Crisis Management 2026

Last Updated March 24, 2026

Thailand

Law and Practice

Authors



Baker McKenzie is a leading global law firm with an integrated Bangkok office that offers comprehensive transactional, regulatory and dispute-related capabilities. The team combines international standards with local insight, advising multinational and domestic clients on complex matters across both contentious and non-contentious work. The firm manages multi-jurisdictional mandates and provides co-ordinated advice across its global platform. Its crisis management work involves lawyers from regulatory compliance, investigations, employment, data protection, corporate governance and disputes, supporting clients in high-pressure situations requiring rapid assessment of legal, operational and reputational risks. Recent matters include responses to industrial incidents, significant cyber-fraud events and regulatory inquiries in highly regulated sectors.

Over the past 12 months, crisis‑management practice in Thailand has become more structured and co-ordinated as organisations faced a series of high‑impact events across natural, operational and technological domains. The severe flooding in the southern provinces underscored the need for clearer internal protocols, more reliable communication channels, and stronger continuity planning, prompting companies to reassess their readiness for large‑scale disruptions. A number of construction‑related incidents also drew national attention and regulatory scrutiny, leading businesses to place greater emphasis on contractor oversight and site‑safety governance.

At the same time, cyber-incidents continued to escalate in both volume and complexity, particularly phishing, ransomware and impersonation attacks. This has pushed organisations to bring IT, legal and communications teams into closer alignment during incident response. Regulatory developments, including mandatory minimum cybersecurity standards and ongoing national disaster‑management planning, have further reinforced expectations around preparedness, documentation and co-ordinated response. Taken together, these developments have moved Thai organisations towards more proactive, cross‑functional crisis‑management approaches.

The sectors most exposed to crises in Thailand over the past year were construction, flood‑affected industries, and cyber‑dependent services. Construction companies faced heightened scrutiny following a series of safety‑related incidents, which highlighted weaknesses in contractor performance and risk controls. Industries operating in the southern provinces were heavily affected by severe flooding, which disrupted transport, hospital operations, logistics and tourism activity. Banks, telecommunications providers and online service platforms also remained vulnerable to ransomware, phishing and other cyber-attacks, which increasingly turned technical disruptions into organisation‑wide crises.

These events led to operational disruption, increased regulatory oversight and reputational challenges. In response, government authorities strengthened contractor‑rating mechanisms, improved multi‑agency disaster‑response co-ordination, and implemented mandatory cybersecurity standards. These measures are designed to reduce sector‑specific vulnerabilities and support more resilient crisis‑response capabilities across the industries most frequently affected.

Thailand’s crisis‑management framework is governed primarily by the Disaster Prevention and Mitigation Act BE 2550 (2007), which functions as the country’s principal all‑hazards statute. It defines “public disasters” broadly, covering natural events such as floods, storms, earthquakes, droughts and fires, as well as man‑made crises, including industrial accidents, sabotage, terrorism and epidemics. The Act establishes national, provincial and local command structures and assigns roles to agencies responsible for preparedness, co-ordinated response and post-event recovery. It is supported by the National Disaster Prevention and Mitigation Plan (2021–2027), which sets out strategic priorities for risk reduction and integrated emergency management.

During a crisis, enforcement occurs through activation of emergency operations centres, mobilisation of government agencies (including the military), and binding directives issued to public and private entities. This framework enables Thailand to centralise command and co-ordinate multi‑agency operations across disaster types.

Thailand has not recently amended the Disaster Prevention and Mitigation Act BE 2550 (2007), but there has been continued national review and policy development, including the implementation of the updated National Disaster Prevention and Mitigation Plan (2021–2027). Although the Plan is not a statutory amendment, it represents a significant policy update that shapes how the Act is applied in practice.

The Plan is expected to strengthen operational readiness through its emphasis on risk reduction, integrated emergency response, enhanced local‑level capability, and “Build Back Better” recovery approaches. It also promotes improved information systems, cross‑sector collaboration and alignment with international best practices, responding to lessons from recurring floods, climate‑related hazards and other major crises. These updates should improve co-ordination and efficiency in managing multi‑hazard emergencies.

Thailand does not yet have an established commercial third‑party litigation funding market. Recent assessments indicate that the country still “lacks a culture of third‑party litigation funding”, and the only available mechanism remains the Ministry of Justice fund that supports low‑income litigants. As a result, crisis-related disputes in Thailand continue to be pursued through party‑funded litigation rather than the funder‑driven mass‑tort models seen in other jurisdictions, limiting the pace and scale of mass‑impact claims following major crises.

In contrast, Thailand’s class action framework has become more active, particularly in areas where crises generate widespread harm. Since their introduction in 2015, class actions – generally viewed as “plaintiff‑friendly” – have increasingly been used in consumer, environmental, shareholder and securities‑related disputes, which often arise following operational failures or public‑safety incidents. Courts retain broad discretion over certification, and the opt‑out model automatically includes large groups, increasing potential exposure for companies. Recent trends show growing interest in environmental and mass‑impact cases, aligning with heightened scrutiny of industrial accidents, construction failures and environmental harm.

Thailand’s crisis‑management system is led at the national level by the National Disaster Prevention and Mitigation Committee (NDPMC), chaired by the Prime Minister, with operational responsibilities carried out by the Department of Disaster Prevention and Mitigation (DDPM). The DDPM also oversees the National Disaster Warning Centre, which is responsible for hazard monitoring and early‑warning dissemination. These bodies co-ordinate preparedness and response under the Disaster Prevention and Mitigation Act BE 2550 (2007) and the National Disaster Prevention and Mitigation Plan (2021–2027), which together mandate integrated early‑warning systems, activation of emergency operations centres, and continuous monitoring and evaluation of crisis‑response actions.

