What should a Data Sharing Agreement include under Thai law?

1. Definitions and Interpretation
2. Roles of the Parties
3. Allocation of Joint Controller Responsibilities
4. Discloser's Obligations
5. Recipient's Obligations
6. Security
7. Data Subject Rights
8. Personal Data Breach
9. Transfers Outside Thailand
10. Records, Review and Assurance
11. Term and Termination
12. Liability
13. Confidentiality
14. Contacts and Notices
15. Governing Law and Disputes
16. General

• In this Agreement each Party uses the shared personal data for its own business, and the Parties decide the purposes and means of the processing together. If one Party only processes data on the other's instructions, for example as a cloud, payroll or mailing service, it is a data processor, and you need a data processing agreement under section 40 of the Personal Data Protection Act (PDPA) instead (Clause 2.2).
• The PDPA does not have a separate chapter on joint controllers. The allocation in the clause headed "Allocation of Joint Controller Responsibilities" binds the Parties to each other, but a data subject may still exercise rights and claim compensation against either Party.
• No money is paid for the Shared Data (Clause 2.3). If one Party pays for access to a customer database, treat it as a sale of personal data, which needs specific consent and carries high legal and reputational risk.

• Discloser: check that your privacy notice names this kind of recipient and purpose (PDPA section 23) and that you have a lawful basis or consent to disclose (sections 24, 26 and 27). If you have not told customers, update the notice or obtain consent before sharing. The Discloser gives these promises in Clause 4.1.
• Recipient: personal data received from another organisation is collected from a source other than the data subjects. Under section 25 the Recipient must either notify the data subjects of that collection without delay and within 30 days and obtain their consent, or rely on an exemption from consent under section 24 or 26 and still give them the section 23 information, unless they already know it (Clause 5.2). Plan who sends that notice and how.
• The Shared Data includes sensitive personal data. Explicit consent or a specific exception under section 26 of the PDPA is required for both the disclosure and the Recipient's use.
• Both Parties should record the sharing in their records of processing activities (section 39) and keep the disclosure log required by Clause 10.1.

• The Recipient may send its own marketing only to people whose consent covers marketing by the Recipient, and must stop within 3 Business Days after an objection or withdrawal (Clause 5.5). Pass on every objection you receive to the other Party within … Business Days.- The Recipient may not use the Shared Data for its own marketing (Clause 5.5). If a joint campaign is planned later, amend this Agreement and check the consents first.
• The Recipient may use the Shared Data to develop AI tools only within the Agreed Purpose, with data minimised and pseudonymised first, and must not release models from which the data could be extracted (Clause 5.6).- The Recipient may not use the Shared Data to train AI models or put it into AI tools that learn from user input (Clause 5.6). This includes free online chat tools.

• Each Party must notify the Office of the Personal Data Protection Committee of a breach within 72 hours after becoming aware of it, unless the breach poses no risk to individuals (PDPA section 37(4)). This Agreement does not shift that duty; it only requires each Party to warn the other within … hours (Clause 8.2).
• A data subject may ask either Party for access, correction or deletion. Answer requests about the data you hold within the legal time limit (30 days for access requests under section 30) and forward the rest within … Business Days (Clause 7.2).

• The Recipient may not send the Shared Data abroad or let anyone access it from abroad without the Discloser's written consent (Clause 9.1). Cloud storage abroad counts as a transfer.- Transfers to … are allowed only if the destination has adequate protection under the Personal Data Protection Committee's criteria, an exception in section 28 applies, or appropriate safeguards are in place under section 29, usually a written agreement with the recipient (Clause 9.2). Keep evidence of the mechanism used.

• Put the review date in your calendar: at least every … months (Clause 10.2). Stop sharing data fields that the purpose no longer needs.
• Either Party may end this Agreement on … days' notice (Clause 11.2), or suspend sharing at once after a serious breach or an order of the regulator (Clause 11.4).
• When the Agreement ends, the Recipient must delete the Shared Data within 30 days and confirm in writing, except data it may keep on its own lawful basis (Clause 11.5). Ask for the written confirmation.- When the Agreement ends, the Recipient may keep data already received until the end of the retention period, but must keep following Clauses 4 to 10 for it (Clause 11.5).

• A data subject may claim compensation, and a court may add punitive damages of up to twice the actual damage; the claim is time-barred 3 years after the data subject learns of the damage and the party liable, or 10 years after the breach (PDPA sections 77 and 78). Clause 12.1 decides how the Parties share that liability between themselves. Keep this Agreement and the disclosure log for at least that long.
• No stamp duty is payable on this Agreement: it is not an instrument listed in the Stamp Duty Schedule of the Revenue Code, and no fee is paid for the data.
• Each Party signs through its authorised director, as shown in its company affidavit or home registration document. Clause 16.7 allows electronic signatures and signed PDF copies. A Thai court works in Thai, so a Party relying on this Agreement in court must file a certified Thai translation.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-C0683B. If you reuse this content, please credit the author and link to the original.