already being used across government services involving matters such as taxation, healthcare entitlements and household registration.

The next stage goes beyond simply establishing that a person is who they claim to be. ETDA is moving toward an ecosystem in which individuals and organizations can digitally prove particular facts, qualifications, rights or authority through Verifiable Credentials (VCs).

Initial use cases include digital academic transcripts and caregiver services, where digital credentials can be used to establish a relationship between a vulnerable person and a caregiver. ETDA has also been exploring interoperability for cross-border transactions. The objective is therefore progressively moving from electronic identification toward reusable and independently verifiable digital credentials.

In 2027, ETDA plans to further develop the VC ecosystem, including assessment mechanisms for service providers and a VC Trusted List. Another important initiative is the proposed pilot of a national identification card in VC format in cooperation with relevant government agencies.

The model could materially change the conventional practice of repeatedly submitting copies of identification documents. Instead of disclosing an entire document, VC technology may allow a person to disclose only the information required for a particular transaction. This could make digital transactions more efficient while supporting data minimization and reducing unnecessary circulation of copies of identity documents.

ETDA also plans to promote a Digital Document Wallet, allowing individuals to access and use digital documents electronically, and to expand Digital ID infrastructure to support additional user groups, including foreign nationals.

Of particular relevance to businesses is the Integrated Document Signing Platform (IDSP). Having undergone sandbox testing, the platform is intended to support verification of corporate authority and execution of documents between organizations. If adopted more broadly, infrastructure of this kind could simplify one of the persistent practical issues in electronic contracting: verifying not merely the identity of the individual signing a document, but whether that individual has authority to bind the relevant legal entity.

The implications extend beyond electronic signatures. Businesses may increasingly need systems capable of receiving and verifying digital credentials for customer onboarding, employee qualifications, corporate authorization, contractual documentation and other transactions. Digital identity is consequently developing from a standalone authentication mechanism into part of the infrastructure underlying digital commerce.

AI governance: moving from principles into the sandbox

AI governance is another area where ETDA intends to move from frameworks toward practical implementation.

ETDA has developed draft AI legislation together with more than 12 guidelines, toolkits and related governance materials. AI governance initiatives have been implemented across four major sectors—education, the justice system, government and financial services—covering more than 140 organizations. ETDA has also provided AI governance training across government and reports reaching more than 120,000 users through its AI-related knowledge initiatives.

The next stage centers on the AI Governance Practice Center (AIGPC) and the AI Governance Sandbox.

The AIGPC is expected to operate as a central platform bringing together government agencies, AI developers, businesses and experts. Rather than treating AI governance primarily as a collection of abstract principles, the sandbox approach allows governance requirements to be tested against actual AI systems and use cases.

ETDA has identified several areas requiring particular attention because of their potential risk, including education, children and vulnerable groups, and the justice system. Sandbox testing is expected to examine issues such as risk management, privacy, transparency and compliance with applicable laws. The results may subsequently inform sector-specific guidelines and proposals for regulatory measures. ETDA also intends to develop testing criteria for multilingual AI safety. (ETDA⁠)

This direction is significant for organizations developing or deploying AI. The central compliance question is increasingly likely to move from whether an organization has adopted general AI principles to whether it can demonstrate that those principles are implemented in practice.

Organizations using AI should therefore consider governance mechanisms that document matters such as the purpose and scope of an AI system, risk classification, data governance, privacy implications, human oversight, transparency, testing and monitoring, accountability and procedures for responding when the system produces inappropriate or harmful outcomes.

For higher-risk AI applications, governance documentation may become particularly important. The sandbox model also indicates that regulatory expectations may evolve through testing and practical experience rather than solely through prescriptive legislation.

SMEs Growth: from adopting technology to demonstrating growth

ETDA’s third priority approaches digital trust from an economic development perspective. The objective is to move SMEs from being merely “digitally ready” toward achieving measurable growth through technology.

Thailand’s Digital Maturity Index has indicated that many SMEs remain at the “Digital Follower” level. ETDA’s response has been to develop a model that first assesses the particular digital maturity and operational gaps of a business and then connects that business with appropriate technology, expertise and financing.

The SMEs Growth program has operated across four regions and 16 provinces. ETDA reports participation by 1,697 SMEs and 138 digital providers, with 108 successful business matches. The program generated an estimated THB 689.5 million in combined economic and social impact, of which approximately THB 530.6 million was attributed to SMEs and THB 158.9 million to digital providers.

An important development arising from the program is the SMEs Profile, essentially a development map intended to help businesses understand their current position, identify operational gaps and select appropriate technology and support mechanisms. The approach recognizes that different SMEs face different constraints: one business may require technology, another personnel or skills, while another may require financing or specialist advice.

In 2027, ETDA intends to expand this model, with particular attention to trade and retail, manufacturing, and tourism-related businesses. Importantly, the effectiveness of digital transformation is intended to be assessed by business outcomes, including revenue, costs, productivity, market development and competitiveness.

This represents a meaningful change in the way digital transformation is measured. The relevant question is no longer simply whether an SME has adopted digital technology, but whether the technology produces measurable improvements in the business.

For technology providers, this may similarly change expectations. Solutions that can demonstrate improvements in revenue, cost efficiency, productivity or market access are likely to be more persuasive than technology adoption for its own sake.

Digital platforms: from bringing platforms into the system to regulating conduct

The fourth priority is particularly relevant to digital platform operators.

Thailand’s digital platform services regulatory framework has already brought a substantial number of services within the regulatory system. ETDA reported that 2,133 digital platform services had submitted notifications by August 2026. The next phase is increasingly concerned with what platforms do after entering the system. (ETDA⁠)

ETDA’s 2027 direction can broadly be understood through three regulatory mechanisms.

