A data sharing agreement (DSA) between two data controllers is not required by Thailand's PDPA, according to the PDPC's advisory subcommittee. It is a useful organisational measure under Section 37 (1), unlike a processor agreement, which Section 40 makes mandatory. This article explains both health-sector opinions for DPOs and legal teams sharing data with other organisations.
- The PDPA does not require two controllers to sign a DSA; each decides for itself.
- A DSA is one organisational measure under Section 37 (1) and clause 4 of the 2022 Notification.
- Without a DSA, the sender notifies purposes in writing and the recipient sets its own measures.
- An agreement with a data processor remains mandatory under Section 40, paragraph three.
- After a leak, the party whose measures failed at that stage is liable, judged case by case.
Every day, Thai public hospitals send treatment records to the National Health Security Office to claim payment for patients under the universal coverage scheme. Those records carry names, treatment history, medicines and diagnoses. Under Section 26 of the Personal Data Protection Act B.E. 2562 (2019), the PDPA, all of it counts as health data.
The Ministry of Public Health built a Financial Data Hub so that every service unit under it sends claims through one system. That raised a practical question: must the sender and the recipient sign a Data Sharing Agreement (DSA) first, and what happens if one side refuses?
The question reached the Office of the Personal Data Protection Committee (PDPC Office) from both ends of the same data flow. The sender was the Office of the Permanent Secretary, Ministry of Public Health (OPS-MOPH). The recipient was the National Health Security Office (NHSO). The answers came from the PDPC's subcommittee that answers questions and advises on compliance with the personal data protection law.
This article retells both opinions in our own words. The boxed legal text is quoted verbatim from the PDPA and from the PDPC Notification on security measures of data controllers, B.E. 2565 (2022). An advisory opinion is not law, but it shows how the regulator reads these sections.
What did the two agencies ask, and why the same question?
Both asked about the same draft agreement. OPS-MOPH and the NHSO signed a memorandum of understanding on developing a health-service claims data system on 8 March 2024, and met to discuss a draft agreement on disclosing personal data to each other on 10 September 2024.
OPS-MOPH, which proposed the draft, saw itself as the controller for its service units and wanted an agreement. The NHSO took the view that claims data sent under the National Health Security Act B.E. 2545 (2002) is already under its own control, so it asked whether signing was necessary at all.
| Asked by | Issue | What they really wanted to know |
|---|---|---|
| OPS-MOPH (sender) | Issue 1 | Should a DSA be signed, and if the other side refuses, how do we keep appropriate security measures in place? |
| OPS-MOPH | Issue 2 | Service units without legal personality: who decides when someone asks for their data? |
| OPS-MOPH | Issue 3 | If data is shared without a DSA and then leaks, who bears civil and administrative liability? |
| OPS-MOPH | Issue 4 | Does full compliance show accountability and keep officials clear of Section 157 of the Criminal Code? |
| NHSO (recipient) | Issue 1 | Must the NHSO sign the agreement OPS-MOPH proposed? |
| NHSO | Issue 2 | If signing would weaken enforcement of the National Health Security Act, what PDPA measures apply instead? |
Who is the data controller when hospitals send claims data?
Both are, each for its own part. The subcommittee found that OPS-MOPH and the NHSO are each a data controller. The test in Section 6 of the PDPA is the power to decide, not who happens to hold the file.
“Data Controller” means a Person or a juristic person having the power and duties to make decisions regarding the collection, use, or disclosure of the Personal Data;
The Ministry of Public Health side
OPS-MOPH is a government agency under the Ministry under Section 43 (2) of the Act Reorganising Ministries, Sub-Ministries and Departments B.E. 2545 (2002). It has department status under Section 18, paragraph two, and legal personality under Section 7, paragraph three, of the State Administration Act B.E. 2534 (1991). The public health facilities under it have no legal personality of their own.
So, in the subcommittee's view, when those facilities collect, use or disclose personal data, OPS-MOPH, as the parent agency with legal personality, is the data controller.
The National Health Security Office side
The NHSO is a state agency with legal personality under Section 24, paragraph one, of the National Health Security Act. Under Section 26 of that Act it collects and analyses health-service data, pays service units and checks their claim documents. It is therefore a data controller in its own right.