At the local level, provincial governors act as incident commanders during emergencies, implementing provincial disaster‑management plans and directing frontline response. Local administrators manage community‑level preparedness, early‑warning systems and initial response until national support arrives. This multi‑tiered structure ensures co-ordinated national oversight, technical monitoring and local execution across natural disasters, man‑made incidents and public‑health emergencies.

Local crisis‑management requirements in Thailand differ from national frameworks mainly in terms of operational details and how authority is exercised. The Disaster Prevention and Mitigation Act BE 2550 (2007) establishes the national command structure through the NDPMC and DDPM, which set nationwide policies, warning systems and co-ordination standards. Local authorities, however, are responsible for developing and implementing provincial and community‑level disaster plans, conducting local risk assessments, and managing first‑response actions tailored to local conditions.

For companies, this creates practical compliance challenges, particularly when operations span multiple provinces. Local governments may impose different evacuation rules, reporting obligations or emergency procedures, requiring businesses to follow both national directives and varying local instructions at the same time. Differences in local enforcement capacity can also lead to inconsistent requirements during a crisis, making it difficult for companies to keep internal crisis plans aligned with shifting, localised expectations.

At the local level, provincial governors act as the primary crisis commanders and are responsible for activating provincial disaster plans and issuing emergency measures under the Disaster Prevention and Mitigation Act BE 2550 (2007). They are supported by Provincial and District Disaster Management Committees, which oversee preparedness and local risk assessments.

Local administrators – including municipalities and sub-district councils – also function as frontline regulators, handling community-level planning, early-warning systems and initial response measures before provincial or national assistance arrives.

Thailand’s independent oversight mechanisms are limited. While crisis‑management authority is mainly governmental (the DDPM, the NDPMC and provincial governors), there are independent or semi‑independent bodies that play a supporting oversight role, mainly through evaluation, audit, research and capacity‑building rather than direct regulatory enforcement.

Thailand’s legal framework requires mandatory public reporting, warning dissemination and information transparency during crises, primarily under the Disaster Prevention and Mitigation Act BE 2550 (2007) and the National Disaster Prevention and Mitigation Plan (2021–2027).

Thailand imposes sector‑specific crisis‑management obligations across healthcare, finance and infrastructure. Healthcare providers must comply with the Communicable Diseases Act 2015, which authorises surveillance, outbreak control and emergency health measures. Financial institutions and critical‑service operators must meet the National Cyber Security Committee’s (NCSC) minimum standards, effective January 2025, which mandate risk classification, baseline cybersecurity controls and incident‑response readiness. Critical information infrastructure operators (CIIOs), including organisations in energy, transport, telecommunications and public‑utility sectors, are also subject to those minimum standards.

All high-risk sectors must align their physical‑crisis and emergency‑response procedures with the National Disaster Prevention and Mitigation Plan (2021–2027). Compliance is monitored through sector‑regulator audits, NCSC assessments and DDPM oversight, supported by emergency‑operations‑centre reporting, early‑warning procedures and provincial-level supervision.

Thailand has several pre‑structured public–private co-operation frameworks that support crisis prevention and response. Under the Disaster Prevention and Mitigation Act BE 2550 (2007), provincial and district disaster‑management committees must include private‑sector representatives and community leaders, meaning that public–private co-operation is built directly into local disaster-management structures. Thailand’s oil‑spill preparedness system is another formal framework: the Marine Department, the DDPM, the Royal Thai Navy, petroleum companies and the Oil Industry Environmental Safety Group Association conduct joint national training, simulation exercises and co-ordinated response planning on a recurring basis.       

Thailand’s crisis‑management system is based on the Disaster Prevention and Mitigation Act BE 2550 (2007) and implemented through the National Disaster Prevention and Mitigation Plan (2021–2027). The framework establishes a top‑down co-ordination system, with national bodies setting overall strategy, provincial governors directing on‑the‑ground response, and local authorities executing community‑level action. Implementation is supported by emergency operations centres, early‑warning systems, and mandatory monitoring and evaluation mechanisms.

Thailand’s crisis co-ordination follows the national‑to‑local chain of command under the Disaster Prevention and Mitigation Act BE 2550 (2007). The NDPMC sets policy direction, while the DDPM co-ordinates ministries, military units and technical agencies, working closely with the National Disaster Warning Centre and specialist bodies to issue unified alerts and procedures. Provincial governors act as on‑the‑ground crisis commanders, activating provincial plans, directing district authorities, and co-ordinating local operations through provincial and district disaster‑management committees that include public, private and community actors. The military provides logistics, engineering support and emergency assistance when mobilised.

Companies may co-ordinate multi‑jurisdiction crises by using a central crisis‑management team that oversees overall strategy while local teams comply with jurisdiction‑specific legal requirements. Central teams maintain consistent decision‑making protocols, communications and documentation, while local counsel and compliance teams interpret differing regulations. The main challenges include inconsistent reporting timelines, varying disclosure thresholds, differing enforcement practices and the difficulty of balancing local legal risk with global reputational considerations.

There are no unified or universal reporting obligations for cross‑border crises. Reporting remains jurisdiction‑specific, meaning that companies must follow each jurisdiction’s separate legal requirements. When a crisis spans several jurisdictions, businesses typically need to file separate reports with each national authority, often with different timelines, formats and disclosure thresholds.

