Sasikarn, spokesperson for the Ruam Thai Sang Chart Party, points out that data centers represent more than just investment capital. She warns the government not to wait until it is too late and urges swift issuance of measures to regulate shareholders and controlling interests to protect Thai data.
On 19 Sep 2026 GMT+7, Ms. Sasikarn Wattanajan, spokesperson for the Ruam Thai Sang Chart Party and former deputy government spokesperson, expressed concern about Thailand's cybersecurity and corporate governance of data center companies amid rapid AI development and data center investments. This followed a Wall Street Journal report that Google's AI, Gemini, accessed systems of three private companies, although its original purpose was testing in simulated environments.
One reason was that the testing environment unintentionally allowed AI to connect to the internet. Google confirmed this, notified the involved companies, and is working with testers to improve procedures.
Ms. Sasikarn sees AI as hugely beneficial for the economy and national development and believes Thailand should continue promoting such technology. However, as AI capabilities grow, cybersecurity systems must advance accordingly. Especially when future AI can connect more extensively to cloud systems, data centers, Thai citizen databases, and various digital services, a single vulnerability could cause damage beyond any single company.
Urgent action is needed regarding corporate governance of data center operators. Even if Thailand has strong cybersecurity technology, if companies holding or processing vast amounts of data lack transparent oversight, accountability, or clear separation of authority and responsibility, risks to citizens' data remain.
"We must ask more than just how good a data center's anti-hacking system is. We must also ask who owns it, where the money comes from, what project plans exist, who controls it, who can access the data, who audits it, and who is responsible if problems arise," she said.
"This is why cybersecurity and corporate governance must go hand in hand," Ms. Sasikarn said.
She added that the government must seriously consider the shareholder structure and changes in controlling interests of companies operating data centers or holding large amounts of personal data, since private companies can buy and sell shares or change controlling parties under relevant laws and conditions.
Although foreign shareholding in data center businesses is under regulatory review by the NBTC, which is considering license classification adjustments that may impose new foreign ownership limits, this remains an ongoing issue.
"Does the government know who the shareholders and controlling parties are in each data center company being built in Thailand? If a company holding vast amounts of Thai data sells shares or changes control to foreigners, what mechanisms guarantee that the data will not change hands along with the company and that Thai data will continue to be protected under the same standards?" Ms. Sasikarn asked.
She further stated that the Ministry of Digital Economy and Society should swiftly set cybersecurity standards for AI and data centers alongside governance measures. These should include limiting data access rights, strictly separating test systems from live systems, auditing and logging data access, defining accountability for incidents, assessing insider risks, and preparing measures for shareholder or control changes.
Ms. Sasikarn emphasized that the government should not wait until Thai people must ask who holds their data and whether it is still safe after incidents occur. AI development must progress alongside cybersecurity, and those handling citizen data must have transparent governance. Technology must advance, but the government must keep pace with the private sector, and protection systems must keep up with technology. Regarding Thai data, we must nip problems in the bud.
"The government must keep up with the private sector. Data center issues are not just about water and electricity consumption. Today, the private sector moves fast, invests quickly, and technology advances rapidly. The government must establish rules before problems arise. Once data centers become critical infrastructure and data becomes a key national asset, we can no longer focus solely on investment capital," Ms. Sasikarn said.