First, existing requirements applicable to particular categories of platforms are expected to move toward more active implementation. ETDA has specifically identified e-marketplaces and ride-sharing platforms as areas where existing rules must produce practical results.

Second, regulation is increasingly focused on preventing harm at an earlier stage. ETDA’s approach emphasizes platform mechanisms for preventing, detecting and responding to problematic activities rather than relying exclusively on intervention after harm has occurred. Content moderation and measures applicable to social media platforms form part of this broader direction.

Third, ETDA is paying greater attention to transparency and fairness in platform commercial practices. One issue is the structure and disclosure of platform fees and gross profit or “GP” charges. ETDA has acknowledged that responsibility for competition, pricing and related matters may fall within the authority of other regulators. Its approach is therefore based partly on transparency requirements and regulatory coordination rather than attempting to regulate every aspect of platform activity under a single statute. ETDA also plans to develop regulatory guidance for application marketplaces.

This illustrates an important characteristic of the emerging platform regulatory model: co-regulation and regulatory coordination.

Many problems arising on digital platforms involve conduct already regulated elsewhere. Non-compliant products, transportation services, accommodation, competition issues and online fraud may each fall within the responsibility of different authorities. ETDA’s role increasingly involves requiring platforms themselves to establish effective systems for prevention, verification, response and coordination with the competent authority.

The development of the 1212 ETDA Center reinforces this approach. ETDA describes complaint information as a form of system-level “radar”: complaints can be aggregated and analyzed to identify emerging risks and then referred to the responsible authority or used to develop preventive measures.

Platform operators should therefore expect regulatory attention to extend beyond formal notification requirements. Internal processes concerning merchant or service-provider verification, complaint handling, content governance, transparency, risk assessment, cooperation with authorities and remediation may become increasingly important aspects of operational compliance.

A broader transition from rules to implementation:

Taken together, ETDA’s four priorities reveal a broader development in Thailand’s digital regulatory policy.

The earlier stage of digital regulation necessarily concentrated on building infrastructure and establishing rules: Digital ID standards had to be created, AI governance principles developed, SMEs encouraged to adopt technology, and digital platforms brought within an identifiable regulatory framework.

The 2027 agenda ask a different question: do those systems work in practice?

For Digital ID, the question is whether trusted identity infrastructure can support reusable credentials, digital documents and corporate transactions. For AI, it is whether governance principles can be translated into controls capable of being tested against real AI systems. For SMEs, it is whether technology adoption produces measurable economic benefits. For platforms, it is whether regulatory obligations result in safer and fairer digital services.

This also explains ETDA’s characterization of itself as a Co-Creation Regulator & Facilitator. The emerging regulatory model does not rely exclusively on issuing additional rules. It combines standards, trusted lists, sandboxes, guidance, complaint data, cooperation with other regulators and collaboration with the private sector. (ETDA⁠)

For businesses, the practical consequence is that operational readiness will become increasingly important.

Digital service providers should consider whether their architecture can accommodate verifiable credentials and trusted digital documents. Organizations deploying AI should establish governance processes capable of being documented and tested. Technology providers serving SMEs should be able to demonstrate measurable business outcomes. Digital platforms should review not only whether they fall within the regulatory regime but also whether their operational processes satisfy emerging expectations concerning transparency, safety, complaint management and risk mitigation.

The direction of travel is therefore clear: digital trust is moving from policy architecture into day-to-day digital transactions and business operations.

Key Takeaways:

• Digital ID is evolving into broader digital transaction infrastructure. Verifiable Credentials, Digital Document Wallets and corporate authorization mechanisms could change how identity, rights, qualifications and signing authority are established online.
• AI governance is becoming operational. The AIGPC and AI Governance Sandbox are expected to test governance principles against real use cases, particularly in areas presenting higher risks.
• AI users should focus on demonstrable governance. Risk assessments, privacy controls, transparency, human oversight, testing and accountability are increasingly relevant as governance moves from principles to implementation.
• SME digital transformation will be judged increasingly by results. ETDA’s approach emphasizes measurable improvements in revenue, cost, productivity, market access and competitiveness rather than technology adoption alone.
• Digital platform regulation is entering a more operational phase. Platform operators should expect increasing attention to preventive controls, transparency, content and complaint management, risk-based regulation and cooperation with other authorities.
• 2027 will be a year of implementation. Across all four priorities, ETDA’s central objective is to turn digital trust from regulatory and technical frameworks into infrastructure and practices that produce tangible results for individuals and businesses.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

New Electronic Transactions Bill: Major Changes for Digital Contracts, E-Signatures and Trust Services

A major overhaul of the legal framework for electronic transactions is underway. A new Electronic Transactions Bill has been submitted to the Cabinet with the objective of replacing the existing Electronic Transactions Act and modernizing the rules governing electronic documents, electronic signatures and seals, automated contracts, electronic transferable records, electronic stamp duty, and electronic transaction service providers.

The Bill is not yet law. If it completes the legislative process and is published in the Government Gazette, it is intended to take effect 180 days after publication. The existing Electronic Transactions Act and its amendments would then be repealed. The government has also indicated that 26 pieces of subordinate legislation are being prepared—two Royal Decrees, three Ministerial Regulations, and 21 notifications—to support implementation of the new regime.

Electronic transactions as the principal mode, without eliminating paper:

The Bill reflects a broader policy shift toward making electronic transactions a principal means of conducting transactions rather than treating electronic methods merely as alternatives to paper. This does not mean that paper transactions will become invalid or prohibited. Instead, the proposed framework strengthens the principle of functional equivalence between electronic and paper-based processes.

Electronic information and electronic printouts may therefore satisfy requirements traditionally associated with documents or evidence, subject to the applicable reliability requirements. An important practical consequence is that disputes concerning electronic evidence are likely to focus increasingly on the reliability of the process and system used to create, transmit, authenticate, and preserve the information, rather than simply on whether the information exists in electronic form.

