Circular No. 2019/12 provides that data of public institutions and organisations should not be stored in cloud storage services except for the institutions’ own private systems or local service providers controlled by the institutions.

It is reported that Türkiye frequently issues regulations that exempt urgent projects and procurements from requirements of the Turkish Public Tender Law, allowing entities to conduct tenders or negotiations on an invitational basis. While these exempted tenders technically are open to foreign as well as domestic firms, it is reported that, in practice, few of these have been awarded to foreign firms unless they were offering goods or services that were urgently needed and not available in Türkiye.

According to Art. 63 of the Public Procurement Law, it is possible for contracting authorities to insert provisions to the tender documents indicating that the tender is exclusively open to domestic tenderers.

The Consumer Protection Act 1979 and the Direct Sales and Direct Marketing Act 2002 provide a comprehensive framework for consumer protection that also applies to online transactions.

Thailand has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Thailand has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Thailand has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

According to Clause 5 of the Ministry of Commerce's Notification (No. 11) 2010, a website that includes the transaction of goods and services must register the 'E-Commercial Registration' under the Commercial Registration Act 1956 (amended by the Commercial Registration Act (No. 2) in 2006). Therefore, the electronic businesses operating in the internet system, service providers, web hosting, e-marketplace, or platform (for example, Lazada, Shopee, etc.) are required to register with the Department of Business Development (DBD). In addition, the DBD registration is valid for five years. Also, ordinary persons and juristic persons engaged in e-commerce businesses without commercial registration are considered to be in violation and shall be subject to a fine penalty as stipulated. Furthermore, foreign companies are required to submit additional documents for registration, including a copy of the company registration, an appointment of operation in Thailand, work permits, and a foreign business license or document certificate (if any).

The Direct Sales and Direct Marketing Act requires businesses that engage in direct sales/marketing to register with the Office of the Consumer Protection Board (OCPB). The definition of "direct marketing" has been amended to include e-commerce transactions. Business operators who fail to register as required will be punishable by a fine, imprisonment, or both.
In accordance with the provisions of the Act, the criteria for registering in the field of direct selling involve the following conditions: (i) the business entity must be structured as a partnership with a minimum registered capital of 500,000 Thai Baht (approx. USD 16,000), or alternatively, it can be a limited company or a public limited company with a minimum registered and paid-up capital of 1,000,000 Thai Baht (approx. USD 32,000); (ii) it is mandatory for direct selling operators to share joint and several liability with consumers who make purchases of goods or services through their independent distributors.
The conditions for registering and marking in the field of direct selling encompass the following: (i) applicants are obligated to furnish a guarantee to the registrar in an amount specified by the Ministerial Regulation, along with the preparation of a purchase and sale document in the Thai language; (ii) applicants must not have had their registration revoked in the five years leading up to the application submission, and the individual responsible for the operations must also not have faced a revocation during that period.
In addition, the Ministerial Regulation 2018 provides a list of activities which are not considered direct marketing, which include (i) a natural person who has not registered as a direct marketing operator and earns no more than 1,800,000 Thai Baht (approx. USD 50,000) per year from selling products or services through an electronic commerce platform; (ii) a small and medium-sized enterprise that legally registers in accordance with Small and Medium Enterprises Promotion Law; (iii) a community enterprise and their networks which legally register in accordance with the Community Enterprise Promotion Law; (iv) the cooperatives and the group of farmers who legally register in accordance with the Cooperatives Law.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is USD 50, below the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

According to the Domain Name Registration Policy 2020, the domain name ".co.th" is designed for business entities registered with the Department of Business Development in Thailand, state enterprises, or any person who registered the Value Added Tax with the Revenue Department in Thailand. In addition, according to Section 2 of the guidelines, the domain name holder can be a foreigner who holds a registered trademark with the Department of Intellectual Property (DIP) in Thailand. However, foreign juristic persons or trademark owners must appoint an agent to hold rights in a domain name on their behalf.

The Computer-Related Crime Act and the Notification of the Ministry of Digital Economy and Society (MDES) establish a safe harbour regime for intermediaries beyond copyright infringement. According to Section 15 of the Computer-Related Crime Act, service providers are not liable of for for the content published if they remove computer data once it has received a notification from the Minister of Digital Economy and Society (MDES) to discontinue the dissemination of these. In addition, the Notification includes the 'Notice and Take Down' procedure to remove the offence's content and the intermediary's liability. This notification allows an individual to submit their notices of online offence to the police or competent officers. After the service provider receives the notification from the Ministry, the competent officer, or court order, they must remove or stop the dissemination of certain content immediately within the given period.

According to Art. 26 of the Commission of Computer-Related Offences Act (commonly known as the Computer Crimes Act or CCA), all service providers are required to record users' computer traffic data and store it for 90 days, with the possibility of extending the retention period up to a year if ordered by authorities. In 2019, it was reported that the Thai government requested all coffee shops, including small operators, to retain traffic data of customers using their Wifi for 90 days and to provide that information upon request. This request includes keeping a 'log file' of customers' computer traffic data, including their IP address, full name, ID card number, or passport details. As defined in Art. 3 of the CCA, "Computer Traffic Data", encompasses information related to the communication of a computer system, such as the origin, source, terminal, route, time, date, size, duration, type of service, and other relevant communication details.

According to the National Council of Peace and Order (NCPO) Notification No. 18/2557 (2014), all types of media services, including both public and private providers in satellite, cable TV, digital TV, and community radio, service providers, newspapers, must monitor their content to prohibit broadcasting or disseminating the following information:
- A criticism of the performance of the NCPO and related persons;
- A confidential information of the state agency;
- An information that creates misunderstanding and inciting conflicts in the Kingdom;
- Threatening to harm any person that could create fear among the public.

In October 2020, the Ministry of Digital Economy and Society (MDES) issued an order requiring internet service providers (ISPs) and mobile service providers to block four internet protocol (IP) addresses associated with Telegram, a messaging app widely used by protesters. Although the government has not publicly disclosed the total number of URLs blocked through court orders, the MDES reported that during the first nine months of 2022, it obtained court orders to block approximately 4,735 URLs, including 1,816 URLs containing allegedly offensive content about the monarchy.
Websites have also been blocked on grounds of national security, for gambling content, for alleged violations of intellectual property rights, and for hosting unauthorised virtual private network (VPN) services. In addition to blocking and filtering, content removal reportedly continues under tight government control.