Supplier ESG data that you can actually use starts with a small group of critical suppliers. Ask for energy, fuel and a few social figures, fix the unit, period and evidence for each one, and store the answers next to your purchasing records in the ERP. FTSE Russell looks for real requirements and a working data mechanism, not just a supplier policy.
This guide is for sustainability, procurement, finance and company secretary teams at SET-listed companies who need to start asking suppliers for data without sending a long questionnaire that suppliers cannot finish. We read the relevant documents from SET, the GHG Protocol, TGO and the Thai Personal Data Protection Act on 12 October 2026 and turned them into steps you can follow.
If you want to see where supplier data sits in the wider data foundation first, read layer 3, the supply chain, in our seven-layer ESG data foundation article.
Why supplier data became urgent in 2026
The assessment has moved to FTSE Russell ESG Scores, which use only what a company publishes, and SET's own documents name the supply chain as a weak area.
From 2026, SET uses FTSE Russell ESG Scores in place of the SET ESG Ratings questionnaire, which ran for the last time in 2025. FTSE Russell does not send a questionnaire. It reads the annual report or One Report, the sustainability report and the company website. If your supplier work is not in those documents, there is nothing to score. The switch is covered in our guide to preparing data as SET ESG Ratings becomes FTSE Russell.
Three points we confirmed in official documents:
- SET's FAQ (information as of March 2026), item 25, says supply chain indicators check whether the company sets ESG requirements for suppliers and has a concrete mechanism to track or collect environmental impact data. A supplier workshop counts when it helps suppliers comply and report, not when it only communicates a policy.
- The SET ESG Ratings 2025 results deck (12 December 2025) says many companies had not identified critical suppliers they do not trade with directly (Critical Non-Tier 1), or confused them with ordinary suppliers. Many only said suppliers fill in a self-assessment and did not disclose the supplier risk results. The same deck lists Scope 3 disclosure as an area to improve.
- The Thai-language FTSE Russell ESG Scores guideline lists Supply Chain: Environmental and Supply Chain: Social among its 14 themes. Themes apply by subsector, so check which ones your subsector is assessed on.
What to ask suppliers for first
Start with data suppliers already have on their own bills: electricity, fuel, and a few social totals.
The reason comes from the GHG Protocol Scope 3 Calculation Guidance. For purchased goods and services (Category 1) it describes four methods: supplier-specific, hybrid, average-data and spend-based. The hybrid method uses Scope 1 and 2 emissions that suppliers allocate to you, or supplier activity data such as fuel and electricity use, and fills gaps with secondary data. Supplier energy data is therefore a realistic first step. For suppliers who cannot give you anything yet, a spend-based estimate from purchase value works in the meantime.
| Data group |
What to ask |
Unit |
Evidence |
| Electricity |
Electricity used at the plant or site that makes your goods |
kWh per month |
Electricity bills |
| Fuel |
Diesel, petrol, LPG, natural gas, by type |
Litres or kg, stated |
Tax invoices or receipts |
| Your share |
Share of output or sales that goes to your company |
% |
Short note on the method |
| Workforce |
Total headcount, number of lost-time injuries |
People, cases |
No names needed |
| Requirements |
Acknowledgement of the supplier code of conduct |
Yes or no |
Signed document |
The share column is the one people forget. If the supplier's plant serves several customers, you need to know which part is yours, or the figure will be overstated.
How to design the data request
A good request fixes the unit, period, scope and evidence in advance, so suppliers do not have to guess and you do not have to fix answers later.
- Fix the unit in the form. TGO's January 2026 emission factor list gives LPG factors both per litre and per kilogram, and the per-kilogram figure is almost twice as high. If a supplier enters a number without a unit, you can apply the wrong factor straight away.
- Match the period to your reporting year, for example January to December, and ask for monthly figures where possible. A single annual total is hard to check.
- Ask the supplier to say which plant or site the figures come from.
- Ask for evidence per figure, not per form. When the assurance provider asks, you can point to the bill behind each number.
- Add a field that says whether a figure is measured or estimated. Estimates are fine, but you need to know which ones they are.
- Write it in Thai, or in a language the supplier reads easily, and keep it short enough to finish in one sitting.
Keep the form the same every year. If the questions change every cycle, you cannot compare years and suppliers have to start again each time.
Where the PDPA comes in
Most supplier data is about companies, but the PDPA applies as soon as names, phone numbers or details about people at the supplier are included.
Points from the Personal Data Protection Act B.E. 2562 (2019):
- Section 22 limits collection to what is necessary for a lawful purpose. If the indicator only needs the number of injuries, do not ask for the names of injured workers.
- Section 23 requires telling data subjects the purpose and details of collection, for example the supplier contact who fills in the form.
- Section 24 sets out bases for collecting without consent, such as performance of a contract or legitimate interest. Your DPO or legal team should decide which basis applies.
- Section 25 bars collecting personal data from a source other than the data subject, unless the person is notified within 30 days and gives consent, or an exception under Section 24 or 26 applies. Data about a supplier's employees sent to you by the supplier falls into this case.