Electronic signatures and electronic seals:

The Bill strengthens the framework for electronic signatures and expressly addresses electronic seals. Where a reliable electronic method is used, or a method specified by the Electronic Transactions Development Agency (ETDA) is followed, an electronic signature or seal may satisfy the corresponding legal requirement for a physical signature or seal.

The express recognition of electronic seals is particularly relevant to juristic persons and organizations that need to authenticate the origin and integrity of documents without requiring an individual to sign every document personally. In practice, businesses should review not only the technology used for electronic signing, but also authorization procedures, identity verification, audit trails, document integrity, and record retention.

Contracts formed by automated systems:

The Bill expressly addresses contracts formed through automated systems, an increasingly important issue for digital commerce.

A contract would not be denied legal effect merely because an automated system performed the relevant transaction without an individual reviewing or intervening in each step. The proposed framework recognizes legal effect where the system operates in a manner that the parties could reasonably expect from its normal operation. It also provides greater clarity concerning the sending, receipt, and acknowledgment of electronic information.

This provision has potentially broad application. It is relevant not only to conventional e-commerce platforms but also to automated procurement, payment systems, algorithmic transaction processing, and other business systems capable of initiating or completing transactions without contemporaneous human intervention.

For businesses, the important issue will therefore increasingly be who bears the legal consequences of the operation of an automated system, and whether the system’s operation falls within what the parties could reasonably have anticipated. Contract terms dealing with system errors, unauthorized transactions, allocation of risk, authentication, and system-generated records may consequently become more important.

Electronic transferable records:

Another major development is the introduction of a framework for electronic transferable records, including bills of exchange, promissory notes, and checks in electronic form.

The proposed regime allows such instruments to have legal effect equivalent to their paper counterparts, while translating concepts traditionally dependent on physical possession—such as possession, delivery, and endorsement—into an electronic environment. The framework therefore addresses control of an electronic record, identification of the person exercising control, transfer, endorsement, and alteration of information through reliable electronic methods.

This is potentially significant for banks, financial institutions, exporters and importers, logistics operators, and businesses involved in trade finance. The legal recognition of electronic transferable records could facilitate end-to-end digitalization of commercial and trade documentation that has historically remained dependent on original paper instruments.

Electronic stamp duty:

The Bill also expressly recognizes electronic stamp duty, with electronic stamping to be carried out in accordance with the criteria and procedures prescribed by the Revenue Department.

This is an important practical component of electronic contracting. Moving a contract to an electronic format does not by itself eliminate tax or stamp duty requirements. Businesses designing digital contracting workflows should therefore integrate execution, authentication, stamping, and record retention rather than treating these as separate processes.

Seven categories of electronic transaction service providers:

One of the most substantial regulatory changes is the introduction of a broader framework governing electronic transaction service providers. The Bill identifies seven categories:

1. identity proofing or authentication services;
2. electronic signature services;
3. electronic date and time-stamping services;
4. electronic information receipt, transmission, or storage services;
5. website or domain name registration or certification services;
6. electronic transferable record system services; and
7. other services prescribed by Ministerial Regulation.

The significance of this framework extends beyond classification. The Bill moves toward a risk-based regulatory approach, under which the duties and responsibilities imposed on service providers can reflect the risks associated with their services. Providers are expected to use reliable methods when creating, sending, receiving, storing, or processing electronic information and to maintain information capable of serving as evidence of transactions. Failure to comply with statutory duties may also result in liability for resulting damage.

The proposed framework therefore represents a broader conception of digital trust infrastructure. Electronic signatures, identity verification, timestamps, transmission and storage services, domain-related services, and electronic transferable record systems are treated as components of an ecosystem supporting reliable electronic transactions.

From licensing toward risk-based certification:

The Bill also changes the regulatory architecture applicable to service providers. Rather than relying exclusively on the existing licensing model, the proposed regime introduces certification mechanisms administered or recognized by ETDA, while allowing the level of regulatory intervention to correspond to the risks associated with particular services. The government’s description of the Bill indicates that certification may be obtained through ETDA or through certification bodies recognized under the statutory framework.

This distinction will be important once the subordinate legislation is available. Businesses currently providing—or procuring—electronic signature, identity, timestamp, electronic storage, or similar services should determine whether their activities fall within one of the seven categories and what certification or technical standards may ultimately apply.

Transitional arrangements:

The Bill contains transitional provisions intended to prevent disruption to existing regulated services.

In particular, providers of digital identity proofing and authentication services already licensed under the existing legal regime are intended to be treated as certified providers under the new legislation. This should facilitate continuity when the new regulatory framework replaces the existing regime.

Importantly, the existing Royal Decree governing digital platform services subject to notification requirements will continue to apply notwithstanding the replacement of the existing Electronic Transactions Act. It will remain in force until separate legislation governing digital platform service businesses becomes effective.

Digital platform operators should therefore not interpret the new Bill as terminating their existing obligations under the current digital platform regime.

Implementation will depend heavily on subordinate legislation:

Although the Bill establishes the overall statutory architecture, much of its practical effect will depend on subordinate legislation. The government has indicated that approximately 26 subordinate instruments are being prepared, comprising two Royal Decrees, three Ministerial Regulations, and 21 notifications.

This will be particularly important for determining what constitutes a reliable electronic method, the standards applicable to particular service providers, certification requirements, technical requirements for electronic transferable records, and the operation of the risk-based regulatory framework.

Accordingly, businesses should not wait only for enactment of the primary legislation. Organizations that rely heavily on digital transactions may wish to begin mapping their current electronic processes—including contracting, electronic signatures and seals, identity verification, automated systems, time-stamping, document transmission and storage, electronic evidence, and stamp duty—against the structure contemplated by the Bill.

