On 14 October 2026, Gasgoo reported that Chinese autonomous-vehicle firm Zelos had launched what it describes as Thailand's first national-level L4 connected and autonomous vehicle test project. It is run with the Department of Science Service and the Office of the National Science, Technology and Innovation Policy Committee, both under the Ministry of Higher Education, Science, Research and Innovation. Officials say the road data "will help shape the country's future autonomous driving policies," including L4 test standards and admission criteria.
That is a sensible way to build a rulebook. It is also the part of the announcement that deserves scrutiny, because the article says nothing about who owns, accesses, shares or retains that data.
What was actually tested
According to Gasgoo's report, the first phase ran on Thailand's closed T-CAV proving infrastructure, with the trial running from 1 to 10 September. It evaluated perception, decision-making and safety control for the Zelos RoboVan. Once closed-track validation wraps up, the next phase moves to the WHA Eastern Seaboard Industrial Estate.
The programme covers more than 20 scenarios tailored to local conditions: mixed traffic with pedestrians, cars and heavy motorcycles, traffic lights, turns, lane-keeping, car-following, automated parking and main-road merging. Testing references the ADAS EURO NCAP standard and ISO 22737:2021, the international standard for low-speed automated driving systems on predefined routes.
Benchmarking against established international standards, rather than inventing bespoke ones, is the right call. It keeps Thai requirements interoperable and lowers the cost of entry for foreign and domestic developers alike.
The strongest case for tight rules now
The best argument for early, binding regulation is that test programmes are where the facts get created. Whoever holds the data holds the evidence base for what counts as safe. If a single vendor keeps the raw logs, regulators may end up writing admission criteria around numbers they cannot audit. Vehicle data is also personal data: cameras on a road-going vehicle capture pedestrians, plates and locations. A regulator that waits for the technology to mature may find the data practices already entrenched.
That argument has real force. Thailand has no AV-specific law, and the announcement does not address data governance.
What Thai law already says
The gap is narrower than it looks, because Thailand's Personal Data Protection Act B.E. 2562 (2019) already applies. According to the ETDA's English translation, Section 6 defines personal data as "any information relating to a Person, which enables the identification of such Person, whether directly or indirectly." Section 5 extends the Act to data controllers and processors outside Thailand where they monitor the behaviour of people in Thailand.
A Chinese operator running a test vehicle that records pedestrians and traffic on Thai roads is plausibly within that reach. Section 6 also defines a data controller as whoever has "the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data." So the question of who the controller is can in principle be answered by the test agreement. The public announcement just does not say.
Section 4 contains exemptions, including for public authorities maintaining state security and public safety, and for other public-interest purposes set out by Royal Decree. Whether a state-backed test programme can lean on those exemptions is exactly what a published data agreement should settle. Practitioners note the broader issue: LawPlus describes automakers as turning vehicles into "sophisticated data collection platforms" and points out that sensitive personal data needs explicit consent. Camera footage of a crowded junction does not easily fit a consent model.
Why not write an AV law first
The tempting response is to draft a comprehensive autonomous-driving statute immediately. That would be a mistake. L4 technology is changing quickly, Thailand's own test programme has only just started producing data, and a premature statute would lock in assumptions that the trials are meant to test. Proportionate regulation means letting the evidence accumulate under existing law, then legislating on what the evidence shows.
But "evidence first" only works if the evidence is usable. That points to a short list of modest, low-cost commitments that need no new statute:
- Name the data controller for each test phase, and say whether Zelos, the Thai agencies or both decide how data is used.
- Publish retention and deletion limits for camera and location data, with de-identification of bystanders by default.
- Share safety-relevant results, such as scenario pass and fail rates, with regulators and, in aggregate, with competing developers, so admission criteria are not built on one firm's proprietary logs.
- State cross-border terms. The PDPA gives the Personal Data Protection Committee power under Section 16(5) to set criteria for transfers abroad, and test data sent to a foreign parent company is exactly such a transfer.
The lesson from vehicle surveillance elsewhere
The risk of leaving data terms vague is not hypothetical. In the United States, the EFF has argued that automated license plate reader data is "simply too dangerous for police to safely store, search, and disclose," and it is pushing states to limit storage. Road-facing sensor data tends to attract new uses once it exists. A Thai test programme that writes retention and purpose limits down now avoids that drift without slowing a single trial.
The takeaway
Thailand is doing the right thing by testing before legislating and by benchmarking against international standards. The weak point is not the pace of regulation but the opacity of the data terms. Publishing who controls the data, how long it is kept and who can audit it costs almost nothing. It would also give Thai policymakers a trustworthy evidence base, and give Zelos and its competitors a predictable path to admission.