What Phuket settled, and what it did not
The tenth negotiating round between the EU and Thailand ran from 28 September to 2 October 2026 in Phuket. According to MLex, reporting on 12 October, services and investment, sanitary and phytosanitary rules, and initial provisions were agreed in principle. Government procurement, energy and raw materials, and rules of origin were agreed except for market access. Further talks will run in dedicated formats on market access and the remaining issues.
Digital trade is absent from that list. It was an open item before the round, and public reporting does not show whether it closed. That silence matters, because the chapter decides how Thailand treats data that leaves its borders for years to come.
The pace of the talks is clear from the earlier round. After the ninth round in Brussels (22 to 30 June 2026), Thai Commerce Minister Suphajee Suthumpun said 15 of 24 chapters were closed, about two-thirds of the agreement, according to The Nation. The same report named digital trade as part of the unfinished third. Phuket cleared a good deal of that remainder, but not, as far as public information shows, this chapter.
The case for caution
The strongest argument for Thai hesitation is a fair one. A binding digital trade chapter limits what a government can do later. Thailand's Personal Data Protection Act is still young, and its regulator is still building enforcement capacity. A commitment to free cross-border data flows, signed before that capacity exists, could lock in a weaker position than Bangkok would choose with more experience. Governments also worry about cybersecurity incidents, law-enforcement access to data, and the leverage that comes from regulating large foreign platforms. Those are legitimate sovereignty concerns, not mere protectionism.
Why the chapter is still worth closing
The EU's opening position is public. The European Commission's Thailand documents page lists a digital trade text among the EU textual proposals published in September 2023. The Commission describes these as a basis for discussion, and says the final text will be the result of negotiation. The EU circulated its legal text proposals on digital trade, together with services and investment, to member states ahead of a Trade Policy Committee meeting on 6 September 2023, as the Austrian Parliament's record of the Council document shows.
The obvious question is what a closed chapter would protect. Thailand already has the domestic architecture for it. Two notifications of the Personal Data Protection Committee on cross-border transfers took effect on 24 March 2024, setting criteria for sending personal data offshore where appropriate protection standards exist, and approving binding corporate rules for transfers within company groups, as Tilleke & Gibbins reports. In other words, Thailand has already chosen a conditional-transfer model, not a localization model. A trade chapter that recognizes that model, and bars arbitrary localization mandates, would mostly lock in what Thailand already does, while giving exporters in both economies a predictable rulebook.
That predictability is the pro-innovation case. Thai software firms, cloud users, and digital exporters sell into a market the EU's regulatory approach strongly shapes. Small firms cannot afford a separate compliance map for each transfer regime. Interoperable rules lower that cost far more than they constrain policy.
What a good outcome looks like
A proportionate chapter would have four features.
- Conditional free flow. Data moves freely by default, with exceptions for legitimate public-policy goals that are necessary and not disguised restrictions.
- No forced localization. Neither side requires servers or data to sit in-country as a condition of market access, except where a specific, justified measure applies.
- Regulatory cooperation, not copying. Both sides recognize that their privacy regimes differ and work on mutual recognition of transfer mechanisms, instead of one side adopting the other's law.
- Source-code and encryption safeguards. Companies are not compelled to hand over proprietary code or weaken encryption as a condition of access, with narrow carve-outs for regulators acting on specific investigations.
The last point also bears on speech. Open data and communications rules are part of the open-internet case, which is why civil-liberties groups such as the Electronic Frontier Foundation keep warning that compelled access and identity requirements can shut people out of information, as in its October 2026 analysis of age verification. Trade chapters that normalize intrusive access demands would work against that.
What to watch
Three things will show where the chapter stands. First, whether the Commission's round report for Phuket says anything about digital trade. Its documents page already lists reports through the tenth round, though the page does not say whether this chapter was settled. Second, whether the dedicated market-access and residual-issues talks include a digital track. Third, whether any final text lets the Thai regulator keep its conditional-transfer rules intact, rather than overriding them with a looser or stricter standard.
For now, the honest reading is that the deal is advancing quickly, and that the data-flow rules are probably among the last pieces. Thailand has little to lose by closing a chapter that mirrors its own law, and a lot to gain from the legal certainty it would give digital exporters. The risk is not that the chapter exists. It is that it gets decided late, in a package trade-off, with little public scrutiny.