According to the Notification of the National Broadcasting and Telecommunications Commission regarding Criteria, Procedures, and Conditions for Digital Television Services Licensing 2013, any person who wishes to operate a digital television program must obtain a digital television license by qualifying and paying the fee. In addition, after receiving the license, a person shall be entered into the process of digital television channel auction as prescribed in the NBTC Notification 2013 regarding the auction.

Cloud computing services typically do not require a telecommunications license. However, when such services utilise a leased line network to connect users to the cloud infrastructure, they are categorised as telecommunications services. Consequently, providers must obtain a Type 1 license, as prescribed by the National Broadcasting and Telecommunications Commission (NBTC) under the Telecommunications Business Act. This requirement is outlined in Agenda 4.24 of the National Telecommunications Commission (NTC) meeting No. 38/2013.

According to Section 6 of the Radio Communication Act, any persons who wish to import radio communication devices or any ancillary devices into the Kingdom are required to obtain a license. The telecommunications devices required to obtain a license include: radio modems, base stations, cellular repeaters, antennas, FM transmitters, and GPS tracking devices, among others. According to Section 9, the import license is valid for 180 days after issuance, and those who violate the law shall be liable to a fine, imprisonment, or both. The "Notification of the National Broadcasting and Telecommunications Commission on Criteria and Procedures for Granting A Permit to Manufacture, Import, Sell, or Offer for Sale or Install Receiver, Apparatus or Device Enabled for Receiving or Decoding Signals to Receive Programs of the Subscription Broadcasting Business B.E. 2555" includes the requirements that the importers must follow, including fee payment and document preparation.

According to the Ministry of Commerce's Notification regarding 3D Printing Machines as a Product Subjected to Import Requirements 2016, importers of 3D printing machines must be registered with the Department of Foreign Trade under the Ministry of Commerce. In addition, they are also required to notify the importation, possession, disposal, and balance of these products twice a year (in June and December). Moreover, the importers must report this information to the Customs Department.

It is reported that, with regard to trade in goods, concerns remain regarding transparency and the non-automatic licensing regimes in Thailand. In addition, the provision of incentives to customs officials for initiating investigations or enforcement actions has raised longstanding concerns among trading partners, given the risks of corruption and the costs, uncertainty, and lack of transparency associated with the customs penalty and reward system. As a result, conflicts of interest linked to personal incentives continue to be an issue.

Section 18 of the Computer-Related Crime Act allows the government to access user-related or traffic data without a court order and compel ISPs to decode programmed data.

It is reported that passive infrastructure sharing in Thailand to deliver telecom services to end users is mandated.

The Foreign Business Act (FBA) 1999 governs foreign investment in Thailand. Section 4 of the Act defines a "foreigner" as a company in which at least half of the capital or shares are held by foreigners, or a limited partnership or registered ordinary partnership with foreigners as the managing partner or manager.
According to Section 8 of the Telecommunications Business Act 2001, Type 2 licenses (telecommunications operators providing services to a specific group of customers, with or without operating their own telecommunications network) and Type 3 licenses (telecommunications operators providing their own telecommunications network for public use) cannot be granted to foreign applicants. As a result, foreign ownership in these sectors is capped at 49%.

The government maintains shareholdings in the National Telecom Public Company Limited, which was established on 7 January 2021 and provides a full range of domestic and international telecommunication services, holds the status of a state enterprise, with the Ministry of Finance fully owning its registered capital.

Thailand does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, accounting separation is mandated.

Thailand has not appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

According to the Act on the Organisation to Assign Radio Frequency and to Regulate the Broadcasting and Telecommunications Services B.E. 2553, the executive authority for the supervision and administration of services in the telecommunications sector in Thailand is the National Broadcasting and Telecommunications Commission. It is reported that the National Broadcasting and Telecommunications Commission is independent from the government in the decision-making process.

The Credit Information Business Act 2002 specifically covers the collection and processing of credit information. Section 9 states that only a credit information company has the right to operate the credit information business. Section 12 of the Act states that "No credit information company or information controller or information processor carrying on or operating the business in the Kingdom shall operate, control or process information outside the Kingdom."

Pursuant to Section 5.2.5.1 of the "NCSC Standards for the Maintenance of Cybersecurity in Cloud Computing Systems", cloud service providers are required to establish both a primary data centre and either a backup data centre located within Thailand or in the nearest Southeast Asian jurisdiction. The Standards further stipulate that information systems classified as having a “high” impact — defined as those capable of causing “very severe” consequences — must utilise these designated data centres.

Under Section 28 of the Personal Data Protection Act, personal data may only be transferred to a third country if the receiving country upholds adequate personal data protection standards, or if one of the following conditions is satisfied: (i) the transfer is necessary to comply with legal obligations; (ii) the individual has given informed consent for the transfer, despite being made aware of the inadequacy of the receiving country’s data protection laws; (iii) the transfer is required for the performance of a contract to which the individual is a party or will become a party; (iv) the transfer is necessary for the fulfilment of the controller’s obligations under a contract with a third party for the benefit of the individual; (v) the transfer is essential to prevent or address a danger to the life, body, or health of the individual or others, in situations where the individual cannot provide consent; or (vi) the transfer is necessary for the performance of a public task.
Section 29 of the Act further permits the international transfer of personal data under the following circumstances: (i) where the transfer is made to a controller or processor within a group company that has established binding corporate rules approved by the Committee; and (ii) where approval for the binding corporate rules from the Committee is pending, provided the controller or processor has implemented appropriate safeguards and effective legal remedies in accordance with the Committee’s guidelines.
Section 5 of the "Notification of the Personal Data Protection Committee on Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country Pursuant to Section 28 of the Personal Data Protection Act" sets forth criteria for determining the adequacy of personal data protection standards in recipient countries.
Additionally, Clauses 7 and 8 of the "Notification of the Personal Data Protection Committee on Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country Pursuant to Section 29 of the Personal Data Protection Act" outline additional requirements related to binding corporate rules, standard contractual clauses, and certifications, among others.