Companies in Thailand generally structure their crisis‑management plans around a central crisis‑response framework aligned with the Disaster Prevention and Mitigation Act BE 2550 (2007). Plans typically identify a core crisis team, set incident‑classification levels, assign decision‑making authority and establish communication protocols for co-ordinating with regulators, provincial authorities and the DDPM.

Key components include:

  • a clear command structure reflecting national and provincial roles;
  • early-warning and monitoring procedures aligned with the National Disaster Warning Centre’s systems and standard operating protocols;
  • communication plans and regulatory and public engagement, consistent with national warning and reporting requirements;
  • co-ordination protocols for multi-agency interaction, mirroring Thailand’s Emergency Operations Centre model; and
  • post-crisis review mechanisms aligned with the national plan’s monitoring and improvement requirements.

Companies in Thailand typically organise internal crisis governance through a central crisis‑management team that mirrors the national command structure. These teams commonly include senior management, legal, operations, communications and safety leads to ensure alignment with national and provincial procedures.

It is common for companies to maintain dedicated crisis or emergency committees that activate when significant incidents occur. These committees co-ordinate internal decision‑making, manage communication with regulators, and liaise with provincial authorities and the DDPM.

Directors and executives face personal exposure under Thailand’s civil and criminal laws if they fail to meet duties of care, oversight or compliance with legally mandated crisis‑management obligations.

Liability can be mitigated by maintaining formal crisis‑management structures aligned with national requirements, documenting compliance with disaster‑management duties, co-ordinating with provincial authorities and emergency operations centres, and ensuring that decisions follow established early‑warning and response protocols. 

Companies in Thailand typically maintain standing crisis or emergency committees that remain dormant until activation. These are activated in response to material incidents such as natural disasters, cyber events and safety failures. It is not common for Thai companies to appoint fully independent external members. Most committees generally consist of internal senior managers, reflecting the statutory national model, which relies on government officials rather than independent actors.

A crisis‑management team in Thai companies usually consists of senior executives overseeing operations, legal, communications, human resources and IT. The chief executive officer, or another senior executive, typically leads the team, reflecting Thailand’s top‑down crisis‑command model. Once activated, the crisis‑management team meets immediately and as frequently as needed. Communication between the crisis team, senior management and internal functions is kept highly centralised and direct to ensure consistent decision‑making, rapid information flow, and alignment between operational teams throughout the crisis.

Companies in Thailand commonly engage external experts to support crisis management and prevention, especially in areas requiring technical capability such as disaster‑risk reduction, oil‑spill response, early‑warning systems, and capacity building. External experts are typically selected for sector‑specific experience, technical capability, emergency operations experience, and ability to co-ordinate with government agencies. For example, in the oil‑spill and chemical‑spill sector, petroleum companies work jointly with the Marine Department, the Royal Thai Navy and the Oil Industry Environmental Safety Group Association in national‑level spill‑response exercises, demonstrating effective collaboration between industry and government.

Companies in Thailand typically manage third‑party and supply‑chain risks by relying on contractual controls, supplier‑monitoring processes and escalation mechanisms aligned with Thailand’s hierarchical disaster‑management structure. Clear contractual rights, audit mechanisms and notification obligations help ensure operational continuity and co-ordination during crises.

Companies in Thailand typically assess crisis‑management effectiveness by reviewing response speed, continuity of critical operations, internal co-ordination, and the quality and timeliness of regulatory and public communication. Continuous improvements are made through after‑action evaluations, updates to internal protocols, and additional training or simulations. Co-ordination with external agencies may also be refined to better align with national early‑warning systems and crisis‑response procedures.

ESG considerations increasingly influence crisis‑management strategies in Thailand, as stakeholders expect companies to protect people, communities and supply chains during disruptive events. As a result, companies now integrate human‑rights safeguards, worker‑safety protections, and supply‑chain due‑diligence measures into crisis planning to ensure that vulnerable groups, employees and contractors are adequately protected. In practice, businesses incorporate ESG into crisis plans by assessing supplier resilience, requiring transparent reporting during disruptions and co-ordinating community‑level risk‑reduction actions in line with Thailand’s emphasis on local preparedness and multi‑sector co-operation.

Companies typically address human rights concerns by prioritising employee safety, non‑discrimination, fair treatment of affected communities, and transparent communication during disruptions. Thailand also imposes legal duties to protect people during emergencies. Under the Disaster Prevention and Mitigation Act BE 2550 (2007), authorities, and organisations operating under their direction, must support public safety, co-ordinate evacuation and reduce harm during disasters. Local administrators and provincial governors are required to safeguard affected individuals as part of their mandated crisis‑response authority.

Companies can usually identify a crisis and its potential legal implications quickly, as most maintain standing crisis‑management teams and predefined escalation protocols. These teams assess incidents immediately by reviewing facts, identifying affected operations or stakeholders, and determining whether legal duties may be triggered, including compliance with national disaster‑response procedures or public‑health directives. Immediate steps include fact‑gathering, notifying senior management, activating crisis plans, and engaging provincial authorities or the DDPM when required. Companies may also conduct internal risk checks similar to the local assessment processes mandated for provincial and district disaster committees. To support rapid identification and communication, companies typically use monitoring tools such as real‑time alert systems, incident‑tracking platforms, and centralised communication channels.

Companies in Thailand commonly use centralised, command‑style crisis‑management frameworks. These rely on a standing crisis‑management team, clear escalation procedures, and co-ordination mechanisms similar to provincial and district disaster‑management structures.

