What should a Penetration Testing Agreement include under Thai law?

1. Definitions and Interpretation
2. Engagement and Authorisation
3. Rules of Engagement
4. Client Preparations
5. Conduct of the Testing
6. Stop Conditions and Emergency Contacts
7. Critical Findings and Prior Compromise
8. Data Encountered During Testing
9. Reports and Retesting
10. AI and Automated Tools
11. Fees and Payment
12. Taxes
13. Confidentiality of Findings
14. Ownership of the Report
15. Warranties and Limits of Testing
16. Liability
17. Force Majeure
18. Termination
19. Notices
20. Governing Law and Disputes
21. General

• Sign this Agreement and the Letter of Authorisation in Schedule 2 before the Testing Window starts. Under the Computer Crime Act B.E. 2550 (2007), accessing a computer system protected by access controls without authorisation is an offence (section 5), and other offences under the same Act cover interference with systems and disclosure of access measures. The written authorisation, limited to the listed Targets, dates and source addresses, is what separates a lawful test from an attack (Clause 2.2).
• Check every Target yourself. An IP address or domain that belongs to someone else, such as a shared host or a customer's system, cannot be authorised by you. For systems on a cloud, hosting or managed-service platform, read the provider's testing policy and give any notice it requires, then send the Tester the confirmation (Clauses 2.3 and 2.4).
• Take and test backups of every Target (Clause 4.1). If the Testing is performed within the rules and a system still slows down or fails, the Tester is not liable unless it acted wilfully or with gross negligence (Clause 16.1).
• Tell your IT team, your security monitoring provider and, where relevant, your hosting provider about the Testing Window and the Tester's source addresses, unless you deliberately want an unannounced test. An unannounced test can trigger a real incident response.
• Keep the emergency contact reachable by telephone during all testing hours. The Tester must stop and call within 1 hour if something goes wrong (Clause 6.1).
• Social engineering is switched on. Decide how your staff will be informed and make sure the exercise follows your employment policies. Results are reported by group, not to shame individuals (Clause 3.4).
• Denial-of-service or load testing is switched on. Agree the exact times with your emergency contact and warn your hosting provider in advance, because such tests can break its terms of service (Clause 3.3).

• The Tester must report each Critical Finding within … hours (Clause 7.1). Act on it immediately; do not wait for the Report.
• If the Tester finds signs that someone has already broken in, or sees personal data exposed, you are the data controller and you decide whether to notify the Personal Data Protection Committee Office. Unless the breach poses no risk to individuals' rights and freedoms, the notice is due within 72 hours after you become aware of it (Personal Data Protection Act section 37(4)), and individuals must also be told where the risk is high. Engage an incident response team if needed; that work is outside this Agreement (Clause 7.2).
• The Tester processes personal data only as a data processor with the limited duties in Clause 8.2 and must delete working data within 30 days after the Report is accepted. If the Tester will handle large volumes of personal data, for example in a white-box test with database access, consider signing a separate, full Data Processing Agreement.
• After the Testing, change every password, key or token listed in the Report (Clause 8.3), and confirm that the Tester removed its tools and test accounts (Clause 5.5).

• Comment on the draft Report within 10 Business Days (Clause 9.2). The Tester decides its findings in good faith; you can correct facts, not negotiate ratings away.
• Ask for the free retest within … days after the final Report (Clause 9.3). Fix the highest-severity findings first.
• A penetration test is a snapshot. A clean Report does not prove that the systems are secure, and it is not a certification (Clause 15.2). You may share the Report with auditors, insurers, regulators and customers under confidentiality, but they cannot rely on it against the Tester (Clause 9.4).

• A penetration testing engagement is a hire of work (Instrument 4 of the Stamp Duty Schedule), and the Tester pays the duty (Clause 12.3): 1 THB for every 1,000 THB or part of 1,000 THB of the Contract Price. On the Contract Price you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the price is in …, convert it to Thai Baht at the exchange rate on the date of signing and calculate the duty on the Baht amount. If the Agreement is signed electronically, pay through the Revenue Department's e-Stamp Duty system within 15 days after signing. An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid.
• A Thai company paying a Thai tester normally withholds 3% of the fee and issues a certificate. If the Tester is abroad, Thai withholding tax on fees paid overseas and self-assessed VAT may apply; take accounting advice before paying, especially because you ticked gross-up.

• The Client's signatory must have authority over every Target, because the same person signs the Letter of Authorisation. A company signs through the directors shown in its company affidavit, with the company seal if required.
• Electronic signatures and signed PDF copies are allowed (Clause 21.8). Keep the signed Agreement, the Letter of Authorisation, any third-party consents and the Tester's activity log together; together they prove that the Testing was authorised.
• A Thai court works in Thai, so a Party relying on this Agreement in court must file a certified Thai translation.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-582424. If you reuse this content, please credit the author and link to the original.