What should a Managed IT Services Agreement include under Thai law?

1. Definitions and Interpretation
2. Services
3. Asset Register
4. Priorities and Response Times
5. Repairs, Parts and Data on Devices
6. Software Licences
7. Admin Accounts and Security
8. Client's Responsibilities
9. Fees and Payment
10. Taxes
11. Confidentiality
12. Personal Data
13. Liability
14. Force Majeure
15. Personnel
16. Term, Termination and Handover
17. Notices
18. Governing Law and Disputes
19. General

• A paid IT support service is treated as a hire of work (Instrument 4 of the Stamp Duty Schedule). Duty is 1 THB for every 1,000 THB or part of 1,000 THB of the fees. On the Contract Value you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the fees are in …, convert the Contract Value to Thai Baht at the exchange rate on the date of signing and calculate the duty on the Baht amount. Each counterpart carries 5 THB, or 1 THB if the duty on the original is 5 THB or less.
• By law the Provider pays and cancels the stamp duty (Clause 10.3), including additional duty when devices are added or the Agreement renews. If the Contract Value is 1,000,000 THB or more, the duty must be paid in money to the Revenue Department.
• An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid (Revenue Code section 118).

• A Thai Provider registered for VAT charges VAT and issues tax invoices (Clause 10.1). A Thai company paying a Thai Provider normally withholds 3% on service fees and gives a withholding tax certificate. Parts bought as goods are not subject to that withholding, so ask for them on separate invoice lines.
• If the Provider is not in Thailand, other withholding and VAT rules may apply. Ask an accountant before the first payment, especially because you ticked gross-up.

• Check the Asset Register with the Provider and label every device (Clause 3.1). Devices that are not listed are not covered.
• Keep at least one owner-level administrator login for Microsoft 365 or Google Workspace, the domain name and the firewall under the Client's own control, with multi-factor authentication (Clause 7.1). Store all passwords in a password manager that the Client owns.
• Agree the support channels and the Client's contact person, and tell staff how to report problems.

• Read each written security recommendation and reply in writing. If you decide not to follow one, the Provider is not responsible for the loss it was meant to prevent (Clause 7.2).
• Never let a laptop or hard disk leave the office for repair or disposal without encryption or removal of its storage, and keep the erasure records (Clause 5.3).
• In a ransomware attack, disconnect affected devices, call the Provider and your insurer, and preserve evidence. Decisions about any contact with attackers are for the Client's management, not the Provider (Clause 7.4).

• An IT provider that can open computers, mailboxes or camera recordings is your data processor (Clause 12.2). The Personal Data Protection Act requires a processor to act only on your instructions, keep the data secure and report breaches (section 40). You must usually notify the Personal Data Protection Committee within 72 hours after becoming aware of a breach (section 37), which is why the Provider must tell you within 24 hours.
• Personal data may not be copied to the Provider's systems or sent abroad without your consent and without meeting the conditions of sections 28 and 29 of the Act.

• Buy software licences in the Client's name and keep the licence records. Using unlicensed copies of software in a business is copyright infringement and may be a criminal offence in Thailand. The Provider must not install unlicensed software and must tell you if it finds any (Clause 6).

• When the Agreement ends, collect the Asset Register, network diagrams and every password within 10 Business Days, and make sure the Provider's remote management tools are removed or disabled (Clause 16.5). Change administrator passwords the same day. Accessing a computer system after the right of access has ended may be a criminal offence in Thailand.
• The Agreement renews every 12 months unless a notice of non-renewal is received at least … days before the end of the current period (Clause 16.1).

• A company should sign through the director or directors authorised in its latest company affidavit, with the company seal if required.
• Clause 19.7 allows electronic signatures and signed PDF copies. Keep the signed file, the Schedules, monthly reports, tickets and security recommendations.
• A Thai court works in Thai. English documents need a certified Thai translation if the case goes to court.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-CC97B2. If you reuse this content, please credit the author and link to the original.