Can hospitals send patient data to the NHSO without consent?
Yes. The subcommittee found that sending patient data to the NHSO to claim payment under Sections 45 and 46 of the National Health Security Act is a disclosure to comply with the law under Section 24 (6), read with Section 27, paragraph one, of the PDPA.
(6) it is necessary for compliance with a law to which the Data Controller is subjected.
Because health data falls under Section 26, the disclosure also relies on Section 26 (5) (c), which names national health security expressly. That exception comes with a condition: suitable measures to protect the data subject's fundamental rights and interests. The subcommittee later built its DSA answer on that very condition.
(c) employment protection, social security, national health security, social health welfare of the entitled person by law, the road accident victims protection, or social protection in which the collection of Personal Data is necessary for exercising the rights or carrying out the obligations of the Data Controller or the data subject, by providing the suitable measures to protect the fundamental rights and interest of the data subject;
On the receiving side, the NHSO collects the data from service units rather than from patients. The opinion says this is allowed under Section 25, paragraph one (2), and that the NHSO need not give the Section 23 notice, by virtue of Section 25, paragraph two, because the collection does not need consent under Section 25, paragraph one (1).
The subcommittee added a practical point. Service units should list the categories of recipients in their privacy notice under Section 23 (4), covering disclosure to the NHSO and to the various health funds, so that patients know from the start where their data goes.
Does the law require two data controllers to sign a DSA?
No. The subcommittee said plainly that the PDPA sets no express duty for a controller to sign a data sharing agreement with another controller. What it does require is that a controller disclosing data provide appropriate security measures under Section 37 (1).
(1) provide appropriate security measures for preventing the unauthorized or unlawful loss, access to, use, alteration, correction or disclosure of Personal Data
The minimum standard for those measures sits in clause 4 of the PDPC Notification on security measures of data controllers, B.E. 2565 (2022), which requires both organisational and technical measures.
(2) Such security measures must consist of appropriate organizational measures and technical measures, which may also include necessary physical measures
The subcommittee classed a DSA as one kind of organisational measure. It sets out the purposes, means, conditions and duties of each party, whether data moves on paper or electronically, and it helps stop the recipient from using the data beyond the purpose it gave.
The Person or juristic person who obtains Personal Data as a result of the disclosure under paragraph one shall not use or disclose such Personal Data for any purpose other than the purpose previously notified to the Data Controller in the request to obtain such Personal Data.
The opinion also cites Section 37 (2) as a measure against unauthorised or unlawful use by the recipient. It adds that if the NHSO needs the data for any purpose beyond paying for health services, it should tell OPS-MOPH or the service units about that purpose when it asks for the data.
The key point: with or without a DSA, the NHSO still carries every PDPA duty. That includes collecting only what is necessary under Section 22, security under Section 37 (1), an erasure review system under Section 37 (3), and handling data subjects' rights under Chapter 3. Signing neither adds to nor removes any legal duty.
If you do sign a DSA, what should it cover?
The subcommittee gave a broad frame. The agreement should cover the purposes, means, conditions and responsibilities of each party for collection, use and disclosure, and may set retention periods or conditions for erasure or destruction.
The condition it stressed is independence. Each party must still be able to act as a controller that sets its own purposes and means, without obstructing the other's work, especially work done in the public interest or under a legal duty, and without conflicting with the PDPA.
| Topic | Question the draft must answer | Source |
|---|---|---|
| Purpose | What will the recipient use the data for, and has any other purpose been notified to the sender? | Section 27, para. 2 |
| Means | Which channel, paper or electronic, and who may access it? | Clause 4, 2022 Notification |
| Conditions | May the recipient pass the data on, and on what terms? | Section 37 (2) |
| Each party's duties | Who looks after security at which stage? | Section 37 (1) |
| Retention and erasure | How long is it kept, and when is it deleted or destroyed? | Section 37 (3) |
| Independence | Does the agreement stop either party from setting its own purposes and means? | Section 6 · PDPC opinion |
This table is the AIPDPA team's arrangement of the opinion's frame, not a form issued by the PDPC Office. A real agreement must fit each agency's own sector law.
