What should a Data Processing Agreement (DPA) include under Thai law?

1. Definitions and Interpretation
2. Roles, Scope and Precedence
3. Controller's Obligations and Instructions
4. Processor's Obligations
5. Security of Processing
6. Personal Data Breach
7. Sub-processors
8. AI Tools
9. Transfers Outside Thailand
10. Data Subject Requests and Assistance
11. Audits and Information
12. Return and Deletion
13. Liability
14. Term and Termination
15. Notices and Contacts
16. Governing Law and Disputes
17. General

• Under section 40 of the Personal Data Protection Act (PDPA), a data controller that lets a service provider process personal data on its behalf must put in place an agreement that controls how the processor performs its duties. Without it, the controller cannot show that it has taken steps to prevent the processor from using or disclosing the data without authority (section 37(2)), and a controller that fails its duties under section 37 may face an administrative fine of up to 3 million THB (section 83). A processor that fails its own duties under section 40 may face the same maximum (section 86).
• This DPA is written to attach to any main agreement: a service contract, an accepted quotation or a provider's online terms. Keep a copy of the Principal Agreement named in Annex 1 with this DPA, because the two documents are read together (Clause 2.2).
• If the service provider also uses the data for its own purposes, it is not a processor but a second controller. Use a data sharing agreement instead, and check that you have a lawful basis to disclose the data to it.

• Sign this DPA before any personal data is sent. Clause 2.2 also covers processing that already happened under the Principal Agreement, but it does not cure a period without any agreement.
• Check that your privacy notice tells data subjects that their data may be disclosed to service providers (PDPA section 23) and that you have a lawful basis for the processing (sections 24 and 26). These are the Controller's promises in Clause 3.1.
• You ticked sensitive personal data. You must have the data subjects' explicit consent or a specific exception under section 26 of the PDPA, and the Processor must apply the extra safeguards in Clause 5.4 from the first day.
• Update your record of processing activities (section 39) to show this Processor, the data it receives and the countries in Annex 1.

• The Controller must notify the Office of the Personal Data Protection Committee within 72 hours after becoming aware of a breach, unless the breach poses no risk to individuals, and must also notify affected individuals without delay if the risk is high (PDPA section 37(4)). The Committee's notification on breach reporting (2022) requires the Processor to tell the Controller within 72 hours as well; this DPA sets … hours (Clause 6.1) so that you have time to assess the breach.
• Put both breach contacts in Clause 15.2 on a list that your team can reach outside office hours. Weekends and holidays count towards the 72 hours.
• The Processor may not notify the regulator or the public on your behalf without your approval (Clause 6.4). The decision to notify, and the notification itself, remain yours.

• The Processor may add sub-processors after giving … days' notice. Read each notice: if you do not object in time, the new sub-processor is treated as approved (Clause 7.1).- The Processor needs your written consent for each new sub-processor (Clause 7.1). Reply to each request within 15 days.
• Whatever AI option you chose, the Processor may never use your personal data to train AI models used by others, and automated decisions with significant effects on individuals need human review (Clause 8).
• A server abroad, a backup abroad, or a support team that logs in from abroad is a transfer of personal data outside Thailand. It is lawful only if the destination has adequate protection under the Committee's criteria (section 28), one of the exceptions in section 28 applies, or appropriate safeguards are in place under section 29, usually a written agreement with the recipient in the form the Committee requires (Clause 9.2). Ask the Processor for a copy of its safeguards.
• Because the GDPR may also apply, check whether the data comes from the European Economic Area. Transfers out of the EEA need the European Commission's standard contractual clauses or another GDPR transfer tool, signed separately (Clause 9.5).
• A controller established outside Thailand that offers goods or services to people in Thailand, or monitors their behaviour, falls under the PDPA (section 5) and may need to appoint a representative in Thailand (section 37(5)).

• Ask for the Processor's security evidence once a year: certifications, penetration test summaries and the list of sub-processors (Clause 11). Keep what you receive; it shows that you took the steps required by section 37(2) of the PDPA to prevent misuse by the recipient of your data.
• When the service ends, choose in writing whether you want the data returned, deleted or both, and ask for the certificate of deletion (Clause 12.3). Backups must be deleted within 90 days after that (Clause 12.2).
• A data subject can claim compensation from the Controller or the Processor, a court may add punitive damages of up to twice the actual damage, and the claim is time-barred 3 years after the data subject learns of the damage and the party liable, or 10 years after the breach (PDPA sections 77 and 78). Keep this DPA and the related records for at least that long.

• The liability caps of the Principal Agreement also apply to this DPA (Clause 13.4). Many service contracts cap liability at a few months of fees, which is often far below the cost of a data breach. Check the cap before you sign.- This DPA has its own cap of … for each Party, in addition to any cap in the Principal Agreement (Clause 13.4).- Liability under this DPA is not capped, but loss of profit and indirect loss are still excluded (Clause 13.4). Expect a large provider to ask for a cap.
• No cap protects a Party for fraud, wilful misconduct, gross negligence, or a Processor that uses the data for its own purposes (Clause 13.5). Under Thai law an advance exclusion of liability for fraud or gross negligence is void in any case (Civil and Commercial Code section 373).

• This DPA is not an instrument listed in the Stamp Duty Schedule of the Revenue Code, and the Parties pay no separate fee for it, so no stamp duty is payable on it. The Principal Agreement carries its own stamp duty according to its type, for example 1 THB per 1,000 THB of the fees for a service contract.
• Each Party signs through its authorised director, as shown in its company affidavit or home registration document. Clause 17.6 allows electronic signatures and signed PDF copies. Keep the signed DPA with the Principal Agreement.
• A Thai court works in Thai, so a Party relying on this DPA in court must file a certified Thai translation.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-7BAAD8. If you reuse this content, please credit the author and link to the original.