Key takeaways:

• The Bill represents a fundamental modernization of the electronic transactions framework rather than a limited amendment to the existing legislation. Most notably, it moves beyond the basic legal recognition of electronic documents and signatures toward a broader infrastructure for digital trust and end-to-end electronic transactions.
• The proposed recognition of automated contracts and electronic transferable records could remove significant legal uncertainty from transactions that previously depended on human intervention or original paper instruments. At the same time, the seven-category framework for electronic transaction service providers introduces a substantially broader regulatory architecture based on the risk associated with the relevant service.
• The Bill is not yet in force. The existing Electronic Transactions Act and applicable subordinate legislation therefore continue to govern electronic transactions. If the Bill completes the legislative process in its present form, it is intended to become effective 180 days after publication in the Government Gazette.
• Businesses should monitor both the progress of the Bill and, importantly, the 26 subordinate instruments being prepared. For many businesses and technology providers, those instruments may ultimately be as important as the Act itself in determining the technical, certification, and compliance requirements applicable to electronic transactions.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

ETDA’s TTR Guidance: A New Framework for E-Marketplace Fee Transparency

The Electronic Transactions Development Agency (ETDA) has issued new guidance introducing the concept of the Total Take Rate (TTR) for e-marketplaces. The guidance is intended to give merchants a clearer and more comparable picture of the total fees and expenses associated with selling through an e-marketplace, particularly before they decide whether to participate in a campaign, promotional program, or additional service.

The initiative responds to an increasingly complex fee structure in the e-commerce ecosystem. A merchant’s cost of selling through an e-marketplace may extend well beyond the headline commission rate and include payment processing fees, infrastructure or system fees, campaign participation costs, merchant-funded discounts, advertising fees, affiliate fees, and charges for additional services. Because these charges may use different names, rates, and calculation bases, merchants may find it difficult to determine the actual economic cost of a transaction. The TTR framework is designed to address this information gap by presenting the aggregate financial impact in a standardized and understandable form. (ETDA⁠)

What is the Total Take Rate?

Under the guidance, TTR generally represents the total fees and expenses borne by a merchant in connection with the sale of a product, expressed as a percentage of the net product price. The net product price is essentially the initial selling price after deducting discounts for which the merchant is responsible. TTR should be presented both as a percentage and as an actual monetary amount so that merchants can see how platform charges affect the proceeds they expect to receive. (ETDA⁠)

The guidance divides TTR into three components:

Baseline TTR represents the aggregate fees ordinarily necessary for an order to take place and be completed. These may include commissions, payment processing fees, and infrastructure fees, without including costs attributable to campaigns or additional services.

Scenario TTR takes the Baseline TTR and adds the costs associated with a particular campaign or additional service that the merchant is considering. Depending on the arrangement, these may include additional discounts, campaign participation charges, advertising fees, affiliate fees, or fees for special programs.

Incremental TTR represents the difference between the Scenario TTR and Baseline TTR. It therefore gives the merchant a relatively straightforward indication of the additional economic burden associated with participating in the proposed campaign or additional service. (ETDA⁠)

This distinction is important because a platform’s headline commission rate may provide only a partial picture of the actual cost of a sale. By comparing the Baseline and Scenario TTR, a merchant can assess the financial position both with and without participation in a particular campaign.

Disclosure before the merchant commits:

A central feature of the guidance is the timing of disclosure. Relevant TTR information should be made available at the point at which the merchant is making the commercial decision, particularly before confirming participation in a campaign or additional service.

The platform should provide information that allows the merchant to understand the Baseline TTR, the Scenario TTR, the resulting Incremental TTR, and the estimated net proceeds. The objective is to enable the merchant to assess the economic consequences before committing, rather than discovering the full cost only after the transaction has taken place.

The guidance therefore encourages platforms to place TTR information at relevant decision points, such as product pricing pages, fee information pages, seller dashboards, and, importantly, the screen presented before a merchant confirms participation in a campaign or additional service. Information should be presented clearly and accessibly rather than being obscured in detailed terms and conditions or links that are difficult to locate. (ETDA⁠)

TTR calculation tools:

The guidance also encourages e-marketplaces to provide merchants with a TTR calculation tool that is easy to use and available without an additional charge.

Such a tool could allow a merchant to select a particular product or SKU and enter relevant variables, including the selling price, merchant-funded discounts, campaign participation, and applicable fees. The resulting calculation should enable the merchant to compare the cost of selling under the ordinary arrangement with the cost that would apply if the merchant participates in the proposed campaign or additional service.

The output should show relevant fees in both monetary and percentage terms and provide an estimate of the merchant’s net proceeds. Where sufficient information is available, the tool may also show gross profit and the break-even selling price. The guidance additionally contemplates merchants being able to save or download calculation results for subsequent verification. (ETDA⁠)

This aspect of the guidance may have practical implications beyond simply adding another disclosure to a platform’s terms of service. E-marketplace operators may need to consider whether their merchant interfaces, campaign enrollment processes, fee databases, and internal calculation systems are capable of generating sufficiently accurate TTR information at the point when a merchant makes its decision.

Changes to fees affecting TTR:

The guidance also addresses subsequent changes to the fee structure. Where a platform changes a fee rate, calculation base, collection method, or other condition affecting TTR, it should generally notify merchants at least 30 days in advance.

The information should allow merchants to compare the position before and after the change and understand how the change affects the Baseline TTR and Scenario TTR. This gives merchants an opportunity to assess the commercial consequences and adjust their pricing or participation strategy before the new fee structure applies. (ETDA⁠)

This approach reflects a broader transparency objective: merchants should not merely know that a particular fee has changed, but should also be able to understand how that change affects the overall cost of using the platform.

