Thailand has not signed the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

It is reported that no compulsory assessment procedure is in place to certify electronic products.

According to Clause 5 of the Ministry of Commerce's Notification (No. 11) 2010, a website that includes the transaction of goods and services must register the 'E-Commercial Registration' under the Commercial Registration Act 1956 (amended by the Commercial Registration Act (No. 2) in 2006). Therefore, the electronic businesses operating in the internet system, service providers, web hosting, e-marketplace, or platform (for example, Lazada, Shopee, etc.) are required to register with the Department of Business Development (DBD). In addition, the DBD registration is valid for five years. Also, ordinary persons and juristic persons engaged in e-commerce businesses without commercial registration are considered to be in violation and shall be subject to a fine penalty as stipulated. Furthermore, foreign companies are required to submit additional documents for registration, including a copy of the company registration, an appointment of operation in Thailand, work permits, and a foreign business license or document certificate (if any).

The Direct Sales and Direct Marketing Act requires businesses that engage in direct sales/marketing to register with the Office of the Consumer Protection Board (OCPB). The definition of "direct marketing" has been amended to include e-commerce transactions. Business operators who fail to register as required will be punishable by a fine, imprisonment, or both.
In accordance with the provisions of the Act, the criteria for registering in the field of direct selling involve the following conditions: (i) the business entity must be structured as a partnership with a minimum registered capital of 500,000 Thai Baht (approx. USD 16,000), or alternatively, it can be a limited company or a public limited company with a minimum registered and paid-up capital of 1,000,000 Thai Baht (approx. USD 32,000); (ii) it is mandatory for direct selling operators to share joint and several liability with consumers who make purchases of goods or services through their independent distributors.
The conditions for registering and marking in the field of direct selling encompass the following: (i) applicants are obligated to furnish a guarantee to the registrar in an amount specified by the Ministerial Regulation, along with the preparation of a purchase and sale document in the Thai language; (ii) applicants must not have had their registration revoked in the five years leading up to the application submission, and the individual responsible for the operations must also not have faced a revocation during that period.
In addition, the Ministerial Regulation 2018 provides a list of activities which are not considered direct marketing, which include (i) a natural person who has not registered as a direct marketing operator and earns no more than 1,800,000 Thai Baht (approx. USD 50,000) per year from selling products or services through an electronic commerce platform; (ii) a small and medium-sized enterprise that legally registers in accordance with Small and Medium Enterprises Promotion Law; (iii) a community enterprise and their networks which legally register in accordance with the Community Enterprise Promotion Law; (iv) the cooperatives and the group of farmers who legally register in accordance with the Cooperatives Law.

List 3 of the Foreign Business Act includes industries in which "Thai nationals are not yet ready to compete with foreigners". These are open to foreign investors provided they receive a licence from the Director-General of the Department of Business Development of the Ministry of Commerce and approval from the Foreign Business Committee. A wide range of businesses are covered under List 3, including advertising businesses. A foreign company can engage in List 3 activities if Thai nationals hold a majority of the limited company’s shares. Any company with a majority of foreign shareholders (more than 50%) cannot engage in List 3 activities unless it receives an exception from the Ministry of Commerce under its Foreign Business License application.

According to the Notification of the National Broadcasting and Telecommunications Commission regarding Criteria, Procedures, and Conditions for Digital Television Services Licensing 2013, any person who wishes to operate a digital television program must obtain a digital television license by qualifying and paying the fee. In addition, after receiving the license, a person shall be entered into the process of digital television channel auction as prescribed in the NBTC Notification 2013 regarding the auction.

Cloud computing services typically do not require a telecommunications license. However, when such services utilise a leased line network to connect users to the cloud infrastructure, they are categorised as telecommunications services. Consequently, providers must obtain a Type 1 license, as prescribed by the National Broadcasting and Telecommunications Commission (NBTC) under the Telecommunications Business Act. This requirement is outlined in Agenda 4.24 of the National Telecommunications Commission (NTC) meeting No. 38/2013.