What if the other side refuses to sign?
You can proceed with one-sided measures. In the NHSO opinion, the subcommittee said that if a DSA would make duties under the health security law or other laws less effective, would defeat their purpose, or if the parties simply cannot agree, they may choose not to sign.
Not signing does not lift any duty. Each party must put other suitable measures in place to protect the data subject's fundamental rights and interests in the same way, as Section 26 (5) (c) requires. The opinion gives an example for each side.
Write to the recipient setting out the purposes for which the recipient will use or disclose the data, instead of a mutual agreement.
Adopt organisational and technical measures, and physical ones where needed, that limit use of the data to the purpose the sender notified or another lawful purpose of its own.
Both parties still owe Section 37 (1). With neither a DSA nor a substitute measure, neither can show it met the safeguard condition in Section 26 (5) (c).
For private organisations in a similar position, for example sharing customer data with a partner that is itself a controller, the safe course in our view is to keep the written notice of purpose and a record of each transfer, even when the partner signs nothing.
How is a DSA different from a processor agreement?
The difference is that one is mandatory. An agreement with a data processor (a Data Processing Agreement, or DPA) is required by law. A DSA between two controllers is not. The subcommittee closed both opinions with this point.
In carrying out the activities in accordance with the Data Processor's obligations as assigned by the Data Controller under paragraph one, the Data Controller shall prepare an agreement between the parties
| Recipient | Example | Agreement | Basis |
|---|---|---|---|
| Data processor (acts on our instructions or on our behalf) | Payroll provider, cloud host, outsourced call centre | Required (DPA) | Section 40, para. 3 |
| Another data controller (decides its own purposes) | NHSO receiving claims data, an insurer receiving claim files | Not required (DSA is optional) | PDPC opinion · Section 37 (1) |
| Another controller that will not sign | An agency whose own statute empowers it to receive the data | One-sided measures instead | Section 26 (5) (c) · PDPC opinion |
Getting the classification right matters more than the document's name. If the recipient is really a processor, calling the paper a DSA does not change what Section 40 demands. For the processor side, see processor agreement clauses and the processor agreement guide.
If data leaks in transit, who is liable?
It depends on the facts. The subcommittee did not name one party as always liable. The test is which party failed to provide appropriate security under Section 37 (1) and the 2022 minimum standard, causing the breach, whether or not there was a DSA.
The opinion described the three types of personal data breach under Section 37 (4) and the 2022 breach notification rules: a confidentiality breach, an integrity breach and an availability breach.
- Before sendingData still held by OPS-MOPH; a breach caused by OPS-MOPH's inadequate measures falls on OPS-MOPH as the disclosing controller.Section 37 (1)
- During exchangeA breach caused by both parties' measures together: each is responsible for its own part.Section 37 (1)
- After receiptData now held by the recipient; a breach caused by the recipient's measures falls on the receiving controller.Section 37 (1)
This shapes how a DSA should be written. A good agreement says clearly where responsibility changes hands, because after an incident, the point where the data leaked decides who must notify within 72 hours under Section 37 (4). See the 72-hour breach guide.
Are directors personally liable?
Civil liability and administrative fines under the PDPA fall on the legal entity that is the controller, not on its directors or managers. The OPS-MOPH opinion says so directly. For criminal offences under Sections 79 and 80, Section 81 extends liability to those who gave the instruction or failed to give one.
In the case where the offender who commits the offense under this Act is a juristic person and the offense is conducted as a result of the instructions given by or the act of any director, manager or person, who shall be responsible for such act of the juristic person
The subcommittee said that if directors or managers did their part in putting appropriate organisational and technical measures in place, such as data protection policies and procedures, risk management and monitoring, that is a fact to weigh alongside the elements of the offence.
Asked whether officials could fall under Section 157 of the Criminal Code, the opinion replied that this depends on the facts, the law and the process in each case, and lies outside the subcommittee's remit, because it is not a request for advice on complying with the PDPA.
How far can a unit without legal personality decide for itself?
As far as the controller delegates. The opinion explains that a service unit's decision-making power depends on the State Administration Act, ministerial regulations on internal structure, delegation rules and the health security law. OPS-MOPH, as controller, may delegate, assign, instruct and supervise its units to decide as it sees fit.