Transparency after the transaction:

The TTR framework does not end once the merchant has agreed to participate in a campaign. The guidance also encourages transparency after a transaction has been completed.

Merchants should be able to review the fees actually deducted and compare them against the TTR previously estimated. Where the amounts differ, the platform should provide sufficient information to explain the discrepancy. Possible reasons could include the actual use of coupons, product returns, refunds, or changes in the merchant’s status.

ETDA also recommends that calculation histories and actual fee information remain accessible through the platform for at least three months and that merchants be able to save or download relevant information. Annual summaries are also contemplated to assist merchants in evaluating the overall cost of selling through the platform. (ETDA⁠)

A transparency framework, not a fee cap:

An important point is what the TTR guidance does not do. It does not prescribe a maximum commission or impose a ceiling on the amount that an e-marketplace may charge. ETDA describes its purpose as improving the completeness, transparency, comparability, and verifiability of fee information so that merchants can make informed commercial decisions. (ETDA⁠)

The legal status of the instrument should therefore be understood accordingly. ETDA places the TTR guidance within its category of “Best-practice/Self-Regulation” measures rather than mandatory platform rules. (ETDA⁠) The guidance should therefore not be characterized as immediately imposing a statutory obligation on every e-marketplace to implement the TTR model exactly as described.

Nevertheless, the distinction between guidance and mandatory regulation should not obscure its practical importance. The TTR framework provides a detailed regulatory benchmark for how ETDA considers platform fee transparency should operate. E-marketplace operators should therefore consider the guidance when reviewing their fee structures, merchant-facing disclosures, campaign enrollment processes, and supporting IT systems.

Why TTR matters for merchants:

For merchants, the principal benefit of the TTR model is that it changes the focus from individual fee rates to the aggregate economic effect of selling through the platform.

Consider a product with an initial price of THB 1,000 where the merchant bears a THB 100 discount, producing a net product price of THB 900. ETDA illustrates how a Baseline TTR of 12.96% would correspond to approximately THB 116.63 in baseline charges and estimated net proceeds of THB 783.37. If participation in a campaign creates another THB 108 of costs, the Scenario TTR would rise to 24.96%, with the Incremental TTR showing an additional 12 percentage points and estimated net proceeds falling to THB 675.37. (ETDA⁠)

The example illustrates the commercial rationale behind the framework. A merchant considering a campaign should be able to assess not simply whether the campaign may increase sales, but also how much additional revenue or volume would be required to offset the additional platform costs.

Practical implications for e-marketplace operators:

For platform operators, implementation of the TTR framework is potentially a product, compliance, and systems issue rather than merely a matter of revising contractual terms.

Platforms may need to map the different charges imposed on merchants, identify the relevant calculation bases, distinguish baseline costs from campaign-specific or additional costs, and ensure that their systems can calculate and present the resulting TTR accurately. Merchant dashboards and campaign enrollment interfaces may also need to be designed so that relevant information is available before the merchant confirms participation.

Operators should also consider whether their post-transaction records allow merchants to reconcile estimated and actual charges and whether changes to fees can be communicated in a manner that explains their overall TTR impact rather than merely announcing a revised percentage for an individual fee.

For merchants, meanwhile, TTR could become a useful metric for comparing the economic effect of different campaigns and services. In particular, the Incremental TTR provides a relatively direct way of assessing the additional cost of a campaign against its expected contribution to sales.

Key takeaways:

• ETDA has introduced TTR as a framework for improving transparency over the aggregate fees and expenses borne by merchants selling through e-marketplaces.
• TTR is divided into Baseline TTR, Scenario TTR, and Incremental TTR, allowing merchants to distinguish ordinary transaction costs from the additional costs associated with campaigns or additional services.
• The guidance emphasizes disclosure before a merchant commits to a campaign or additional service, rather than relying solely on general fee schedules or contractual terms.
• E-marketplaces are encouraged to provide accessible TTR calculation tools showing fees, estimated net proceeds, and other relevant financial information in both monetary and percentage terms.
• Changes affecting TTR should generally be notified to merchants at least 30 days in advance, together with information enabling them to understand the impact of the change.
• Merchants should be able to compare estimated TTR with fees actually deducted after transactions and access historical fee information.
• The TTR framework does not impose a cap on platform fees. It is currently presented by ETDA as a best-practice/self-regulatory measure aimed at transparency and informed decision-making rather than direct price regulation.
• Although not framed as an immediately mandatory fee-control regime, the guidance provides e-marketplace operators with a detailed regulatory benchmark against which their fee disclosure practices and merchant-facing systems can be reviewed.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework

Telemedicine Practices and Data Protection Compliance in Thailand: Legal Brief

I. Introduction to Telemedicine in Thailand:

Telemedicine has emerged as one of the most transformative innovations in healthcare. By leveraging modern communication technologies, telemedicine enables the delivery of medical services regardless of geographic barriers. As the global demand for accessible, efficient, and cost-effective healthcare increases, many countries have embraced telemedicine to overcome traditional challenges such as distance, cost, and limited access to medical expertise.

Thailand, with its rapidly developing digital infrastructure and progressive approach to healthcare, is becoming a prominent destination for telemedicine providers. However, alongside its tremendous growth potential, Thailand presents unique challenges, particularly in the realm of data protection and privacy. For both local and international telemedicine platforms, understanding and complying with the local legal environment is critical. The country’s evolving legal landscape, especially concerning data protection, patient privacy, and healthcare standards, requires providers to implement robust compliance measures. Doing so not only safeguards sensitive patient information but also builds trust with users, ensuring sustainable business growth in a competitive market.

In this guide, we delve into the key considerations for data compliance, discuss the relevant regulatory frameworks under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”), and outline practical steps for telemedicine platforms to navigate these regulations. By doing so, telemedicine providers can effectively mitigate risks, secure patient data, and maintain a competitive edge in the Thai market.

