An NDA that actually protects is one that helps the information stay within the definition of a trade secret in section 3 of Thailand's Trade Secrets Act, which requires the owner to take appropriate measures to keep it secret, not just to write "do not disclose". This guide is for business owners and legal teams sharing information with partners, investors or contractors.
- Information is a trade secret under section 3 only if its controller takes appropriate measures to keep it secret; an NDA is key evidence of those measures.
- Section 6 paragraph two lists breach of contract as an act contrary to honest trade practices.
- Reverse engineering is not an infringement unless the parties expressly agreed otherwise (section 7, last paragraph).
- Claims must be brought within three years of knowing of the infringement and the infringer, and never more than ten years after it (section 10).
- If the NDA covers customer data, the sender still has a separate duty under PDPA section 37 (2).
The NDA, or confidentiality agreement, is one of the documents companies sign most often: before a deal discussion, before showing figures to an investor, before sending specifications to a factory or contractor. Most are signed on an inherited template and filed away.
The problems appear only once information has leaked. Thailand's Trade Secrets Act B.E. 2545 (2002) does not protect everything a company calls confidential. It protects information that meets the definition in section 3, and one condition of that definition is in the owner's own hands: appropriate measures to keep the information secret. A loosely written NDA may not help with that at all.
This piece looks at NDAs with outsiders such as partners, investors and contractors. For employees who leave with company information, see An Employee Quits and Takes the Customer List and Source Code.
What does an NDA have to do with trade secret status?
Everything, because the definition of a trade secret has three elements and the last one depends on what the owner does.
“Trade Secrets” means trade information not yet publicly known or not yet accessible by persons who are normally connected with the information. The commercial values of which derive from its secrecy and that the controller of the trade secrets has taken appropriate measures to maintain the secrecy.
| Element in section 3 | What it means in practice | How an NDA helps |
|---|---|---|
| Not yet publicly known or accessible to people normally connected with it | What everyone in the industry knows is not secret, whatever the stamp says | Stops information you send out from becoming freely accessible |
| Commercial value derived from secrecy | You must be able to say what the business loses if it leaks | Stating the permitted purpose helps show the information has value |
| The controller has taken appropriate measures to keep it secret | Something must actually be done, not merely intended | It is evidence of the measures, but should not be the only one |
The third element is why the NDA matters. Send information to an outsider with no confidentiality agreement and the other side can argue you took no appropriate measures, so the information was never a trade secret. Equally, an NDA alone may not be enough if anyone inside your own company can open the file.
How far does the law support sharing secrets under an NDA?
Explicitly. Section 5 allows the trade secret owner to license others to disclose, take or use the secret and to set conditions so that it stays secret.
The trade secrets owner is entitled to disclose, deprive of, or use the trade secrets, or license someone else to disclose, deprive of, or use the trade secrets. He may also stipulate any terms and conditions for the maintenance of the secrecy.
An NDA is therefore a direct use of section 5. Its conditions should answer three questions: for what purpose may the information be used, who on the recipient's side may access it, and when the obligation ends. The clearer the conditions, the easier it is to show when a use fell outside them.
Is breaching an NDA a trade secret infringement?
It can be, if the other elements are met. Section 6 paragraph one defines infringement as disclosing, taking or using a trade secret without consent in a manner contrary to honest trade practices, and paragraph two names breach of contract first in its list.
Acts contrary to honest trade practices under paragraph one shall include breach of contract, infringement or inducement to infringe confidentiality, bribery, coercion, fraud, theft, receiving of stolen property or espionage through electronics or other means.
So breaching an NDA is not only a contract claim; it can feed directly into infringement under section 6. Paragraph one still requires that the infringer knew or had reasonable cause to know the act was contrary to honest practices. An NDA that says clearly what is prohibited goes a long way towards proving that.
What can an NDA not prohibit?
Section 7 lists four situations that are not infringement. An NDA has to be written knowing which of them it can close and which it cannot.
Section 7 (1) says this is not infringement. What you can do is bar your counterparty from passing it on and require anyone it shares with to accept the same terms.
Section 7 (2) concerns state agencies, not private contracts.
Section 7 (3) says this is not infringement, so the NDA should require a recipient claiming independent development to produce development records.
The last paragraph of section 7 removes the reverse-engineering defence where the parties expressly agreed otherwise.
The act under (4) cannot be raised as a justification if the person who conducted reverse engineering expressly agreed otherwise with the owner of trade secrets or seller of the product.
Check your current template for this. If you send product samples, prototypes or software for a partner to test, the NDA needs an explicit reverse-engineering ban. Broad wording such as "no use outside the purpose" may not reach the "expressly" standard section 7 uses.
Which NDA clauses help you get a court order quickly?
The ones that create evidence. Section 8 lets the controller of a trade secret petition the court for an interim injunction where there is clear evidence of infringement, actual or imminent, and that petition can be filed before the main action.
Where there is clear evidence that an infringement of trade secrets has been committed or is imminent, the affected or imminently to be affected controller of trade secrets has the following remedies: (1) Petition the court for an interim injunction, temporarily to stop the infringement of trade secrets; and,
"Clear evidence" is what the NDA should help you build. Three clauses do the real work: identifying or marking confidential documents, recording what was sent to whom and when, and requiring return or destruction with written confirmation when talks end. Without those records it is hard to prove that the information the partner is using came from you.
On damages, section 13 allows the court to include the infringer's profits, and where the infringement was wilful or malicious and destroyed the secret, to add punitive damages.
