Thai bill to require environmental impact assessment for data centres

A draft bill on the operation of digital infrastructure services would regulate data centres, cloud services and digital platforms.

Operators would need a licence from the Minister of Digital Economy and Society, while the rules for applying for, issuing, suspending and revoking licences for each type of business would be set out in ministerial regulations.

For data centres, the proposals cover project locations, environmental and health impact assessments, electricity and water supplies, and data storage in Thailand.

The draft leaves several key numerical thresholds unspecified, so secondary legislation will need to be examined before the costs for individual projects can be assessed.

Location and licensing requirements

The draft requires data centres to be located in areas where factories may be established under town-planning law.

Projects must also undergo an assessment of their impact on environmental quality and the health of people in the community under the Enhancement and Conservation of National Environmental Quality Act.

Applicants for a licence to establish a data centre must be limited companies or public limited companies registered under Thai law.

They must provide a guarantee for their operations, use clean electricity in a proportion to be announced by the minister, and meet the prescribed standards for data centre services.

The amount of the guarantee may vary according to the size or type of service.

High-use data centres must generate power or buy from private producers

For data centres whose electricity use reaches a threshold to be set in ministerial regulations, the draft provides three ways to obtain power: generating it themselves with permission under energy law, buying it directly from a licensed private power producer, or combining the two methods.

That condition applies only to businesses whose electricity use reaches the threshold to be set.

The draft does not require every data centre to generate its own power, nor does it specify the level of use at which the condition would apply.

Data centres must also maintain electricity and water usage effectiveness throughout their operations, in line with standards to be announced by the minister.

Water, heat, noise and electronic waste

The draft requires licence holders to keep heat released into the atmosphere and noise pollution within limits to be announced by the minister.

It also allows standards to be set for other forms of pollution.

Data centres meeting a size threshold to be specified in ministerial regulations must have sufficient water from their own sources to operate, without using water from public sources.

Operators must also manage electronic waste and put fire prevention and control measures in place under the prescribed rules.

If pollution or electronic waste management causes damage and the guarantee provided is insufficient to cover compensation or environmental restoration, the licence holder must pay the remaining costs.

Data storage in Thailand, with conditional overseas transfers

The draft requires operators that collect, store, process or hold in custody Thai nationals’ personal data, data of legal entities registered in Thailand, or information of government departments, public organisations and other state agencies to store those data in Thailand.

It nevertheless allows such data to be sent, transferred, stored, processed or backed up outside Thailand only where there is a necessary reason and the criteria, procedures and conditions to be set in ministerial regulations are met.

The proposal therefore does not prohibit every transfer of data overseas.

Operators must employ Thai nationals to supervise their systems, with Thai nationals making up at least half of all personnel performing system supervision duties, subject to details to be announced by the minister.

The draft also empowers the minister to set conditions or required proportions for the use of domestically produced materials and equipment.

Cloud providers must protect data; platforms must handle complaints

Licensed cloud providers must meet ministerial standards for storing user information and securing access to and transmission of data.

They must also check, prove or confirm users’ identities under rules to be prescribed.

Where there are reasonable grounds to believe a cloud user is using the service in breach of the law or failing to comply with it, the draft would allow an authorised official to order the provider to suspend access to data.

The provider must act within 12 hours of receiving notice of the order.

Digital platforms must inform users of their rights before a transaction, provide a channel for complaints or reports of unlawful acts, acknowledge complaints or reports within 24 hours, and communicate the results of their review within 60 days of receiving the matter.

If a platform presents a service or information to users in return for payment, it must disclose that the presentation is an advertisement.

The draft also allows the minister to require platforms to disclose agreements, conditions or factors involved in decisions about providing services.

The minister may set rules and maximum rates for fees charged to persons other than affiliated companies.

Operating without a licence risks imprisonment and daily fines

Under the draft, operating without a licence would carry a sentence of up to five years’ imprisonment, a fine of at least THB10 million, or both.

An additional fine of up to THB1 million a day would apply for as long as the operator failed to bring its business into compliance.

An operator that fails to store Thai nationals’ personal data in Thailand as required would face up to three years’ imprisonment, a fine of at least THB6 million, or both.

The draft specifies Thai nationals’ personal data for this particular penalty.

Under the transitional provisions, businesses operating before the law takes effect would have to apply for a licence within 180 days of the ministerial regulations on licensing coming into force.

They could continue operating while awaiting a decision, subject to criteria and conditions set by the minister.

The draft aims to protect national resources, regulate electricity and water use, reduce environmental impacts and prevent digital services from being used unlawfully.

The detail of its requirements will determine how far it protects the country and whether it places an excessive burden on investment.

Operators, communities and service users should therefore contribute their views so the rules protect the public interest without obstructing the growth of Thailand’s digital economy.

The draft is open for comment from Thursday (September 3, 2026) to Thursday (October 15, 2026).