Thailand software delivery: PDPA, PromptPay, e-Tax Invoice and Thai script

OutsourcingVN is operated by Netbase JSC, so this guide is written by a supplier that would like your project. It sets out what Netbase can evidence for a Thailand-facing brief, points to the official references your own advisers should read in full, and names the decisions that stay with you. The guides index lists guides for other markets, and the market index compares the first question each one raises.

Contents

• What makes a Thailand-facing build different?
• What can Netbase evidence for a Thailand brief?
• Which steps come before a Thailand-facing launch?
• Worked scenario: a Thai QR payment that does not confirm
• What has Netbase built that is relevant to a Thailand brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

What makes a Thailand-facing build different?

Four design choices come up in almost every Thailand-facing brief, and each has a different owner.

• Data protection under the PDPA and its committee. The Personal Data Protection Act B.E. 2562 (2019) is Thailand's general data protection law, overseen by the Personal Data Protection Committee. It requires consent before personal data is collected unless one of the Act's other lawful bases applies, sets obligations on data controllers and processors and conditions for sending personal data out of Thailand, and requires a controller to notify the Office of the Personal Data Protection Committee of a breach without delay and, where feasible, within 72 hours.
• PromptPay and Thai QR at checkout. The Bank of Thailand supervises payment service providers and the country's payment systems under the Payment Systems Act B.E. 2560 (2017). PromptPay is the national scheme that lets a payer send funds using a registered mobile number or ID instead of an account number, and the Thai QR Payment standard carries QR-code checkout; most Thai consumer products expect at least one of them alongside cards.
• The Revenue Department's e-Tax Invoice & e-Receipt system. The Revenue Department runs e-Tax Invoice & e-Receipt as part of its move toward a fully electronic tax environment, and it keeps a public directory of the business operators already registered in the system.
• Thai-language interfaces and fonts. Thai script has no spaces between words, carries tone marks that change line-breaking and letter-shaping rules, and commonly appears alongside the Buddhist Era calendar in business documents; none of that is a late translation pass.

A buyer's legal, finance and product owners should settle each of these with their own advisers before discovery starts; engineering then turns the decisions into a consent and breach process, an invoicing integration, a payment flow and a language boundary.

What can Netbase evidence for a Thailand brief?

Procurement and security reviewers tend to ask for the same statements. These are the ones Netbase can give, set against what a Thailand-facing brief actually needs decided.

Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. Netbase clients are in the United States, Europe and Asia-Pacific, and most projects come from clients outside Vietnam; delivery communication is in English, with the Hanoi office working Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7).

Worked scenario: a Thai QR payment that does not confirm

An online retailer adds Thai QR Payment alongside PromptPay and cards so shoppers can pay straight from a banking app.

A proposal that cannot describe steps 3 and 5, specifically what happens when a QR confirmation does not arrive, has not yet scoped Thai payments for this product.

What has Netbase built that is relevant to a Thailand brief?

Netbase has a published record for a client in Thailand: a preview bar that lists every page of a multi-page design as a thumbnail, built for a design-tool provider in Thailand, is one of the online-designer features in the online designer feature builds record; the client is not named. The closest further evidence for a Thailand-facing commerce brief is regional. Netbase redeveloped an online print store for a large-format inkjet printing company in Singapore: over several phases and more than a year, Netbase redeveloped the store's user experience, interface and most of its system, including a function that converts uploaded PDF artwork into high-resolution, editable pages mapped to the sides of a product; the large-format print store redevelopment record has the detail. Netbase has also built web-to-print stores with online design tools for print businesses in Singapore, described by industry and country only. The product personalisation and online design solution sets out how designer and configurator work is scoped for a Thai storefront.

Which questions should you ask a supplier?

• Who owns the PDPA consent basis and breach reporting? It should be your organisation, with the supplier advising rather than making the decision for you.
• Which e-Tax Invoice & e-Receipt route have you actually integrated? Ask for a real submission reference against the Revenue Department's directory, not a slide.
• What happens when a QR confirmation does not return? Look for a status check and a fallback, not a second charge.
• Who holds the PromptPay and Thai QR merchant relationships after handover? It should be your organisation.
• How do you test Thai script in generated documents? Look for real Thai content, named devices and a defect log covering line breaks and tone marks, not a placeholder string.
• What is out of scope for the first release? A good proposal names it rather than leaving it implicit.

What usually goes wrong?

• PDPA consent and breach-reporting duties left undecided. Signal: nobody can say how a real incident would be reported to the Personal Data Protection Committee. Owner: the data protection lead.
• The e-Tax Invoice route treated as a one-off form. Signal: the integration cannot handle a correction or a cancellation. Owner: the finance systems owner.
• Only one payment method tested end to end. Signal: a QR confirmation failure leaves an order stuck with no fallback. Owner: the product owner.
• Thai rendering added as an afterthought. Signal: line breaks fall mid-word and generated PDFs mis-shape Thai text. Owner: the localisation owner.

How this guide is sourced and where it stops

This guide uses the Ministry of Digital Economy and Society's English translation of the Personal Data Protection Act, the Revenue Department's own e-Tax Invoice & e-Receipt page, the Electronic Transactions Development Agency's own site and the Bank of Thailand's payment-systems page, all accessed on 2026-10-17, together with Netbase delivery records approved in the OutsourcingVN claim register. It is written for product, technology and operations leads preparing a brief. It does not decide whether a specific product sits inside the Personal Data Protection Act's scope or which e-Tax Invoice route fits your transaction volume; those decisions stay with your advisers. Bangkok and Hanoi share the UTC+7 time zone.

Plan the first release

Bring your PDPA consent and breach-reporting decisions, your e-Tax Invoice route, your PromptPay and Thai QR scope and the names of your legal, finance and product owners. For neighbouring markets, the Malaysia guide covers the amended PDPA, phased MyInvois e-invoicing and DuitNow payments, the Singapore guide covers phased redevelopment and identity data, and the Indonesia guide covers electronic-system registration and QRIS. Time zone collaboration in Vietnam sets out how an overlap window and escalation route are agreed.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your registration and payment questions, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions

Sources

• Ministry of Digital Economy and Society, Personal Data Protection Act B.E. 2562 (2019), unofficial English translation
• Revenue Department of Thailand, e-Tax Invoice & e-Receipt
• Electronic Transactions Development Agency (ETDA), official site
• Bank of Thailand, payment systems oversight