---

II. Health Information Protection Before the Enforcement of the Personal Data Protection Law:

1. The National Health Act and Ministerial Regulation:

Thailand’s regulatory framework for data protection has undergone significant evolution over recent years. Prior to the enactment of the PDPA in 2019, Thailand relied on a combination of the Thai Constitution, the Thai Civil and Commercial Code, and sector-specific regulations like the National Health Act B.E. 2550 (2007) (“National Health Act”). The National Health Act mandated that personal health information be kept confidential. Specifically, Section 7 of the National Health Act required that such information not be disclosed in a manner that could harm the data subject, except when authorized by the individual or required by law.

The Ministerial Regulation on the Protection and Management of Personal Health Information B.E. 2561 (2018) (“MR”) provided further details on the scope and nature of personal health information. Clause 4 of the MR defined personal health information as encompassing a variety of documents, case files, reports, and other materials capable of identifying an individual’s health status. Clause 11 offered an exhaustive list of items considered personal health information, such as:

1. Health History: Such as height, weight, blood type, and body shape.
   1. Medical Records: Such as nursing records, laboratory examinations, and x-ray films.
   1. Related Documents: Any documents or objects that relate to the above data.
   1. Photographic Evidence: Images of medical personnel or actions during treatment.
   1. Additional Information: Any further information as specified by the Personal Health Data Protection and Management Committee.
2. Penalties for Non-Compliance:

Before the PDPA’s enactment, violations regarding the unlawful or unauthorized disclosure of personal health information were met with penalties prescribed under the NHA. Under Section 49 of the National Health Act, such violations could result in imprisonment of up to six months, fines of up to 10,000 THB, or both. Moreover, wrongful use of personal data was addressed under Section 420 of the Civil and Commercial Code, which provided for civil liability in cases where data misuse resulted in harm to the data subject.

• Transition to the PDPA:

In 2019, the PDPA was published in the Royal Gazette, marking a significant shift in Thailand’s data protection landscape. With its comprehensive framework, the PDPA rendered the earlier MR obsolete. The Medical Council of Thailand subsequently issued a new Ministerial Regulation on the Revocation of the MR B.E. 2565 (2022). This evolution represents Thailand’s commitment to aligning its data protection standards with international best practices.

---

III. What Is Health Information?

As a result of the MR revocation, Thailand no longer has a statutory definition of health information, which is crucial in terms of personal data protection and compliance with obligations under the PDPA. Telemedicine platforms need to understand the personal data in their possession and handle such data according to the PDPA.

In the absence of subordinate regulations, directives, or guidelines to clarify the extent and scope of health information under the PDPA, it is worth exploring the definition given under the European Union General Data Protection Regulations (2016/679) (“EU GDPR”), which was a core foundation of the Thai PDPA, containing many similar provisions tailored to Thailand’s contexts.

Article 4 (15) of the EU GDPR defines ‘data concerning health’ as personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status. Additionally, the European Parliament and the Council of the European Union opined that ‘personal data concerning health’ should include all data pertaining to the health status of a data subject, including information collected during registration or provision of health care services, testing results, disease history, clinical treatments, or physiological states.

By this principle, personal data that may not obviously qualify as health information could still be considered health information depending on the context of personal data processing activities.

---

IV. Overview of PDPA Compliance for Telemedicine Platforms:

The PDPA extends its reach not only to local businesses but also to international data controllers who process the personal data of Thai residents. This extraterritorial effect means that even telemedicine platforms headquartered outside Thailand must comply with the PDPA if they process the personal data of individuals located in the country.

1. Extraterritorial Applicability:

According to Section 5, Paragraph 2 of the PDPA, foreign data controllers are subject to the PDPA if any of the following criteria are met:

1. The offering of goods or services to the data subjects who are in the Kingdom of Thailand, irrespective of whether the payment is made by the data subject, or
   1. The monitoring of the data subject’s behavior, where the behavior takes place in the Kingdom of Thailand.

• Obligations for Telemedicine Providers:

Once the PDPA applies, telemedicine providers (whether local or international) must adhere to various obligations under the PDPA, some of which include:

1. Data Collection and Processing: Ensure that personal data is collected, used, and disclosed with legal bases supporting each processing activity.
   1. Privacy Notices: Clearly communicate to data subjects how their personal data will be used.
   1. Security Measures: Implement appropriate technical and organizational measures to safeguard personal data.
   1. Data Subject Rights: Provide mechanisms for data subjects to exercise their rights (e.g., access, correction, deletion).
   1. Breach Notification: Establish procedures to notify both the regulatory authority and affected data subjects in the event of a data breach.
   1. Record-Keeping: Maintain a Record of Processing Activities (ROPA) to document data processing practices.

V. Privacy Notice / Privacy Policy Under the PDPA:

One of the foundational requirements under the PDPA is the preparation and dissemination of a comprehensive privacy notice or privacy policy. This document serves to inform data subjects about how their personal data is collected, processed, stored, and shared.

1. Content of Privacy Policy:

Under Section 23 of the PDPA, data controllers must notify data subjects of the purposes of data collection prior to or at the time of collection. Common practices include written notices, electronic pop-ups on websites or applications, or verbal communications as applicable.

• Best Practices for Drafting a Privacy Policy:

For telemedicine platforms, drafting a privacy policy involves a deep understanding of the personal data flows within the organization. Understanding the customer journey is vital for telemedicine platforms in preparing the privacy policy, as each touchpoint involves the collection and processing of personal data.

1. Sign-Up / Registration:

During the initial sign-up process, users are generally required to provide basic personal data such as their name, age, contact details, and, in some cases, initial health information, such as their height, weight, medical history, passport or national identification card, contact information, and information relating to personal allergies. This stage sets the foundation for subsequent interactions and must be handled with the highest level of security and clarity regarding data usage.

