What should a Managed Security Services Agreement include under Thai law?

1. Definitions and Interpretation
2. Services and Onboarding
3. Coverage, Severity Levels and Alerts
4. Escalation and Communication
5. Division of Response Responsibilities
6. Containment Actions
7. Access to Client Systems
8. Security Data and Logs
9. Personal Data
10. Regulatory Notifications
11. Automated Detection and AI Tools
12. Reporting and Service Reviews
13. Client's Responsibilities
14. Service Levels and Service Credits
15. Fees and Payment
16. Taxes
17. Intellectual Property
18. Confidentiality
19. Limitation of Liability
20. Force Majeure
21. Term and Termination
22. Exit and Handover
23. Notices
24. Governing Law and Disputes
25. General

• Schedule 1 is the heart of this Agreement. The Provider can only see systems that send it logs (Clause 2.3). Check the list of log sources against your real environment, and record anything deliberately excluded.
• Test the escalation list before the Service Commencement Date: ask the Provider to send a test Critical Alert at night and see who answers (Clause 4.1). An alert that nobody picks up protects nobody.
• Review the Playbook in Schedule 1 Part C with the people who own the affected systems. Every action listed there can be taken without waiting for your approval (Clause 6.1), so leave out anything that could stop a critical business process.- Every containment action needs your approval (Clause 6.1). Make sure the escalation contacts have authority to approve isolating a device or disabling an account at any hour, or the delay may let an attack spread.
• Keep your own emergency ("break-glass") administrator account that the Provider cannot use (Clause 7.3). Access to a computer system without permission can be a criminal offence under the Computer Crime Act (section 5), so the Provider's access should always be granted in writing and limited to what the Services need.

• The Provider detects and advises; you decide and act (Clause 5). Patching, restoring from backups and all notifications to regulators, customers and the police remain your responsibility.
• If personal data may be affected, the law requires you, as data controller, to notify the Office of the Personal Data Protection Committee without delay and within 72 hours after becoming aware of the breach, unless the breach poses no risk to individuals' rights and freedoms, and to tell the affected individuals without delay if the risk to them is high (Personal Data Protection Act section 37(4)). The Provider must notify you within … hours (Clause 9.2(f)) and send a written summary within 24 hours of a Critical Alert (Clause 10.2), so you have time to assess and report.
• As a critical information infrastructure organisation, you may have separate duties to report cyber threats to your sector regulator and the national cybersecurity authority, with their own deadlines. Give the Provider those procedures in writing (Clause 10.3).
• The Provider will not negotiate with or pay an attacker (Clause 5.3). If you receive a ransom demand, take legal advice before any payment; payments may breach sanctions or other laws and do not guarantee recovery.
• Ask the Provider to export the relevant logs with their handling record as soon as a serious incident is confirmed (Clause 8.3). Logs are deleted after … days unless you ask for them to be preserved.

• Logs contain personal data such as user names, IP addresses and email metadata, so the Provider acts as your data processor (Clause 9.2). The Personal Data Protection Act requires a written arrangement that controls the processor (section 40), and Clause 9 is designed to meet it. If your organisation uses its own standard form, you may sign a separate Data Processing Agreement instead, and state that it prevails.
• You chose to allow storage or access in …. That is a transfer of personal data abroad, which is lawful only if the destination has adequate protection or another condition in sections 28 and 29 of the Act is met, such as appropriate safeguards in a written agreement. Check this before the logs start flowing.- The logs must stay in Thailand (Clause 8.2). If the Provider later wants to use analysts or storage abroad, it needs your written consent and a lawful transfer mechanism.
• Tell your employees in your privacy notice that security monitoring takes place. Monitoring should be limited to what security requires.

• A managed security services agreement is a hire of work (Instrument 4 of the Stamp Duty Schedule). The Provider pays the duty (Clause 16.3): 1 THB for every 1,000 THB or part of 1,000 THB of the fees. On the Contract Value you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the Fees are in …, convert the Contract Value to Thai Baht at the exchange rate on the date of signing and calculate the duty on the Baht amount.
• If the Contract Value is 1,000,000 THB or more, the duty must be paid in money to the Revenue Department. If the Agreement is signed electronically, pay through the e-Stamp Duty system within 15 days after signing. An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid (Revenue Code section 118). Additional duty is due if the Agreement renews and more fees are received.

• A Thai company paying service fees to a provider in Thailand normally withholds 3% and issues a certificate. If the Provider is abroad, different withholding rules and self-assessed VAT may apply, and a double tax treaty may reduce the rate. Ask an accountant before the first payment, especially because you ticked gross-up.

• Service credits of …% per late Critical or High Alert, capped at …% of the monthly fee, are deducted from the next invoice (Clause 14). Under Thai law they work like a penalty, which a court may reduce if excessive, and they do not stop you claiming a larger proven loss.- The alert times are targets without service credits (Clause 14). Keep the monthly reports; three consecutive months of missed targets is a breach you can act on.
• No provider can guarantee that every attack will be detected (Clause 19.1). The liability cap does not apply to misuse of access or data by the Provider's staff, fraud, gross negligence or personal injury (Clause 19.4). Consider cyber insurance for the losses that remain with you.

• The Agreement renews every 12 months unless notice is given … days before the end of the current period (Clause 21.1). Diary the date.- The Agreement ends after the Initial Term. Arrange a new provider or a renewal in good time so that monitoring does not stop.
• During the Exit Period of … days, ask for the export of logs and custom detection rules (Clause 22.1). The Provider may not hold the logs back to press for payment (Clause 22.2). Remove the Provider's accounts and agents on the last day and ask for written confirmation of deletion.

• Each Party signs through its authorised director, as shown in its company affidavit or home registration documents. Clause 25.8 allows electronic signatures and signed PDF copies.
• A Thai court works in Thai, so a Party relying on this Agreement or on English logs and reports must file a certified Thai translation. If the other Party has no assets in Thailand, an arbitral award is usually easier to enforce abroad than a Thai judgment.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-C6A5DD. If you reuse this content, please credit the author and link to the original.