- Section 26 treats health data, criminal records and trade union data as sensitive, needing explicit consent unless an exception applies.
The simplest approach is to design the request so you never collect personal data in the first place. Ask for totals, keep only the name and contact details of the supplier's coordinator, and restrict who can open evidence files, since some receipts carry personal names. We cover access rights and evidence handling of this kind in our article on running ESG on PrivacyHub.
How to store supplier data in the ERP so it can be reused
Keep supplier ESG data on the same supplier record that procurement uses, and link it to purchase history, so it does not disappear into one person's spreadsheet.
Each entry should hold:
- Which supplier, which site and which period
- The figure, its unit, and whether it is measured or estimated
- The evidence file, the reviewer, the review date and a status such as waiting, under review or accepted
- The supplier's tier, such as critical Tier 1 or general, plus any Critical Non-Tier 1 suppliers identified in your analysis
Linking to purchase history matters because spend tells you which suppliers are critical, and it is the basis for a spend-based estimate for suppliers who have not sent data. If you use Odoo, the standard ESG app can assign emission factors to journal items by product, partner or account, and the product's unit of measure must match the factor's unit. Details are in our Odoo ESG app article. For choosing a system overall, see our guide to selecting ESG software.
The same data then feeds the One Report, the sustainability report and SET's ESG Data Platform without asking suppliers again each time.
A phased plan
Work in three phases, with the first small enough to finish within one reporting cycle.
| Phase |
What to do |
Result |
| 1. Start |
Pull the supplier list from purchase data, choose the first group of critical suppliers, send the code of conduct and the energy and fuel form |
A ranked supplier register and a first set of energy data with evidence |
| 2. Expand |
Add social totals, assess risk for each supplier group, run workshops for suppliers who cannot report yet |
Supplier risk results you can disclose and data for the hybrid method |
| 3. Annual cycle |
Analyse the chain to identify Critical Non-Tier 1 suppliers, disclose requirements, mechanisms and results in the One Report |
Supplier reporting an assessor can read from public documents |
Along the way, your own Scope 1 and 2 still need to be solid first, since those are the figures that need assurance. See our article on IFRS S2 Scope 1 and 2 readiness for SET50 companies.
Frequently asked questions
Do we need ESG data from every supplier?
No. Start with critical suppliers by spend or risk. Assessors want to see requirements, a tracking mechanism and results you can disclose, not the number of questionnaires sent.
What is a Critical Non-Tier 1 supplier?
A critical supplier you do not buy from directly, such as a raw material producer that sells to your supplier. SET's 2025 results say many companies have not identified this group yet.
Can we calculate Scope 3 if suppliers have no carbon data?
Yes. The GHG Protocol spend-based method multiplies purchase value by average emission factors. Use it as a starting point and switch to supplier data once suppliers can send energy and fuel figures.
Can we ask suppliers for the names of injured workers?
You should not. Most indicators only need totals. Health data is sensitive under Section 26 of the PDPA, and receiving personal data from a supplier has conditions under Section 25.
Where should we disclose supplier work so FTSE Russell sees it?
SET's FAQ says in the One Report, the sustainability report or other public channels, because FTSE Russell only uses publicly disclosed information.
What Enersys does
Enersys is a Bangkok software house that has built business software since 2012. We are an Official Odoo Silver Partner and the winner of the Odoo Awards 2026 Best Starter APAC. 2026 is our second year working with Odoo.
For ESG, we build custom ESG modules on Odoo for Thai listed companies, scoped to each company's indicators, source systems, approvals and report format. We run monthly data cycles on PrivacyHub's governance base of role-based access, workflow status, evidence and audit history, build KPI dashboards mapped to the 56-1 One Report or GRI with links back to source documents, and handle employee data under the PDPA.
See the Enersys ESG page. If you want to design your first supplier data request together, contact the Enersys team.
Sources
- FAQ FTSE Russell ESG Scores and Index 2569, The Stock Exchange of Thailand (accessed 12 Oct 2026)
- SET ESG Ratings 2568 results announcement, The Stock Exchange of Thailand (accessed 12 Oct 2026)
- The Guideline to FTSE Russell ESG Scores (Thai edition), The Stock Exchange of Thailand (accessed 12 Oct 2026)
- FTSE Russell ESG Scores assessment process, The Stock Exchange of Thailand (accessed 12 Oct 2026)
- Scope 3 Calculation Guidance, GHG Protocol (accessed 12 Oct 2026)
- Corporate Value Chain (Scope 3) Standard, GHG Protocol (accessed 12 Oct 2026)
- Emission Factor (CFO), Thailand Greenhouse Gas Management Organization (accessed 12 Oct 2026)
- Personal Data Protection Act B.E. 2562 (2019), Royal Thai Government Gazette (accessed 12 Oct 2026)
- ESG, Odoo saas-19.4 Documentation, Odoo S.A. (accessed 12 Oct 2026)
