What should an Outsourced Data Protection Officer Agreement include under Thai law?

1. Definitions and Interpretation
2. Appointment and Designated DPO
3. Term and Renewal
4. DPO Functions and Additional Services
5. Service Levels and Availability
6. Independence and Reporting Line
7. Client's Support and Responsibilities
8. Contact Details and Notification
9. No Guarantee of Compliance
10. Personal Data Handled by the Provider
11. Use of AI Tools
12. Fees and Payment
13. Taxes
14. Confidentiality
15. Liability
16. Force Majeure
17. Records and Handover
18. Termination
19. Notices
20. Governing Law and Disputes
21. General

• The Personal Data Protection Act requires a controller or processor to designate a data protection officer if: (1) it is a public authority prescribed by the Committee; (2) its core activities require regular and systematic monitoring of personal data or systems because of the large amount of personal data; or (3) its core activities involve sensitive personal data under section 26 (section 41).
• Under the Committee's 2023 notification on DPOs, "large scale" includes core activities involving 100,000 or more data subjects, and regular monitoring includes profiling, behavioural advertising, credit scoring or fraud prevention checks on customers, network and telecommunications services, and security surveillance of premises. Support activities such as HR and IT alone do not count as core activities.
• A controller or processor that must have a DPO but does not, or that fails to support its DPO or dismisses the DPO for performing the role, faces an administrative fine of up to THB 1 million (sections 82 and 85). Even where a DPO is not required, appointing one under this Agreement is lawful and helpful.

• Notify data subjects and the Office of the Personal Data Protection Committee of the DPO's details, place of contact and method of contact (section 41, Clause 8). Under this Agreement the Client makes the notification, with the Provider's help.Under this Agreement the Provider makes the notification for the Client and sends evidence of submission. Update every privacy notice with the contact channel: ….
• Tell staff how to reach the DPO, and that a suspected personal data breach must be reported to the DPO at once. The Client must pass it on within … hours (Clause 7.2), and the Provider starts advising within … hours (Clause 5.4). The controller must notify the Office within 72 hours after becoming aware of a breach unless the breach poses no risk to individuals, and the notification must include the DPO's name and contact details.
• If the DPO also performs other tasks for the Client, the Client must be able to certify to the Office that those tasks do not conflict with the DPO role (Clause 6.3). Do not make the DPO the person who decides what personal data the business collects or how it is used.
• Give the DPO access to systems, documents and people (Clause 7.1). The law requires the organisation to support the DPO with adequate tools and access.

• The Client may not dismiss the DPO or end this contract because the DPO performed the role, for example by raising uncomfortable findings or cooperating with the Office (section 42). Clause 6.4 makes any such notice ineffective.
• The DPO advises; the Client decides. Record the reasons whenever management decides not to follow significant advice (Clause 6.2). The appointment of a DPO does not transfer the Client's legal duties to the Provider (Clauses 7.3 and 9).

• This Agreement renews every 12 months unless notice of non-renewal is received … days before the end of the current period (Clause 3.2). Diarise the date.- This Agreement ends after … months (Clause 3.2). Arrange a new DPO in good time if the law requires the Client to have one.
• When the Designated DPO or the Provider changes, update the notification to the Office and the privacy notices within 15 Business Days (Clause 8.2), and collect the log and handover documents (Clause 17).
• Unpaid fees allow the Provider to suspend only the additional services. The DPO role and breach response continue until the Agreement ends (Clause 12.5), so the Client is not left without a DPO without notice.

• This is a hire of services (Instrument 4 of the Stamp Duty Schedule). Duty is 1 THB for every 1,000 THB or part of 1,000 THB of the fees. On the Contract Value you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the Fees are in …, convert the Contract Value to Thai Baht at the exchange rate on the date of signing and calculate the duty on the Baht amount. The Provider pays the duty (Clause 13.3), and additional duty if renewals or extra hours take the fees above the Contract Value.
• If the Agreement is signed electronically, pay the duty through the Revenue Department's e-Stamp Duty system within 15 days after signing. An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid.
• A Thai company paying service fees to a Thai provider normally withholds 3% and issues a certificate. If the Provider is abroad, different withholding rules and double tax treaties may apply, and because you ticked gross-up the Client bears the withholding tax on top of the Fees. Take accounting advice before the first payment.

• Each Party signs through its authorised director as shown in its company affidavit. Clause 21.8 allows electronic signatures.
• Keep the monthly reports, the advice log, the notification to the Office and evidence of every breach assessment. They show that the organisation had a working DPO, which matters if the Office investigates.
• A Thai court works in Thai. A Party relying on this Agreement in court must file a certified Thai translation.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-B7C438. If you reuse this content, please credit the author and link to the original.