The subcommittee advised weighing flexibility against risk, in line with Section 27 of the Royal Decree on Criteria and Procedures for Good Governance B.E. 2546 (2003), which calls for decisions to be delegated to the officials directly responsible, to cut steps and serve the public faster.
A private company with many branches can use the same logic. The company is the controller, but it should spell out in writing which kinds of disclosure a branch manager may approve alone and which must go to the DPO or legal team.
What does this mean for the public?
For everyone on the universal coverage scheme, treatment data already flows from hospital to the NHSO for payment. The two opinions confirm that this flow has a legal basis without consent, and set the principle that the recipient must stick to the notified purpose, keep the data secure and honour data subjects' rights, whether or not an agreement is signed.
Patients who want to know where their data goes can read the service unit's privacy notice and contact the agency directly. Information on health coverage rights is on the National Health Security Office website, and PDPA notices and publications are on the PDPC Office website. Both full opinions (in Thai) are on the PDPC Office consultations page: the Office of the Permanent Secretary, Ministry of Public Health opinion and the National Health Security Office opinion.
What should an organisation check before sharing data with another controller?
- Decide whether the recipient is a controller or a processor. If a processor, you need an agreement under Section 40, paragraph three.
- Find the legal basis for disclosure under Section 24 or 26 read with Section 27, paragraph one, and log consent-exempt disclosures in the Section 39 record as Section 27, paragraph three, requires.
- Check that your privacy notice lists categories of recipients under Section 23 (4).
- Ask the recipient to state its purposes in writing, so Section 27, paragraph two, has a clear frame.
- Choose between a DSA and a one-sided notice of terms, and keep it as evidence of an organisational measure.
- Set the transfer channel, access rights and retention period in line with clause 4 of the 2022 Notification.
AIPDPA helps in two places. The RoPA register records recipients and the legal basis of each disclosure and prints a Section 39 report, and the ready-to-use document library includes a processor agreement template. See the real screens in the demo account or view plans.
Frequently asked questions
Do I need a DSA every time I share personal data with another controller?
No. The PDPC's subcommittee found that the PDPA does not require two controllers to sign a DSA. Both must still keep security measures under Section 37 (1), and a DSA is one organisational measure that can serve that purpose.
How is a DSA different from a DPA?
A DPA is the agreement with a processor that acts on the controller's instructions or on its behalf, and Section 40, paragraph three, requires it. A DSA is between two controllers that each decide their own purposes, and the law does not require it.
Can I still share the data if the recipient will not sign a DSA?
Yes, if you have a legal basis. The opinion suggests the sender notify the recipient in writing of the purposes for its use, and the recipient set its own organisational and technical measures to limit use.
Who is liable if data leaks and there is no DSA?
It depends on which party failed to provide measures under Section 37 (1). A leak before sending falls on the sender, a leak after receipt on the recipient, and a leak caused by both falls on each for its own part.
Must hospitals get patient consent before sending data to the NHSO?
No. The opinion treats it as compliance with law under Section 24 (6), or as necessary under Section 26 (5) (c), read with Section 27, paragraph one. Hospitals should still name the NHSO in their privacy notice under Section 23 (4).
Do directors pay administrative fines personally?
No. The opinion says civil liability and administrative fines under the PDPA fall on the controller entity. For criminal offences under Sections 79 and 80, Section 81 can extend to directors or managers who instructed or failed to instruct.
You have read it. Now get it done
Open the demo account to see the real AIPDPA system with a sample company: RoPA, the 72-hour breach clock, data subject requests, cookie consent and ready-to-use documents, all in one place.
From 2,900 THB/year (11 modules) · all 24 modules from ENTERPRISE at 19,900 THB/year · demo account, no sign-up
No time? Have our lawyers handle it →Kooru's lawyers set it up and act as your DPO
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 6 · 22 · 23 (4) · 24 (6) · 25 · 26 (5) (c) · 27 · 37 (1) (2) (3) (4) · 39 · 40 · 81
- PDPC Notification on security measures of data controllers, B.E. 2565 (2022) — Clause 4 (2)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)