A typical crisis-response plan includes:

  • a defined command structure;
  • incident‑classification levels, roles and responsibilities;
  • internal and external communication protocols;
  • co-ordination procedures with government authorities;
  • early‑warning and monitoring steps; and
  • post‑crisis review mechanisms aligned with national requirements.

Companies in Thailand identify and assess potential crisis‑related risks through regular risk assessments, scenario planning, and monitoring early‑warning information. Relevant risk factors typically include natural hazards, operational vulnerabilities, supply‑chain dependencies, technology failures and community‑level impacts. Common preventative measures include implementing early‑warning tools, strengthening internal controls, improving supplier oversight, conducting training and simulations, and co-ordinating with local authorities.

Though frequency varies by industry, many organisations in Thailand conduct regular simulation exercises, often annually or in line with industry‑specific standards. For example, oil and gas companies participate in national oil‑spill response simulations jointly organised by the Marine Department, oil companies and other agencies. Typical scenarios include oil or chemical spills, flood and storm events, earthquakes, warning-system activation, and multi‑agency emergency co-ordination, reflecting the hazards addressed in Thailand’s national early‑warning and crisis‑response framework.

Many organisations in Thailand promote and organise regular crisis prevention and response training for employees, depending on their sector’s needs. Companies ensure that employees are aware of crisis protocols through periodic drills, awareness sessions and internal briefings, similar to the multi‑agency simulation exercises used in the oil‑spill sector. Responsibility for training typically falls to safety, operations or risk‑management teams, with senior management oversight to ensure alignment with national and provincial crisis‑management expectations.

Many companies adopt crisis preparedness and prevention policies that mirror the structure of Thailand’s national disaster-management framework. These often include procedures covering risk assessment, escalation, communication and early-warning mechanisms, consistent with the National Disaster Prevention and Mitigation Plan. Policies are incorporated into company handbooks, standard operating procedures (SOPs) and business‑continuity frameworks. Effective implementation relies on regular training, drills and co-ordination exercises, along with clear assignment of responsibility to safety, operations or risk‑management teams.

Key legal challenges include complying quickly with mandatory crisis‑management duties under the Disaster Prevention and Mitigation Act BE 2550 (2007), which prescribes specific co-ordination, response and safety obligations for organisations during crises. Failure to meet these duties may expose companies to allegations of inadequate preparedness or negligence. Companies also face challenges in co-ordinating with multiple government bodies, such as provincial disaster‑management authorities and emergency operations centres, which can issue differing instructions during fast‑moving events.

Legal liability exposure depends on the type of crisis. Natural disasters fall under the DDPM and provincial governors under the Disaster Prevention and Mitigation Act BE 2550 (2007), which grants them command authority during emergencies. Environmental, industrial or technological incidents may instead trigger sector‑specific regulators, as Thai law defines “public disaster” broadly to include fires, chemical accidents and environmental harm. As a result, legal exposure varies depending on which authority is empowered to manage the relevant category of incident.

Companies typically co‑operate frequently with enforcement authorities during crises as Thailand’s disaster‑management system requires co-ordination with national, provincial and local authorities. To address potential legal violations or issues, companies usually take immediate corrective action, conduct internal investigations, and document compliance with directions issued by crisis commanders. These measures reflect Thailand’s national plan, which requires continuous monitoring and post‑crisis evaluation to correct deficiencies and strengthen future readiness.       

Companies typically assess potential legal risks and liabilities by conducting rapid internal reviews of how an incident intersects with Thailand’s crisis‑management laws and any binding directives issued by provincial governors or local administrators. Key considerations include whether the company complied with government orders, the potential impact on employees, communities or public safety, sector‑specific obligations, and any exposure arising from environmental or operational harm. In addition, companies must analyse the substantive provisions of all relevant liability frameworks, as a single incident may trigger responsibilities under multiple statutes. Accordingly, a comprehensive legal review is essential to determine the full spectrum of potential liabilities and to guide an appropriate and defensible response strategy.

Legal teams are typically involved from the moment a crisis is identified, advising on compliance with national disaster‑management obligations, provincial emergency orders, and sector‑specific rules. They review facts, manage regulatory communications, and assess liability exposure as provincial governors and local administrators issue binding directives. A key part of their role is to analyse all legal frameworks relevant to the particular incident, as a single event may trigger obligations and potential liabilities under multiple statutes – each with different duties, timelines and exposure levels – even when stemming from the same underlying occurrence.

Given the complexity of co-ordinating with provincial authorities, multiple agencies or specialised regulatory regimes, companies often engage external legal counsel to support these efforts. External counsel are typically selected for their experience with emergency‑related regulations, their ability to liaise effectively with government authorities, and their sector‑specific expertise.

Companies typically establish immediate evidence-preservation protocols, including securing relevant records, freezing automated deletion systems, and centralising document collection. Materials such as internal communications, incident logs, operational data and reports are preserved to maintain an accurate record of events. Compliance with legal requirements is ensured through clear retention policies, oversight by legal teams and controlled access to sensitive information.

Possible settlement arrangements include negotiated settlements, mediation or court-approved compromises, depending on the nature of the claims and the number of affected parties.

Companies commonly obtain general liability insurance, directors and officers (D&O) coverage, and environmental or industrial‑incident policies to address litigation and crisis‑related costs. When managing claims, companies typically notify insurers immediately, provide required documentation, and work with appointed claims-handlers or external counsel to confirm coverage. Insurers often require evidence of the company’s response efforts and risk‑mitigation steps, especially in environmental or mass‑impact incidents.