• Know Your Customer (KYC) and Confirming the Identity of the Data Subject: To ensure compliance with Thailand’s PDPA and safeguard sensitive personal data, telemedicine platforms must implement robust KYC procedures during the sign-up phase. These procedures are designed to verify the identity of the data subject and establish trust between the platform and its users.

• Verification of Identity: Platforms should require users to provide a valid
  • identification documents, such as a national ID card, passport, or other government-issued IDs, to confirm their identity.
  • The verification process may involve uploading scanned copies of these documents or using digital identity verification tools that comply with Thai legal standards.
• Biometric Verification (Optional):

For enhanced security, telemedicine platforms may opt to incorporate biometric verification methods, such as facial recognition or fingerprint scanning, where applicable and permitted by law.

• Data Matching:

Once the user submits their identification details, the platform should cross-check this information against official databases (e.g., government records) to ensure accuracy and prevent fraud.

• Explicit Consent:

During the registration process, explicit consent must be obtained from the user for the collection, use, and disclosure of both general personal data and sensitive personal data. This includes clear explanations of how their data will be processed, stored, and shared.

If the user is under 20 years of age, additional consent from their legal representative, guardian, or curator may be required under Section 20 of the PDPA.

• Booking / Appointment Scheduling:

Once registered, users schedule appointments with healthcare providers. The booking process may involve selecting a healthcare professional based on specialty, availability, or patient reviews. Additional forms might be used to capture medical history or current health conditions.

• Consultation:

Consultations are the core of telemedicine services. Whether conducted via video calls, chat sessions, or telephone, these interactions involve real-time exchange of sensitive health information. Data from these sessions may include verbal communications, visual data, and records of diagnosis and treatment.

1. Post-Consultation Services:

After the consultation, several processes may occur:

• Payments: Patients make payments through integrated or third-party payment gateways. This process generally involves third-party service providers.

• Insurance Claims: In some cases, patients may file insurance claims. Telemedicine platforms might assist in this process by forwarding relevant health information to insurers.
• Medicine Delivery: If medication is prescribed, delivery logistics come into play. This may involve sharing personal data (such as address and contact information) with third-party courier services.
• Follow-up Appointments: Follow-up consultations or treatment plans may be scheduled, requiring further data collection.
• Feedback and Reviews: Post-consultation feedback is often solicited to improve service quality. While this may involve general data, any health-related feedback is treated with heightened sensitivity

n)

---

VI. Legal Bases for Each Activity:

Different stages of the customer journey require distinct legal bases under the PDPA. For example:

Activity	General Personal Data	Sensitive Personal Data
Sign-up / Registration	Necessary to enter into / Performance of a contract (Section 24 (3))	Explicit Consent (Section 26)
Booking / Appointment	Necessary to enter into / Performance of a contract (Section 24 (3))	Explicit Consent (Section 26)
Consultation	Necessary to enter into / Performance of a contract (Section 24 (3))	Necessary for compliance with a law with respect to the provision of health or social care / Explicit Consent (Section 26 (5)(a) / Section 26)
Payment and Billing	Necessary to enter into / Performance of a contract (Section 24 (3))	Explicit Consent (Section 26)
Insurance Claims	Legitimate interest (Section 24 (5))	Explicit Consent (Section 26)
Medicine Delivery	Necessary to enter into / Performance of a contract (Section 24 (3))	Explicit Consent (Section 26)
Feedback / Reviews	Legitimate interest (Section 24 (5))	Explicit Consent (Section 26)

Important Remark: Please note that the table above shall only be used as a reference. The actual legal basis for each activity may differ based on the specific facts and circumstances.

---

VII. Processing Personal Data of Minors, Quasi-Incompetent Persons, or Incompetent Persons:

Where a patient is under 20 years of age or is a quasi-incompetent person or incompetent person, Section 20 of the PDPA requires their consent to be accompanied by consent from their respective legal representatives, guardians, or curators. However, if the patient is under 10 years of age, sole consent from the legal representative is sufficient.

Section 24 of the Thai Civil and Commercial Code provides an exemption for acts deemed suitable for a minor’s reasonable needs. Therefore, a minor (between 10 and 20 years of age) may give sole consent for telemedicine consultation purposes, as it deems suitable and actually required for their reasonable needs.

---

VIII. Data Subject Rights and Request Compliance Under the PDPA:

The PDPA enshrines several rights for data subjects. Telemedicine platforms must have robust processes to facilitate these rights.

A. Overview of Data Subject Rights:

The PDPA grants data subjects the following rights:

1. Right to Access: Data subjects may request copies of their personal data.
2. Right to Data Portability: Individuals can obtain their personal data in a structured, commonly used format.
3. Right to Object: Data subjects may object to certain personal data processing activities.
4. Right to Delete: Also known as the “right to be forgotten,” this allows data subjects to request deletion or anonymization of their personal data.
5. Right to Restrict Processing: In certain circumstances, processing may be limited or suspended.
6. Right to Rectification: Data subjects can have inaccurate or incomplete personal data corrected.
7. Right to Lodge a Complaint: Data subjects can lodge complaints with regulatory authorities.
8. Right to Withdraw Consent: Where processing is based on consent, data subjects may withdraw that consent at any time.

B. Procedures for Data Subject Rights Requests (DSRR):

Upon receiving a data subject request, telemedicine platforms should follow a set of protocols:

1. Verification: Confirm the identity of the data subject or their representative.

• Clarification: Request additional information if the request is ambiguous.

• Documentation: Record all details of the request.

• Data Retrieval: Locate and compile the relevant data.

• Review for Exemptions: Determine if any exemptions apply.

• Response: Communicate a clear response—either fulfilling the request, rejecting it, or outlining why an exception applies.

