What should an Information Security Assessment Agreement include under Thai law?

1. Definitions and Interpretation
2. Engagement and Scope
3. Reference Framework
4. Approach and Methodology
5. Client Evidence and Access
6. Level of Assurance
7. Inherent Limitations
8. Independence and Conflicts
9. Findings and Ratings
10. Draft and Final Report
11. Use of the Report and Third-Party Reliance
12. Follow-up Review
13. Personal Data
14. AI Tools
15. Fees and Payment
16. Taxes
17. Confidentiality
18. Intellectual Property
19. Warranties
20. Liability
21. Termination
22. Notices
23. Governing Law and Disputes
24. General

• You chose an advisory gap assessment (Clause 6.1). The Report lists where your controls meet, partly meet or miss the Framework and what to fix. It contains no overall conclusion, so do not present it as a pass or fail.- You chose limited assurance (Clause 6.1). The Report includes a conclusion that nothing came to the Assessor's attention indicating significant non-conformity. It is based on less work than an audit and gives less confidence than a reasonable assurance opinion; describe it that way to customers and insurers.
• The Report is not an ISO/IEC 27001 certificate. Only an accredited certification body can certify an information security management system. It is also not a financial audit and not a legal opinion that you comply with the Personal Data Protection Act (Clause 6.2). Using the Report as if it were a certificate can mislead customers and expose you to claims (Clause 6.3).
• The PDPC framework you chose reflects the minimum security measures that personal data controllers must have under section 37(1) of the Personal Data Protection Act. A good result helps show that you took appropriate measures, but compliance with the rest of the Act, such as lawful basis, notices and data subject rights, is outside this Assessment.
• Other parties can read the Report under confidentiality, but cannot rely on it against the Assessor unless the Assessor signs a reliance letter with them (Clause 11.2). If a customer asks to rely on the Report, raise it with the Assessor before the Assessment starts.

• Send the Evidence within … Business Days after you receive the Evidence list (Clause 5.1). Missing Evidence is reported as "not evidenced", not assumed to be fine, and extra days caused by delay may be charged (Clause 5.3).
• Appoint one coordinator and brief interviewees to answer factually. Before the final Report you must confirm in writing that you have provided all relevant Evidence and disclosed known incidents (Clause 10.3).
• The Assessor will not scan or attack your systems (Clause 4.2). If you also need technical testing, commission a penetration test under a separate agreement.
• If the Assessor finds signs of a security incident or personal data breach, it will tell you within 24 hours (Clause 7.2). As data controller you decide whether to notify the Personal Data Protection Committee Office, which is due within 72 hours after you become aware of a breach unless it poses no risk to individuals' rights and freedoms (section 37(4)).
• The Assessor will see personal data in samples and acts as your data processor with the duties in Clause 13.2. For large or sensitive data sets, you may prefer a separate, full Data Processing Agreement.- Remove or mask personal data from every document and screenshot before sending it to the Assessor (Clause 13.2).
• Ask for the free follow-up review within … months after the final Report (Clause 12.1), once high and medium findings are fixed.
• If your organisation operates critical information infrastructure, Thailand's cybersecurity law may require specific risk assessments and audits. Check whether this Assessment meets that requirement before relying on it for that purpose.

• An assessment engagement is a hire of work (Instrument 4 of the Stamp Duty Schedule), and the Assessor pays the duty (Clause 16.3): 1 THB for every 1,000 THB or part of 1,000 THB of the fees. On the Contract Price you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the fees are in …, convert the Contract Price to Thai Baht at the exchange rate on the date of signing and calculate the duty on the Baht amount. If signed electronically, pay through the Revenue Department's e-Stamp Duty system within 15 days after signing. An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid.
• A Thai company paying a Thai assessor normally withholds 3% of service fees and issues a certificate. For an assessor abroad, Thai withholding tax on fees paid overseas and self-assessed VAT may apply; take accounting advice before the first payment, especially because you ticked gross-up.

• A company signs through the directors shown in its company affidavit, with the company seal if required. Electronic signatures and signed PDF copies are allowed (Clause 24.9).
• Keep the signed Agreement, the Evidence list, your written confirmation under Clause 10.3, the draft and final Report and your management responses together.
• A Thai court works in Thai, so a Party relying on this Agreement in court must file a certified Thai translation.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-362537. If you reuse this content, please credit the author and link to the original.