Companies usually measure reputational impact by monitoring public sentiment, media coverage and stakeholder reactions, including social media discussions, customer feedback and enquiry volumes. To rebuild reputation, companies typically rely on transparent communication, visible corrective actions, and ongoing engagement with affected communities.

Crisis-related reporting can be mandatory depending on the type of incident. Companies ensure timely and accurate reporting by activating internal escalation protocols, assigning responsibility to legal or compliance teams, and maintaining clear documentation and communication channels. These teams verify accuracy before submission and co-ordinate directly with the relevant authority to meet statutory expectations.

Companies usually co-ordinate crisis communication through a central communication lead or team, which manages information flow with government authorities, private-sector partners and the public. Unified communication channels are common during significant events requiring alignment with government directives. Communication is typically triggered by a material incident, activation of a crisis plan, receipt of a government order or any event affecting safety, operations or public confidence. Communications or corporate‑affairs leads, supported by legal and senior management, are usually responsible for these interactions.

Internal crisis communication is handled through a centralised channel managed by the crisis‑management team to ensure rapid, verified updates. The first stakeholders informed are senior management, operations leads, legal teams and communications teams, as they must activate response actions and co-ordinate with government authorities.

Effective public communication relies on clear, timely and centralised messaging, usually delivered through a designated communications lead. Companies prioritise factual updates and co-ordination with government authorities. Consistency is maintained through single‑point approval, close co-ordination between communications and legal teams, and controlled release channels. Key challenges include rapid information spread and maintaining accuracy under time pressure.

Companies typically communicate with investors and shareholders when the crisis is material, affects financial performance, or creates potential litigation exposure. Updates are usually delivered through formal statements, briefings or regulated disclosures, with legal teams ensuring accuracy. To maintain investor confidence, companies prioritise transparent communication, evidence of active risk management, and clear explanations of steps taken to stabilise operations and comply with government requirements.

Companies maintain customer trust by providing clear, timely and factual updates through controlled communication channels. Common communication methods include website updates, email or SMS alerts, social media announcements, call‑centre briefings and, where relevant, direct co-ordination with local authorities.

Employees are informed through centralised internal channels such as email alerts, messaging platforms, or briefings issued by the crisis‑management team. Priority is placed on explaining safety measures and operational changes. To maintain morale and productivity, companies commonly provide clear instructions, regular updates and support measures such as flexible work arrangements or welfare assistance.

Companies usually create dedicated communication channels for affected parties when an incident has direct community, customer or stakeholder impact, or when required by provincial disaster-management structures. Typical channels include hotlines, SMS or email alerts, social media announcements, website updates, and co-ordination with local authorities.

Companies manage crises on social media through dedicated monitoring protocols and rapid-response procedures to track discussions, misinformation and public sentiment. Most use real-time monitoring tools, a central communications lead, and pre-approved messaging guidelines to ensure quick and consistent responses. Updates are co-ordinated with legal and senior management to ensure accuracy.

Companies increasingly use AI, big data and digital-platforms for monitoring, early detection and faster decision-making. AI-driven tools are used for real-time data analysis and risk monitoring, while big-data systems help aggregate information from multiple sources to support faster situational assessments. Social media and sentiment-analysis tools are also commonly used to track public reaction during high-impact events. These technologies are integrated into internal protocols through automated alert systems, data dashboards and centralised communication platforms.

The main legal risks include errors or bias in automated assessments that may lead to harm, safety failures or non‑compliance with statutory duties. Risks also arise when AI‑generated outputs conflict with government directives issued by provincial or national authorities, since companies remain legally responsible for following official instructions regardless of technological tools.

Companies usually conduct post‑crisis reviews through structured internal assessment led by the crisis‑management team with input from senior management, operations, legal, communications and safety functions. Lessons are documented in internal reports, updated procedures or revised training materials, and are shared through internal briefings or team debrief sessions. To embed improvements, companies update their crisis protocols, strengthen training, and adjust co-ordination processes with provincial and district authorities.

Companies usually update their policies and procedures based on post‑crisis findings that identify what worked, what failed and what requires improvement. As part of this process, the crisis‑management team and senior management revise internal protocols, training materials and communication procedures. In parallel, internal work instructions are routinely updated to ensure that they remain current and aligned with relevant standards as well as newly issued laws or regulatory requirements. Once revisions are completed, updated policies are shared through internal briefings or incorporated into refreshed operating guidelines.

Companies measure crisis‑management effectiveness by assessing response speed, operational continuity, co-ordination quality and clarity of communication. They also review how well internal teams complied with directions issued by provincial or national authorities during the event. There is no single public benchmark, but companies often refer to national disaster‑management plans and industry‑specific guidance, particularly where joint training or simulation exercises exist (such as oil‑spill preparedness programmes run by the Marine Department and private operators). They stay updated through government guidelines, technical agencies and external partners.

Baker McKenzie

195 One Bangkok Tower 4
30th-33rd Floors, Wireless Road
Lumphini, Pathum Wan
Bangkok 10330
Thailand

+66 2636 2000

+66 2636 2111

bangkok.info@bakermckenzie.com www.bakermckenzie.com
Author Business Card

Trends and Developments


Authors



Baker McKenzie is a leading global law firm with an integrated Bangkok office that offers comprehensive transactional, regulatory and dispute-related capabilities. The team combines international standards with local insight, advising multinational and domestic clients on complex matters across both contentious and non-contentious work. The firm manages multi-jurisdictional mandates and provides co-ordinated advice across its global platform. Its crisis management work involves lawyers from regulatory compliance, investigations, employment, data protection, corporate governance and disputes, supporting clients in high-pressure situations requiring rapid assessment of legal, operational and reputational risks. Recent matters include responses to industrial incidents, significant cyber-fraud events and regulatory inquiries in highly regulated sectors.