(3) In case where there is clear evidence that the infringement of trade secrets is conducted willfully or maliciously causing the trade secrets to cease the quality of secrecy, the court is empowered to order the infringer to pay punitive damages in addition to the amount of damages granted under (1) and (2). However, the punitive damages shall not exceed two times the amount of damages under (1) or (2).
If your NDA sets a fixed contractual penalty, have counsel check how it interacts with damages under section 13; the rules on contractual penalties sit in other legislation that is not yet in our library.
How long should the confidentiality obligation last?
The Act does not set a term for NDAs, but two sections should shape your thinking. The first is the limitation period in section 10.
No cases of trade secrets infringement shall be brought after three years from the date where the controller of trade secrets knows of the infringement and of the infringer, however, the period shall not exceed ten years from the date of infringement.
The second is section 11 paragraph two: if the secret later becomes public or ceases to be a trade secret, the person under an injunction can ask the court to lift it. Legal protection lasts only as long as the information stays secret.
In case where the court grants an injunction under Section 8(2) stopping further infringement of the trade secrets, and if at a later stage, the trade secrets have been disclosed to the public or have ceased to be trade secrets, the person enjoined by the court can file a petition to have the order rescinded.
An NDA whose confidentiality duty ends two or three years after the talks may be read as permission to use the information after that date, while it still has value. For formulas, processes or source code, it is safer to tie the obligation to "for as long as the information remains a trade secret". Fast-ageing information, such as a price quote, can have a fixed term.
If the NDA covers customer data, what else is needed?
The PDPA applies as well. Customer lists, contact details and membership databases are both trade information and personal data. When you send them to an outsider, section 37 (2) of the Personal Data Protection Act B.E. 2562 (2019) requires the controller to prevent the recipient from using or disclosing them unlawfully.
(2) in the circumstance where the Personal Data is to be provided to other Persons or legal persons, apart from the Data Controller, the Data Controller shall take action to prevent such person from using or disclosing such Personal Data unlawfully or without authorization;
An NDA helps with this duty but does not replace the PDPA's own requirements. If the partner will process customer data on your behalf, you also need a section 40 agreement; see Before You Sign a Vendor That Touches Customer Data. And before sharing customer data with anyone, you need a lawful basis for the disclosure; see You don't need consent for everything.
Is disclosing someone else's trade secret to the public a crime?
Yes, where the disclosure destroys the secret and is made with malicious intent to damage the controller's business. Section 33 sets the penalty, and section 37 makes the offence compoundable.
Whosoever discloses a trade secret of other person to the public in the manner which causes the trade secret to cease as a secret, with malicious intent to cause damage to the business of the controller of trade secrets, whether by publication through documents, audio or video broadcasting, or disclosure by any other means, shall be liable to imprisonment not exceeding one year or fine not exceeding two hundred thousand baht, or both.
The criminal offence covers malicious public disclosure only. A partner quietly using your information to build a competing product does not automatically fall under section 33; the owner's main route is still the civil remedies in section 8.
A checklist for an NDA that keeps secrets secret
| NDA clause | Why it matters | Section |
|---|---|---|
| An identifiable definition of confidential information, with document marking | Proves what was secret and that measures were taken | Section 3 |
| The permitted purpose | A licence condition that makes out-of-scope use visible | Section 5 |
| Who on the recipient's side may access it, bound by the same terms | Reduces the chance of information reaching an outsider who can claim good faith | Section 7 (1) |
| An express ban on reverse engineering | Closes the section 7 (4) defence | Section 7, last paragraph |
| Records required from a recipient claiming independent development | Answers an independent-discovery defence | Section 7 (3) |
| Transfer logs, and return or destruction with written confirmation | Builds the clear evidence needed for a court order | Section 8 |
| Duration tied to secret status | Stops the contractual duty ending before the secret does | Sections 10 and 11 |
| Personal data used only for the stated purpose, with security measures | The controller's duty when sharing data with outsiders | PDPA section 37 (2) |
For the wider picture, see the guide on protecting trade secrets. If the information you share is source code for a system built by an outside developer, see the copyright side in Outsourced Software in Thailand: Who Owns the Copyright?
Frequently asked questions
Once an NDA is signed, is everything we send a trade secret?
No. The information must meet all three elements of section 3: not publicly known, commercially valuable because it is secret, and protected by appropriate measures. An NDA supports the last element, but it cannot turn what the industry already knows into a secret.
Our partner passed the information to another company. Can we act against that company?
Under section 7 (1) it is not infringement if that company obtained the information through a transaction without knowing, or having reasonable cause to know, that its counterparty took it wrongfully. You can still pursue the partner for breaching the NDA, and you should notify the other company in writing promptly so that its knowledge is clear from that date.
The information has leaked. How fast must we act?
Section 10 requires a claim within three years of knowing of the infringement and the infringer, and never more than ten years after the infringement. To stop use immediately, section 8 allows an interim injunction before filing suit, and section 9 lets the parties agree to ask the Trade Secrets Board to mediate first.
What is the difference between a one-way and a mutual NDA?
The Act makes no distinction; the same principles apply. A one-way NDA fits when only one side shares secrets. If both sides exchange information, use a mutual NDA and check that you can actually meet the obligations you take on for the other side's information.
If we share customer data under an NDA, have we met the PDPA?
Not fully. An NDA helps with the section 37 (2) duty, but you still need a lawful basis for the disclosure, and if the partner processes data on your behalf you need a section 40 agreement covering security measures and breach reporting.
Law and sources
- Trade Secrets Act B.E. 2545 (2002) — Section 3 · 5 · 6 · 7 · 8 · 10 · 11 · 13 · 33
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (2)
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)