What should a Secure Data Destruction Agreement include under Thai law?

1. Definitions and Interpretation
2. Services
3. Client's Preparation
4. Chain of Custody
5. Security of Personnel, Vehicles and Facility
6. Destruction Standard
7. Witnessing and Evidence
8. Certificate of Destruction
9. Title, Risk and Lost Media
10. Recycling, Reuse and Environmental Disposal
11. Personal Data
12. Subcontracting
13. Fees and Payment
14. Taxes
15. Insurance
16. Confidentiality
17. Liability
18. Force Majeure
19. Term and Termination
20. Notices
21. Governing Law and Disputes
22. General

• Decide what may be destroyed. Thai accounting, tax, labour and sector rules require many records to be kept for fixed periods, and records relevant to a dispute or investigation must not be destroyed. The Provider does not check the content (Clause 3.2), so the decision and the risk are yours. Keep a signed internal approval listing what each batch contains.
• As data controller you must have a system to delete or destroy personal data once it is no longer needed or the retention period ends (Personal Data Protection Act section 37(3)). This Agreement and its certificates are part of the evidence that the system works.
• Prepare a list of storage devices with serial numbers before collection (Clause 3.1). The Certificate of Destruction can only be as precise as the list that goes in.
• Media leaves your premises, so the chain of custody matters most. Check on the first collection that the containers are sealed, the seal numbers are written down and the vehicle is locked (Clause 4). The Provider must destroy each batch within … days.- Media is destroyed at your premises (Clause 2.2). Arrange a safe place for the mobile unit and a staff member to watch the process.

• Compare every Certificate of Destruction with your own list: the number of containers, the seal numbers and every serial number (Clause 8). Question any difference at once; the Provider must report differences within 24 hours (Clause 4.3).
• You may send someone to watch, or ask for a video (Clause 7). For hard disks and SSDs from finance, HR or customer systems, it is worth doing.
• You allowed purging instead of physical destruction where it can be verified (Clause 6.1(b)). Check that each purged device appears on the certificate as "purged and verified". Devices that failed verification must be shown as destroyed.- Every storage device is physically destroyed (Clause 6.1(b)). This is the safest choice for SSDs, memory cards and phones, where overwriting may leave data in hidden areas.
• Keep certificates and chain of custody records for at least as long as someone could claim that data leaked. The Provider keeps them for … years (Clause 4.4).

• Loss of Media containing personal data is a personal data breach. The Provider must tell you within … hours (Clause 11.3). You, as controller, must notify the Office of the Personal Data Protection Committee without delay and within 72 hours after becoming aware of it, unless the breach poses no risk to individuals' rights and freedoms, and must tell affected individuals if the risk to them is high (section 37(4)). Unlawful destruction of data you still needed is also a breach.
• The Provider bears the risk from the moment its staff sign for the Media (Clause 9.2). Its liability for lost Media is capped at the amount in Clause 17.2, but not for fraud, a false certificate, or data its staff kept or sold (Clause 17.3).
• Ask for the insurance certificate before the first collection and check that it covers loss of client data, not only damage to property (Clause 15).

• The Provider handles the Media as your data processor. The Personal Data Protection Act requires a written arrangement that controls a processor (section 40), and Clause 11 is designed to meet it for destruction work. If your organisation uses its own standard form, you may sign a separate Data Processing Agreement instead and state that it prevails.
• Clause 11.2(e) keeps the Media in Thailand. Sending it abroad for destruction would be a transfer of personal data abroad and would need a lawful basis under sections 28 and 29 of the Act.

• A destruction service is a hire of work (Instrument 4 of the Stamp Duty Schedule). The Provider pays the duty (Clause 14.3): 1 THB for every 1,000 THB or part of 1,000 THB of the fees. On the Contract Value you entered, the duty on the original is the amount the system calculates from the figures entered, and each counterpart carries the amount the system calculates from the figures entered.Because the Fees are in …, convert the Contract Value to Thai Baht at the exchange rate on the date of signing and calculate the duty on that amount. If the fees actually paid exceed the Contract Value, additional duty is due. An unstamped agreement cannot be used as evidence in a Thai civil court until the duty and a surcharge are paid (Revenue Code section 118).
• A Thai company paying a service provider in Thailand normally withholds 3% and issues a certificate; because you ticked gross-up, the Client bears that tax on top of the Fees.

• Shredded electronics, batteries and circuit boards are regulated waste in Thailand. The Provider must use licensed recyclers and may not export the residue (Clause 10.1). Ask for evidence of disposal once a year; a company's name on illegally dumped waste can damage its reputation even if it is not legally liable.
• You allowed resale of purged devices (Clause 10.2). Agree any resale credit in Schedule 2 and make sure your labels and asset tags are removed.

• Each Party signs through its authorised director, as shown in its company affidavit. Clause 22.8 allows electronic signatures and signed PDF copies.
• A Thai court works in Thai, so a Party relying on this Agreement or on English certificates must file a certified Thai translation.

Compiled from the notes that accompany the English contract templates on this site, published by Phuwara Krobtaku (ภูวรา ครอบตะคุ), Thai attorney-at-law, licence no. 477/2558. The short answer and summary at the top of this page are put together by the site from the template's clause headings and notes. Statutes are quoted only in the official Thai text: Thai is the only official language of Thai legislation, and an unofficial translation can mislead. Article registry OKC-7BD857. If you reuse this content, please credit the author and link to the original.