Introduction

In 2026, doing business in Thailand means operating in a climate where risks can evolve quickly and sometimes overlap in ways that are hard to predict. A company might face a data breach and regulatory scrutiny at the same time, or deal with a flood that disrupts its supply chain, affects employee safety and creates reputational pressure on social media. These situations feel different from ordinary operational issues because they can escalate quickly, attract public attention, and lead to legal and financial consequences in a short period.

A crisis is defined not only by the incident itself but also by the potential impact on trust, reputation, business continuity and financial performance, and by whether it requires an urgent and co-ordinated response. In Thailand, many crises quickly become public events because information spreads rapidly through social media and informal online channels, and because regulators, employees and communities expect companies to respond with speed, clarity and responsibility.

Although not every crisis can be prevented, most can be anticipated and planned for. Effective preparation involves understanding what could go wrong based on the nature of the business, where it operates, its dependencies and the regulatory framework, and then developing a plan that is tested and workable under pressure. Thailand’s national disaster management framework emphasises risk reduction, integrated emergency management, and co-ordination across multiple parties, which mirrors what companies need to implement internally.

This section outlines key crisis management trends and developments currently relevant in Thailand. The focus is on public-facing risk and reputation – how crises are perceived and judged by customers, employees, regulators, investors and communities – rather than purely technical business continuity planning.

Leading Crisis Management Trends and Developments in Thailand

The speed of information is now part of the crisis

One of the most significant changes affecting crisis management in Thailand is the pace at which information moves online. During major incidents – whether a building collapse, a transport accident, an oil spill, a cyber-attack or a severe flood – photos, videos and speculation often spread before a company has confirmed the facts. If the company remains silent for too long, the public may assume that the company is withholding information or avoiding responsibility, or is not in control.

This is not only a communications issue. Once misinformation takes hold, it can affect employee morale, customer behaviour, regulatory scrutiny and even litigation strategy. As a result, many organisations are adopting continuous monitoring of social media and online platforms, together with clear internal processes for issuing timely updates through official channels. The objective is not to over‑commit but to provide factual information and demonstrate that the organisation is managing the situation responsibly.

In practice, crisis communication in Thailand increasingly requires pre‑approved templates, escalation workflows and clear response protocols so that teams are not drafting key messages from scratch during an incident. This is particularly crucial for high‑impact events such as fires, building collapses or environmental incidents, where public sentiment is heightened and stakeholders expect immediate empathy and tangible assistance. At the same time, given that any public communication may affect ongoing or potential legal proceedings, organisations must prepare messages with great caution. Effective crisis communication therefore requires carefully balancing situation management with the need to avoid prejudicing the company’s legal position – ensuring that responses are timely, responsible and legally sound.

Cyber-incidents are rising, and are no longer “just IT issues”

Cyber-incidents in Thailand have become more frequent and more disruptive, and public reporting suggests that organisations continue to face high volumes of phishing, banking malware and ransomware attacks. When these incidents occur, the initial facts are often incomplete: companies may not know the full scope of the intrusion, the attacker’s identity, or whether personal data has been accessed. This uncertainty creates a difficult environment where both legal obligations and public expectations may arise before the organisation has full visibility of the situation.

Threat actors are also using more sophisticated tactics, including AI‑enabled. These include more convincing impersonation attempts targeting finance teams, executives or customer-facing staff, which increases the risk of fraudulent payments and data disclosure. As a result, crisis readiness now requires verification procedures for transactions, staff training on social engineering, and rapid co-ordination between IT, legal and communications teams.

Many businesses also underestimate how quickly a cyber-incident can become a reputational crisis. Service disruptions have immediate customer impact, and data breaches raise questions about trust and accountability. Because regulators and the public in Thailand are increasingly aware of data protection and cybersecurity rules, the response now requires not only technical containment but also a clear and credible explanation of what occurred, the steps being taken to manage the incident, and how affected individuals will be supported.

Oil spills and coastal pollution: strong public emotion, complex multi‑agency response and long reputational tail

Oil spills are a clear example of how a physical incident can quickly escalate into a reputational crisis in Thailand. Public reporting highlights that Thailand has experienced several major oil spills in recent years. These events remain a recurring concern for coastal communities, fishers, tourism operators and regulators.

Oil spill crises tend to escalate because they are highly visible and emotionally charged. Images of polluted beaches or affected marine life spread quickly and can erode trust. These incidents also engage multiple stakeholders at once – local residents, tourism operators, fishers, regulators, NGOs and the broader public – each with different concerns. In these situations, technical clean-up is only one part of the response. Public credibility depends heavily on early transparency, clear responsibility and practical support for affected communities.

Thailand’s preparedness efforts also show a clear trend. Government agencies and industry have conducted training and workshops on oil spill response, including incident command systems and co-ordinated simulation exercises, reflecting the importance of planning and multi‑party co-ordination.

For businesses in energy, petrochemicals, logistics or coastal operations, the crisis management lesson is that public trust is shaped not only by the clean-up process but by actions taken in the first days. This includes how quickly the event is acknowledged, how clearly risks are communicated to the public, how the company works with authorities and how affected communities are treated. The reputational impact can continue long after the physical clean-up concludes – particularly with investigations, lawsuits or compensation processes that follow.