According to Section 6 of the Radio Communication Act, any persons who wish to import radio communication devices or any ancillary devices into the Kingdom are required to obtain a license. The telecommunications devices required to obtain a license include: radio modems, base stations, cellular repeaters, antennas, FM transmitters, and GPS tracking devices, among others. According to Section 9, the import license is valid for 180 days after issuance, and those who violate the law shall be liable to a fine, imprisonment, or both. The "Notification of the National Broadcasting and Telecommunications Commission on Criteria and Procedures for Granting A Permit to Manufacture, Import, Sell, or Offer for Sale or Install Receiver, Apparatus or Device Enabled for Receiving or Decoding Signals to Receive Programs of the Subscription Broadcasting Business B.E. 2555" includes the requirements that the importers must follow, including fee payment and document preparation.

According to the Ministry of Commerce's Notification regarding 3D Printing Machines as a Product Subjected to Import Requirements 2016, importers of 3D printing machines must be registered with the Department of Foreign Trade under the Ministry of Commerce. In addition, they are also required to notify the importation, possession, disposal, and balance of these products twice a year (in June and December). Moreover, the importers must report this information to the Customs Department.

It is reported that Thailand’s provision of incentives to customs officials who initiate investigations or enforcement actions creates conflicts of interest and encourages customs investigations for personal financial gain. Foreign companies report concerns about corruption and the cost, uncertainty, and lack of transparency associated with the customs penalty/reward system. Foreign stakeholders also have expressed concern about the country's inconsistent application of the transaction valuation methodology, as well as the repeated use of arbitrary or fictitious values by the Customs Department.

According to Section 6 of the Radio Communication Act, any persons who wish to export radio communication devices or any ancillary devices into the Kingdom are required to obtain a license. The telecommunications devices required to obtain a license include a radio modem, base station, cellular repeater, antenna, FM transmitter, GPS Tracking, among others. According to Section 9, the import license is valid for 180 days after issuance, and those who violate the law shall be liable to a fine, imprisonment, or both. In addition, the Notification of the National Broadcasting and Telecommunications Commission (NBTC) on Export of Radio Communication Equipment 2011 includes the requirements that the exporters must follow, including fee payment and document preparation.

According to the National Council of Peace and Order (NCPO) Notification No. 18/2557 (2014), all types of media services, including both public and private providers in satellite, cable TV, digital TV, and community radio, service providers, newspapers, must monitor their content to prohibit broadcasting or disseminating the following information:
- A criticism of the performance of the NCPO and related persons;
- A confidential information of the state agency;
- An information that creates misunderstanding and inciting conflicts in the Kingdom;
- Threatening to harm any person that could create fear among the public.

In October 2020, the Ministry of Digital Economy and Society (MDES) issued an order requiring internet service providers (ISPs) and mobile service providers to block four internet protocol (IP) addresses associated with Telegram, a messaging app widely used by protesters. Although the government has not publicly disclosed the total number of URLs blocked through court orders, the MDES reported that during the first nine months of 2022, it obtained court orders to block approximately 4,735 URLs, including 1,816 URLs containing allegedly offensive content about the monarchy.
Websites have also been blocked on grounds of national security, for gambling content, for alleged violations of intellectual property rights, and for hosting unauthorised virtual private network (VPN) services. In addition to blocking and filtering, content removal reportedly continues under tight government control.

The appointment of a Data Protection Officer (DPO) is a mandatory condition under the Personal Data Protection Act (PDPA). Section 41 of the Act specifies that the data controller and data processor shall designate a DPO in the following circumstances: the activities such as collection, use, or disclosure of personal data.
The DPO's duties include advising the data controller and data processor, investigating the performance of the data controller and data processor, coordinating and cooperating with the Office of the Personal Data Protection Committee (PDPC) when there are problems and keeping confidentiality of the personal data (Section 42).

Section 64 of the Cyber Security Maintenance Act (CSA) 2019 states that, if it is necessary for the prevention, handling, and reduction of cyber threat risks, the Cyber Security Supervisory Committee (CSSC) shall order State agencies to provide information in their possession and related to cybersecurity maintenance.
Also, in Section 66, the CSSC has the power to carry out or order competent officials to carry out operations, only to the extent necessary for preventing cyber threats, in the following matters:
- to enter a place for inspection upon written notification;
- to gain access, copying or filtering computer data, computer systems or other related data;
- to test the functionality of computers or computer systems;
- to seize or attach, only to the extent necessary, computers, computer systems, or equipment, not exceeding 30 days.
To carry out activities under (2), (3), (4), the CSSC must file a motion to the competent court. However, in case of emergency and the threat is critical to cybersecurity, the Secretary-General shall take immediate action to the extent necessary for preventing and remedying damage in advance without filing a motion with the Court (Section 68).