Dr Peerapat Chokesuwattanaskul Speaks on Data Sovereignty at NBTC Symposium 2026

Image source: Office of the NBTC

On 9 October 2026, Dr Peerapat Chokesuwattanaskul, Senior Partner at VA Partners, spoke as a panellist in the session "Data Sovereignty in a Connected World: Securing Thailand's Digital Future" at NBTC Symposium 2026, organised by the Office of the National Broadcasting and Telecommunications Commission (Office of the NBTC) at the Dusit Thani Bangkok. The symposium ran on 8–9 October 2026 under the theme "Beyond Volatility: Harnessing Resilience Through Dialogue". He spoke alongside speakers from government and the telecommunications industry.

Across three rounds, he addressed what data sovereignty means, where control over data actually sits, and which rules Thailand should adjust first. He began with the concept of sovereignty itself and set out three elements against which a policy can be tested: authority, meaning whose law applies; control, meaning whether that law can be enforced in practice; and independence, meaning whether anyone outside can stop a service, and whether the country can move elsewhere. Keeping data inside the country, he argued, does not by itself secure all three, because another state's law can reach a provider through the company rather than the server, and a service can be suspended by a decision taken elsewhere.

The Data Sovereignty in a Connected World panel, 9 October 2026. Image source: Office of the NBTC

He then distinguished access control, which decides who can reach data, from usage control, which decides what may be done with it once reached: how long it is kept, who it is passed to and whether it may be used to train AI models. Where data has to move across borders, he suggested, sovereignty depends mainly on usage control, exercised through law that travels with the data, contract terms and encryption keys held by the customer. A mid-sized economy gains leverage when global providers need its market and when it keeps credible alternatives, but that leverage weakens once its systems are tied to a single provider.

In the round on regulatory trust, he proposed one priority: shifting the basis of data rules from nationality and location to risk and conditions of use, through a single data classification shared by the relevant laws. He linked this to three further steps: conditional access to data for AI development; terms on customer-held keys, notice before suspension and exit in public-sector cloud and AI contracts; and, for services supplied to government and critical infrastructure, incentives tied to continuity of service and the ability to move.

Panel participants, Session 7. Image source: Office of the NBTC

VA Partners works on these questions through its AI Governance & Investigations practice.