Building collapses and construction accidents: rising scrutiny, safety expectations and “licence to operate” risk

Thailand has recently seen heightened attention on construction safety following a series of high‑profile incidents, including reports of crane collapses and a major building collapse that resulted in significant loss of life. Public reporting has noted public reaction, increased scrutiny and government responses ranging from contract termination and blacklisting to broader discussions about enforcement and systemic safety gaps.

These developments matter well beyond the construction sector. When a building collapses or a major site accident occurs, the crisis often becomes a broader story about governance, standards and accountability. The public tends to ask whether corners were cut, whether safety warnings were ignored and whether regulators are enforcing existing rules. These are reputational concerns rather than purely technical questions, and they can affect lenders, partners, insurers and the approvals needed for future projects.

Large workplace incidents also draw attention to migrant labour conditions and contractor oversight, which can create additional reputational exposure for companies with international profiles. Public reporting on a recent Bangkok construction collapse highlighted the involvement of foreign national workers among the fatalities and the scale of the incident, illustrating how quickly a construction accident can become a national – and even international – story.

From a crisis-management perspective, these trends push companies towards stronger contractor management, more visible safety culture and a well-rehearsed “first hour” response: securing the site, co-ordinating with emergency services, supporting victims and families, and communicating responsibly without speculation. They also reinforce the need for a clear internal chain of command and designated spokespeople, as inconsistent messaging during a fatal incident can severely damage trust.

Floods and climate events: recurring disruption and greater expectation of preparedness

Thailand is widely recognised as being exposed to multiple natural hazards, with flooding among the most frequent and disruptive, and climate change continues to intensify these risks. National disaster‑management guidance stresses the importance of preparedness, early-warning systems and co-ordination across government levels. This was demonstrated most recently by the severe flooding that struck Southern Thailand in November to December 2025, particularly affecting Songkhla, Hat Yai, Nakhon Si Thammarat, Surat Thani, Phatthalung, Trang, Satun, Pattani, Yala and Narathiwat. Reporting noted widespread inundation, with water levels reaching up to two metres in some areas, causing large‑scale evacuations, transport disruptions, hospital evacuations and the near‑total submergence of parts of Hat Yai. Millions of people were affected across multiple provinces, with estimated daily business and tourism losses of approximately THB1 billion to THB1.5 billion. The Thai government declared emergency zones and deployed military assets, high‑clearance vehicles, water pumps, helicopters and relief teams throughout the region.

These events highlight how environmental crises in Thailand can rapidly disrupt business operations by restricting transport routes, limiting workforce mobility, damaging commercial facilities, and creating expectations for companies to protect employees and support local communities. They also show how quickly these events can become reputational issues when companies appear unprepared or slow to respond.

Thailand’s updated National Disaster Prevention and Mitigation Plan continues to emphasise national resilience, risk reduction and integrated emergency response. For businesses, this reinforces how extreme weather and flooding should not be treated as unexpected anomalies but as foreseeable risks that require documented readiness, tested protocols and proactive communication strategies.

Emergency command structures and multi‑party co-ordination are becoming more important

A recurring theme across cyber-incidents, oil spills, construction accidents and floods is that no single team can manage a crisis in isolation. Thailand’s national disaster-management framework emphasises integrated emergency management and multi‑sectoral co-operation, including the activation of emergency operations centres depending on the severity of the event. This provides a useful model for the private sector: the most effective companies establish crisis structures that allow operations, legal, communications, HR and security teams to work together under a clear command hierarchy.

In the context of oil spill and emergency response readiness, industry and government training has placed significant emphasis on incident command systems and simulation exercises. The broader trend is that authorities and stakeholders in Thailand are becoming more sophisticated in their expectations regarding how organisations co-ordinate, communicate and make decisions during crises. A disorganised response can attract criticism even when the underlying incident was accidental.

The practical implication is that companies should identify a core crisis management team, assign roles clearly, train replacements and practice realistic scenarios. Crisis preparedness is not solely about having a written plan; it is about developing the operational discipline and muscle memory needed to make quicker and more consistent decisions under pressure.

Navigating the intersection of legal and communications functions

As crisis scenarios in Thailand become more complex, the alignment between legal strategy and public communication has become increasingly significant. Organisations must now respond to incidents in an environment where regulatory scrutiny, stakeholder expectations and real‑time information pressures converge. This creates a greater need to co-ordinate legal obligations with external messaging from the outset.

In practice, legal teams must ensure regulatory compliance, including timely reporting and evidence preservation, while communications teams must maintain public confidence through accurate, consistent and responsible disclosure. The challenge lies in balancing prudence with transparency. Premature or overly broad statements may create legal risk, while delayed or narrow communication can undermine trust and suggest a lack of control.

For this reason, effective crisis management now demands structured co-ordination between legal and communications functions, supported by clear protocols, unified decision‑making and pre‑agreed messaging frameworks. This integrated approach helps organisations respond quickly while protecting both regulatory compliance and reputational integrity. In contrast, misalignment between legal and communications responses can escalate the situation and prolong the recovery period.

