What should a Managed Cloud Services Agreement include under Thai law?

1. Definitions and Interpretation
2. Services
3. Cloud Accounts and Ownership
4. Administrative Access
5. Cloud Charges and Budget
6. Operations and Change Management
7. Incidents and Service Levels
8. Backup, Disaster Recovery and Restoration
9. Security
10. Data Location
11. Client's Responsibilities
12. Fees and Payment
13. Taxes
14. Intellectual Property
15. Confidentiality
16. Personal Data
17. Liability
18. Exit and Handover
19. Term and Termination
20. Force Majeure
21. Notices
22. Governing Law and Disputes
23. General

• A paid management service is treated as a hire of work (Instrument 4 of the Stamp Duty Schedule). Duty is 1 THB for every 1,000 THB or part of 1,000 THB of the Provider's fees. Cloud Charges are not part of the base. On the Contract Value you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the fees are in …, convert the Contract Value to Thai Baht at the exchange rate on the date of signing and calculate the duty on the Baht amount. Each counterpart carries 5 THB, or 1 THB if the duty on the original is 5 THB or less.
• By law the Provider pays and cancels the stamp duty (Clause 13.3), including additional duty when fees received exceed the estimate or the Agreement renews. If the Contract Value is 1,000,000 THB or more, the duty must be paid in money to the Revenue Department; an electronically signed agreement is stamped through the e-Stamp Duty system.
• An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid (Revenue Code section 118).

• A Thai Provider registered for VAT charges VAT on its fees and on the re-billed Cloud Charges and issues tax invoices (Clause 13.1). A Thai company paying a Thai Provider normally withholds 3% on service fees.
• Cloud Charges paid to a cloud provider abroad, and fees paid to a Provider abroad, may require the Thai payer to withhold income tax at a different rate and to pay VAT to the Revenue Department on the foreign provider's behalf, unless the foreign provider is registered for VAT in Thailand. Ask an accountant how your cloud bill is treated, especially because you ticked gross-up.

• Confirm that the Client holds the root or owner login, the billing settings and the recovery email and phone for every cloud account, with multi-factor authentication on (Clause 3.2).
• Give the Provider named identities with limited roles, not the root login (Clause 4.1). Check that audit logs go to a place the Provider cannot delete (Clause 4.2).
• Make sure you receive the inventory, diagrams, runbooks and exit plan within 30 days (Clause 2.2). Without them, changing provider later is slow and costly.
• Under partner billing, the accounts are still yours. Ask the Provider to show you how the accounts would be moved to direct billing, so that you know the transfer works before you need it (Clause 3.1).

• Read the cost report and approve any spend above the Budget in writing before it happens (Clause 5.3). Unexpected charges caused by the Provider's mistakes are for the Provider's account (Clause 5.5).
• Approve reserved capacity or savings plans only after checking how long they bind you (Clause 5.4).
• Ask for the restore test results every quarter and the disaster recovery test once a year (Clause 8.3). A backup that has never been restored may not work.

• A Provider that can access personal data in your cloud is your data processor (Clause 16.2). The Personal Data Protection Act requires a processor to act only on your instructions, keep the data secure and report breaches (section 40). You must usually notify the Personal Data Protection Committee within 72 hours after becoming aware of a breach (section 37), which is why the Provider must tell you within … hour(s).
• Keeping data in … is your decision. Transfers of personal data outside Thailand must meet the conditions in sections 28 and 29 of the Act.
• If your business is designated as critical information infrastructure under Thailand's cybersecurity law, add the required security standards and incident reporting steps to Schedule 1.

• When the Agreement ends, the Provider must hand over diagrams, runbooks, infrastructure code and credentials, and remove its access, within 10 Business Days, and may not delete anything (Clause 18). Change any shared passwords and keys yourself on the same day. Accessing a computer system after the right of access has ended may be a criminal offence in Thailand.
• The Agreement renews every 12 months unless a notice of non-renewal is received at least … days before the end of the current period (Clause 19.1).

• A company should sign through the director or directors authorised in its latest company affidavit, with the company seal if required. For a foreign Provider, ask for evidence of the signatory's authority.
• Clause 23.8 allows electronic signatures and signed PDF copies. Keep the signed file, Schedule 1, budget approvals, cost reports and incident reports.

• A Thai court works in Thai. English documents need a certified Thai translation. Budget for this cost.
• A Thai judgment may be hard to enforce against a party with no assets in Thailand. Keeping the accounts and root login in your own name protects you better than any court case.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-2ED0A1. If you reuse this content, please credit the author and link to the original.