What should a Cyber Incident Response Retainer Agreement include under Thai law?

1. Definitions and Interpretation
2. Retainer and Scope of Services
3. Term and Renewal
4. Onboarding and Readiness
5. Reporting an Incident and Severity Levels
6. Response Times
7. Client Cooperation and Authority
8. Evidence and Chain of Custody
9. Notifications to Authorities and Affected Persons
10. Ransomware and Extortion
11. Insurers, Advisers and Communications
12. Personal Data
13. Tools and AI
14. Fees, Prepaid Hours and Expenses
15. Taxes
16. Confidentiality
17. Reports and Intellectual Property
18. Warranties and Outcomes
19. Liability
20. Force Majeure
21. Termination
22. Notices
23. Governing Law and Disputes
24. General

• Finish onboarding within 30 days (Clause 4.1): give the Responder the environment overview, the authorised incident contacts and the way it will get emergency remote access. A retainer without onboarding saves little time on the night of an attack.
• Put the Responder's hotline (…) in your incident response plan, print it and keep it outside your IT systems. If email and chat are encrypted by ransomware, you will still need to reach the team.
• Keep the logs and backups the Responder recommends (Clause 4.3). An investigation can only show what the Evidence shows.
• Keep Schedule 1 current. Tell the Responder when contacts, cloud providers or key systems change (Clause 4.2).
• Pre-approved containment is switched on (Clause 7.4). Review the list of actions with your IT team and keep it narrow; everything else still needs a decision from your authorised contact.
• Book the annual tabletop exercise early in each Retainer Year (Clause 4.4). It tests the plan, the contacts and the decision-makers, not only the technology.

• Call the hotline and send the email (Clause 5.1). Do not wipe or rebuild affected machines before the Responder advises, because that destroys Evidence.
• Personal data breach: as data controller you must notify the Personal Data Protection Committee Office without delay and, where feasible, within 72 hours after becoming aware of a breach, unless the breach poses no risk to individuals' rights and freedoms, and must also tell affected individuals where the risk is high (Personal Data Protection Act section 37(4)). The PDPC's notification rules list what the notice must contain; the Responder is obliged to give you those facts in time (Clause 9.2). If you cannot notify within 72 hours for a necessary reason, the rules allow you to explain the delay to the Office, but no later than 15 days after becoming aware.
• If you are, or serve, a critical information infrastructure organisation under Thailand's cybersecurity law, or you are regulated by a sector regulator, you may have a separate duty to report cyber threats to that regulator and the national cybersecurity authority. Record those duties in onboarding (Clause 9.3).
• Notify your cyber insurer within the time in your policy, and check whether the insurer must approve the Responder before costs are incurred (Clause 11.1).
• Consider reporting to the police. A police report is often needed for insurance and for pursuing the attacker.
• Do not pay a ransom without legal advice. A payment may breach anti-money laundering or sanctions laws and does not guarantee recovery; the Responder will not negotiate or pay without your written instruction (Clause 10).
• Beware of fake payment instructions during an incident. Confirm any change of bank account by telephone (Clause 14.5).

• Evidence belongs to you. The Responder keeps a chain-of-custody record and hashes (Clause 8.1). If a lawsuit, insurance claim or regulatory inquiry is likely, instruct the Responder in writing to keep the Evidence beyond 90 days (Clause 8.2).
• Evidence and reports may be needed in a Thai court or by a regulator in Thai. Budget for certified translation of key reports.

• The Retainer Fees pay for availability and … Prepaid Hours each Retainer Year, whether or not an incident happens (Clause 14.1). Use unused hours during the year for readiness work such as a compromise assessment or playbook review; they expire at year end (Clause 14.3).Unused hours roll over once into the next year if the Agreement is renewed (Clause 14.3).Unused hours expire at year end without refund (Clause 14.3).
• The Agreement renews every 12 months unless notice of non-renewal is received at least … days before the end of the current period (Clause 3.2).- The Agreement ends at the end of the Initial Term. Sign a renewal before then so that you are never without a team (Clause 3.2).

• An incident response retainer is a hire of work (Instrument 4 of the Stamp Duty Schedule), and the Responder pays the duty (Clause 15.3): 1 THB for every 1,000 THB or part of 1,000 THB of the fees. On the Contract Value you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the fees are in …, convert the Contract Value to Thai Baht at the exchange rate on the date of signing and calculate the duty on the Baht amount. Additional duty is payable if the fees actually received, including hourly charges, exceed the Contract Value. If signed electronically, pay through the Revenue Department's e-Stamp Duty system within 15 days after signing. An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid.
• A Thai company paying a Thai responder normally withholds 3% of service fees and issues a certificate. For a responder abroad, Thai withholding tax on fees paid overseas and self-assessed VAT may apply; take accounting advice before the first payment, especially because you ticked gross-up.

• A company signs through the directors shown in its company affidavit, with the company seal if required. Electronic signatures and signed PDF copies are allowed (Clause 24.9).
• A Thai court works in Thai, so a Party relying on this Agreement in court must file a certified Thai translation.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-0BABD5. If you reuse this content, please credit the author and link to the original.