Practical Best Practices (What Clients Should Do)

Build one crisis framework that covers both digital and physical incidents

Many companies in Thailand still separate their cyber-incident plan from their health, safety and environment plan, and treat both separately from their communications protocols. In practice, incidents often overlap. Cyber-incidents can disrupt customer services and trigger Personal Data Protection Act (PDPA) obligations. Physical incidents can involve employee data, third‑party vendors and reputational risks that require co-ordinated messaging. PDPA guidance and breach-notification expectations reinforce the need for structured investigation and documented decision-making, which are tasks that are more effectively managed within one integrated framework than across disconnected plans.

An integrated crisis framework typically includes a unified command structure, a severity rating system, defined escalation triggers, and an approvals workflow that enables rapid communication without compromising accuracy.

Make third‑party readiness part of crisis management

In Thailand, many crises involve contractors and suppliers. Oil spill response depends on shipping operators, port facilities and specialist clean-up vendors. Construction incidents often involve main contractors, subcontractors, engineers and multiple site operators. Cyber-incidents commonly involve cloud providers or outsourced IT. Ongoing policy discussions around oversight of third‑party service providers in cybersecurity contexts suggest a growing expectation that organisations should manage vendor risk more actively. Practical steps include:

  • reviewing contracts for incident co-operation clauses;
  • ensuring access to logs and evidence during cyber-incidents;
  • confirming emergency responsibilities in high‑risk operations; and
  • requiring contractors to participate in drills.

Practice crisis response through drills and simulations

Thailand’s oil spill preparedness framework relies heavily on training and simulation exercises, reflecting a broader principle: crisis response skills improve through practice. Companies can adopt similar approaches by running tabletop simulation exercises for scenarios such as ransomware, warehouse fires, structural failures or community-affecting spills.

Exercises should test decision-making under uncertainty, not only ideal scenarios. They should also involve legal and communications teams, which are often sources of delay when approval processes are unclear.

Communicate with empathy, not only with legal caution

Crises involving injury, death or environmental damage often generate intense public expectations around empathy and accountability in Thailand. Reporting on oil spills illustrates that communities are concerned about livelihood impacts, environmental recovery and long-term consequences, and these concerns require visible support and clear explanations.

This does not mean admitting fault before investigations conclude. It means acknowledging harm, prioritising safety, co-operating with authorities, and communicating in a human and responsible manner. Organisations that manage this well tend to preserve trust even when the underlying incident is serious.

Strengthening internal controls and compliance to meet rising regulatory expectations

In view of the increasing regulatory scrutiny across industries, businesses should regularly review and update their internal work instructions to ensure that their operational standards remain aligned with evolving legal requirements. In certain sectors, it is advisable to conduct periodic drills or internal audits to reinforce established procedures and maintain a cycle of continuous improvement. Strengthening compliance frameworks and adhering to professional standards are critical, as these factors often form the basis for assessing whether a company has acted prudently in the event of an incident. When investigations arise, companies must be able to clearly explain their processes and demonstrate that appropriate measures were in place. Organisations with well‑maintained, transparent and consistently followed protocols are better positioned to present a clean, defensible narrative and mitigate unnecessary risks.

Conclusion

Crisis management in Thailand today is shaped by two simple realities. First, the range of risks affecting companies has expanded. Businesses must be ready for digital issues such as cyber-incidents as well as real‑world emergencies such as oil spills, building collapses, industrial accidents, fires and major floods. These events can cause rapid disruption because information spreads instantly online, and stakeholders expect organisations to act quickly and demonstrate control.

Second, Thailand’s regulatory expectations are becoming more structured. New cybersecurity standards taking effect in 2025 and the national disaster‑management framework reflect a clear direction: organisations are expected to be more prepared, co-ordinated and organised. This includes having documented procedures, trained teams and established protocols before an incident occurs.

For companies, the message is straightforward: crisis readiness is an ongoing process, not a one-time task. It requires engaging the right people, developing practical action plans, conducting regular drills, ensuring that contractors and partners can respond effectively, and communicating with honesty and empathy when incidents occur. Organisations that invest in these capabilities are better positioned to maintain trust, limit disruption and recover more quickly when crises arise.

Baker McKenzie

195 One Bangkok Tower 4
30th-33rd Floors, Wireless Road
Lumphini, Pathum Wan
Bangkok 10330
Thailand

+66 2636 2000

+66 2636 2111

bangkok.info@bakermckenzie.com www.bakermckenzie.com
Author Business Card

Law and Practice

Authors



Baker McKenzie is a leading global law firm with an integrated Bangkok office that offers comprehensive transactional, regulatory and dispute-related capabilities. The team combines international standards with local insight, advising multinational and domestic clients on complex matters across both contentious and non-contentious work. The firm manages multi-jurisdictional mandates and provides co-ordinated advice across its global platform. Its crisis management work involves lawyers from regulatory compliance, investigations, employment, data protection, corporate governance and disputes, supporting clients in high-pressure situations requiring rapid assessment of legal, operational and reputational risks. Recent matters include responses to industrial incidents, significant cyber-fraud events and regulatory inquiries in highly regulated sectors.

Trends and Developments

Authors



Baker McKenzie is a leading global law firm with an integrated Bangkok office that offers comprehensive transactional, regulatory and dispute-related capabilities. The team combines international standards with local insight, advising multinational and domestic clients on complex matters across both contentious and non-contentious work. The firm manages multi-jurisdictional mandates and provides co-ordinated advice across its global platform. Its crisis management work involves lawyers from regulatory compliance, investigations, employment, data protection, corporate governance and disputes, supporting clients in high-pressure situations requiring rapid assessment of legal, operational and reputational risks. Recent matters include responses to industrial incidents, significant cyber-fraud events and regulatory inquiries in highly regulated sectors.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.