According to the Act on the Organisation to Assign Radio Frequency and to Regulate the Broadcasting and Telecommunications Services B.E. 2553, the executive authority for the supervision and administration of services in the telecommunications sector in Thailand is the National Broadcasting and Telecommunications Commission. It is reported that the National Broadcasting and Telecommunications Commission is independent from the government in the decision-making process.

The Credit Information Business Act 2002 specifically covers the collection and processing of credit information. Section 9 states that only a credit information company has the right to operate the credit information business. Section 12 of the Act states that "No credit information company or information controller or information processor carrying on or operating the business in the Kingdom shall operate, control or process information outside the Kingdom."

Pursuant to Section 5.2.5.1 of the "NCSC Standards for the Maintenance of Cybersecurity in Cloud Computing Systems", cloud service providers are required to establish both a primary data centre and either a backup data centre located within Thailand or in the nearest Southeast Asian jurisdiction. The Standards further stipulate that information systems classified as having a “high” impact — defined as those capable of causing “very severe” consequences — must utilise these designated data centres.

Under Section 28 of the Personal Data Protection Act, personal data may only be transferred to a third country if the receiving country upholds adequate personal data protection standards, or if one of the following conditions is satisfied: (i) the transfer is necessary to comply with legal obligations; (ii) the individual has given informed consent for the transfer, despite being made aware of the inadequacy of the receiving country’s data protection laws; (iii) the transfer is required for the performance of a contract to which the individual is a party or will become a party; (iv) the transfer is necessary for the fulfilment of the controller’s obligations under a contract with a third party for the benefit of the individual; (v) the transfer is essential to prevent or address a danger to the life, body, or health of the individual or others, in situations where the individual cannot provide consent; or (vi) the transfer is necessary for the performance of a public task.
Section 29 of the Act further permits the international transfer of personal data under the following circumstances: (i) where the transfer is made to a controller or processor within a group company that has established binding corporate rules approved by the Committee; and (ii) where approval for the binding corporate rules from the Committee is pending, provided the controller or processor has implemented appropriate safeguards and effective legal remedies in accordance with the Committee’s guidelines.
Section 5 of the "Notification of the Personal Data Protection Committee on Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country Pursuant to Section 28 of the Personal Data Protection Act" sets forth criteria for determining the adequacy of personal data protection standards in recipient countries.
Additionally, Clauses 7 and 8 of the "Notification of the Personal Data Protection Committee on Criteria for the Protection of Personal Data Sent or Transferred to a Foreign Country Pursuant to Section 29 of the Personal Data Protection Act" outline additional requirements related to binding corporate rules, standard contractual clauses, and certifications, among others.

Thailand has not joined any agreement with binding commitments to open transfers of data across borders. Art. 12.15 of the Regional Comprehensive Economic Partnership (RCEP) recognises that each party may maintain its own regulatory requirements governing cross‑border transfers of information by electronic means and stipulates that such transfers shall not be restricted when undertaken for the conduct of business by a covered person; however, the article simultaneously allows parties to adopt or maintain any measures they themselves deem necessary to achieve a legitimate public policy objective, as well as any measures necessary to protect essential security interests, with the parties expressly affirming that the determination of such necessity lies solely with the implementing party and that such measures shall not be subject to dispute. It is reported that this formulation enables the parties to preserve their domestic data‑control regime under the rubric of national security without risking inter‑state disputes, and that the relative weakness of Chapter 12 renders its provisions largely ineffectual in facilitating the liberalisation of cross‑border data flows, particularly because the clause entrusting necessity assessments to the implementing party effectively permits any measure to be characterised as legitimate at that party’s discretion.

The Personal Data Protection Act provides a comprehensive regime of data protection in Thailand.

It is reported that rights holders consider existing enforcement mechanisms and deterrent measures to be insufficient in addressing the increasing prevalence of online piracy carried out through devices and applications that enable users to stream and download unauthorised content. Stakeholders are reportedly concerned that criminal proceedings relating to online piracy are protracted and that, even when convictions are ultimately obtained, the penalties imposed are inadequate to discourage future infringing conduct. Counterfeit and pirated goods also remain readily accessible, particularly through online marketplaces. Additional concerns persist regarding the continued use of unlicensed software within the private sector.

Thailand has adopted the World Intellectual Property Organization (WIPO) Copyright Treaty.

Thailand has not adopted the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

According to the Trade Secrets Act, trade secrets can be in any means or any medium which conveys a statement, story, or fact in formula, form, compilations, or assembled works, programs, methods, techniques, or processes (Section 3). The disclosure or use of trade secrets by a governmental agency that supervises the maintenance of trade secrets shall not be deemed as an infringement of rights in trade secrets in the following cases:
- When it is necessary to protect the health or safety of the public, or;
- When it is necessary for the benefit of the public, not for a commercial purpose, the governmental agency must proceed under the procedure to protect such trade secrets from being used in unfair trading activities (Section 7.2).

The Trade Secrets Act (TSA) provides a framework for effective protection of trade secrets. Any “trade information”, such as an instrument of statements, facts, or other information that meets the following three requirements, is protected as a trade secret:
- It is confidential, i.e. the trade information is not being publicly known to or accessible by persons who are not related to the trade information;
- It has a commercial value derived from its secrecy;
- Its secrecy is protected by its owner/controller, who has taken appropriate and sufficient protection measures to maintain its secrecy.
In practice, a non-disclosure agreement is commonly used to safeguard and maintain the secrecy of a trade secret.
If there is a dispute concerning the trade secret because a person infringes its secrecy, the trade secret owner can submit the dispute to the Trade Secret Committee for mediation and settlement. Alternatively, they can file a lawsuit in court against the infringer for interim and permanent injunction orders and compensations for actual damages and punitive damages. The lawsuit must be filed within three years from the date on which the infringement act and the infringer are known or within 10 years from the date of the infringement act.

Thailand is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA). However, the country has been an observer of the WTO GPA since 2015.

According to Section 4 of the Budget Procedure Act, foreign companies are prohibited from acquiring shares exceeding 50% in publicly controlled firms or state-owned enterprises (SOEs).

The Foreign Business Act (FBA) of 1999 governs foreign investment in Thailand. The act defines "foreigner" as any company with at least 50% foreign-owned capital or shares, or any limited partnership or registered ordinary partnership where foreigners hold managerial control. Under the Telecommunications Business Act of 2001, foreign applicants are prohibited from obtaining Type 2 and Type 3 telecommunications licenses, limiting foreign ownership in these sectors to 49%.
Additionally, the 2011 Foreign Dominance Notification, enforced by the National Broadcasting and Telecommunications Commission (NBTC), establishes criteria for foreign dominance in the telecommunications sector. The regulation restricts foreign dominance, prohibiting actions like holding 50% or more of voting shares, controlling majority votes at shareholder meetings, or appointing or removing half or more of a company's directors. Prohibited behaviours also encompass dominance through shareholders, voting rights, controlling power, financial relationships, intellectual property agreements, procurement arrangements, joint business operations, and transfer pricing.

List 3 of the Foreign Business Act includes industries in which "Thai nationals are not yet ready to compete with foreigners". These are open to foreign investors provided they receive a licence from the Director-General of the Department of Business Development of the Ministry of Commerce and approval from the Foreign Business Committee. A wide range of businesses are covered under List 3, including advertising businesses. A foreign company can engage in List 3 activities if Thai nationals hold a majority of the limited company’s shares. Any company with a majority of foreign shareholders (more than 50%) cannot engage in List 3 activities unless it receives an exception from the Ministry of Commerce under its Foreign Business License application.