• Record-Keeping: Maintain records of the requests and responses for regulatory audits.

---

IX. Record of Processing Activities (ROPA):

Maintaining a detailed ROPA is a regulatory requirement under Section 39 of the PDPA.

A comprehensive ROPA should include,

1. the collected personal data;
   1. the purpose of the collection of personal data in each category;
   1. details of the data controller;
   1. the retention period of personal data;
   1. rights and methods for accessing personal data, including conditions for exercising these rights;
   1. the use or disclosure of personal data;
   1. rejection or objection to the data subject’s rights request; and
   1. explanation of the appropriate security measures.

However, SMEs may be exempt from maintaining a full ROPA if they employ fewer than 100 people and have an annual revenue of no more than 300,000,000 THB. Nevertheless, telemedicine platforms handling sensitive personal data must maintain a full ROPA due to the risks involved.

---

X. Appropriate Security Measures for Telemedicine Platforms:

Prescribed under Section 37 (1) of the PDPA, where a data controller is required to provide appropriate security measures to prevent unauthorized or unlawful loss, access to, use, alteration, correction, or disclosure of personal data. In this regard, the appropriate security measures for the telemedicine platforms shall focus on the maintenance of personal data’s confidentiality, integrity, and availability.

According to the PDPC’s Announcement on Security Measures for Personal Data,  the security measures should contain at least the following mechanism: (1) access controls, allowing access to personal data only on a need-to-know basis provided that there shall also be an identity proofing, authentication, and authorization procedure; (2) user access management including registration and de-registration of access provision; (3) user responsibilities shall be prescribed; (4) implement an audit trail to enable the reviewing of access, change, alteration, or deletion of personal data.

The duty to implement appropriate security measures shall be extended to the imposition of obligations on the data processor of the telemedicine platforms (such as medicine delivery service providers), to prevent unauthorized or unlawful loss, access to, use, alteration, correction, or disclosure of personal data.

---

XI. Personal Data Breach and Breach Notification Procedures:

Despite security measures, data breaches can occur. The PDPA requires prompt action in response to breaches.

A. Definition:

A personal data breach is defined as a breach of security measures resulting in the loss, access, use, alteration, modification, or disclosure of personal data without authorization or unlawfully.

B. Procedures:

Assess the reliability of the breach report and investigate the facts.

Notify the PDPC within 72 hours if the breach affects the rights and freedoms of data subjects.

Notify affected data subjects without delay if the breach poses a high risk.

Mitigate the situation and review security measures to prevent future breaches.

---

XII. Processing of Sensitive Personal Data by Data Processors:

Throughout the customer journey, a data processor may be involved in processes such as medicine delivery. A data controller must prepare a Data Processing Agreement (DPA) to control the activities of the data processor. Key provisions of a DPA include:

Restriction on use or disclosure of personal data.

Implementation of appropriate security measures.

Recording of personal data processing activities.

Notification of personal data breaches.

---

XIII. Designating a Representative and a Data Protection Officer (DPO) in Thailand:

A. Designating a Representative for Foreign Providers:

Foreign telemedicine providers offering services to Thai residents must designate a representative in Thailand under Section 5, Paragraph 2 of the PDPA.

B. Appointment of a Data Protection Officer (DPO):

Telemedicine platforms are obligated to designate a DPO if their core activities involve processing sensitive personal data. External or outsourced DPOs may be appointed for SMEs.

---

XIV. Use of Sensitive Personal Data (Health Information) for Telemarketing Purposes:

Sensitive personal data cannot be used for marketing purposes without explicit consent. Instead, telemedicine platforms may rely on general personal data (e.g., email addresses) for mass communications, provided an opt-out mechanism is available.

---

XV. Frequently Asked Questions (FAQs)

Q1: Does Weight and Height Qualify as Health Information?

Weight and height information may qualify as either general personal data or sensitive personal data, depending on the context. For example, in telemedicine services, weight and height may play a vital role in medical analysis and thus could be considered sensitive personal data.

Q2: Can a Patient Request Deletion of Their Health Information?

Patients have the right to request deletion of their personal data under certain conditions. However, telemedicine platforms are required to retain medical records for at least 5 years in accordance with the National Health Act.

---

XVI. Conclusion

As telemedicine continues to revolutionize the healthcare industry, ensuring robust compliance with data protection laws like the PDPA is critical. Health information, being sensitive personal data, demands the highest level of security and compliance to protect patient privacy and maintain trust in digital healthcare services.

For telemedicine platforms operating in Thailand, navigating the interplay between local regulations and international frameworks necessitates a meticulous approach to data processing. Failure to comply can lead to reputational damage, regulatory penalties, and legal liabilities. By adopting best practices such as transparent privacy policies, strong security measures, and compliance with data subject rights, telemedicine providers can create a safe and legally compliant environment.

In conclusion, the landscape of health information regulation is complex and continuously evolving. Telemedicine platform providers must proactively update their policies and compliance strategies to align with changing regulations, ensuring that patient rights remain protected while fostering innovation in digital healthcare solutions. By doing so, they can contribute to a more secure, efficient, and globally compliant telemedicine ecosystem.

Author: Panisa Suwanmatajarn, Managing Partner.

Other Articles

• DIP: WIPO GRATK Study Puts Genetic Resource Records in Focus
• FDA: Building a Telepharmacy Platform—What Developers Need to Address
• DIP: New Facility Checks the Status of Corporate Trademark Owners
• Thailand’s Revenue Department Launches Public Consultation on Draft Departure Tax Act: Key Proposed Principles and Implications
• PDPA: Research Consent, Lawful Bases and the Use of Personal Data in Research
• Thailand–Canada Free Trade Agreement (TCAFTA): Cabinet Approves Negotiating Framework