A data processing agreement is the contract a Thai data controller must put in place with each processor under Section 40 of the PDPA, to keep the processor acting only on instructions, securing the data and reporting breaches within 72 hours. Procurement, legal and DPOs get the clauses that cannot be left out, each marked as law, notification or guidance.
- PDPA Section 40, paragraph three requires the controller to put an agreement in place with every processor to keep its work within the Act.
- Clause 8 of the 2022 Breach Notification requires the contract to oblige the processor to report a breach within 72 hours of becoming aware.
- Clause 6 of the 2022 Security Measures Notification ties the processor's security to the minimum standard in Clause 4.
- A processor that acts outside instructions is treated as a controller for that processing (Section 40, paragraph two).
- TDPG 4.0 notes the controller cannot contract its way out of statutory liability by shifting blame to the processor (guidance).
A typical mid-sized Thai company has more data processors than it thinks: the payroll provider, a cloud CRM, the agency that sends marketing email, the security firm that monitors CCTV. Each one handles personal data on the company's behalf, and most were signed up on a quotation and a service contract with no data clauses at all.
TDPG 4.0 names the problem directly. Ordinary service contracts usually cover scope, fees, liability and intellectual property, and say nothing about personal data protection. This article sets out what an agreement with a processor must contain, and says plainly whether each clause comes from the Act, a PDPC notification, or guidance only.
Does Thai law really require a contract with every processor?
Yes, and the duty sits with the controller, not the vendor. Section 40, paragraph three of the Personal Data Protection Act says the controller "shall prepare" an agreement. It is not a recommendation.
In carrying out the activities in accordance with the Data Processor's obligations as assigned by the Data Controller under paragraph one, the Data Controller shall prepare an agreement between the parties to control the activities carried out by the Data Processor to be in accordance with the Data Processor's obligations for compliance with this Act.
Section 37(2) adds a second layer: when data is provided to another person, the controller must act to prevent that person from using or disclosing it unlawfully. The agreement is the most obvious tool for doing so.
You do not have to tear up the existing contract. TDPG 4.0, at K5, suggests a separate Data Processing Agreement (DPA) made part of the principal service agreement. Large cloud providers do exactly this with an addendum.
How do you know the vendor is a processor and not a controller?
Look at what it actually does, not at the label in the contract. TDPG 4.0, at B28, stresses that calling a provider a processor in the contract does not settle its status. TDPG's example is a marketing agency labelled a processor that also used the client's customer database to promote other clients' products, and so became a controller for that processing.
The Act states the consequence itself. A processor must act only on instructions; if it acts outside them, the law treats it as a controller for that processing, with all of a controller's duties.
The Data Processor, who fails to comply with (1) for the collection, use, or disclosure of the Personal Data, shall be regarded as the Data Controller for the collection, use, or disclosure of such Personal Data.
Which clauses can the agreement not do without?
The table lists ten clauses and shows where each comes from. Clauses drawn from the Act or a Committee notification are binding. Clauses from TDPG 4.0 are industry guidance, not law, but they fill gaps the statute leaves open.
| # | Clause | Source | Status |
|---|---|---|---|
| 1 | Process only on the controller's written instructions | s.40(1) · TDPG K5 | Law + guidance (on writing) |
| 2 | Processor checks instructions are lawful; controller warrants they stay within the purpose | s.40(1) · TDPG K5 | Law + guidance |
| 3 | Limit access to those who need it, under a duty of confidentiality | TDPG K5 · Security Notification Cl. 4(6) | Guidance + notification |
| 4 | Security measures at or above the minimum standard | s.40(2) · Security Notification Cl. 6 | Law + notification |
| 5 | Report breaches to the controller within 72 hours of the processor becoming aware | s.40(2) · Breach Notification Cl. 8 | Law + notification (must be in the contract) |
| 6 | Help the controller answer rights requests and pass on requests received | TDPG K5 | Guidance |
| 7 | Erase or destroy data within a set number of days after termination, and follow the 2567 erasure notification on erasure requests | TDPG K5 | Guidance |
| 8 | No transfer abroad without the controller's written consent | TDPG K5 · s.28 | Guidance + statutory conditions |
| 9 | Sub-processors only with prior authorisation, bound by the same duties | TDPG B21 | Guidance |
| 10 | Processor keeps its own record of processing activities | s.40(3) | Law |
Clauses 1-2: instructions must be clear and provable
Section 40(1) says the processor must follow instructions but not what form they take. TDPG 4.0 adds that they should be in writing. The practical reason: when something goes wrong, both sides must be able to point to what the instruction was. If instructions live in a chat thread or a phone call, nobody can prove who exceeded them.
The data processor shall not process personal data beyond the instructions of the data controller (which are in writing)
Clauses 3-4: security needs a standard behind it
"The contractor will keep data appropriately secure" is not enough. Clause 6 of the 2022 Security Measures Notification tells the controller to consider requiring the processor, in the agreement, to have appropriate measures and to report breaches, and those measures must meet the minimum standard in Clause 4.
In providing for an agreement between a data controller and a data processor, the data controller shall consider requiring the data processor to provide appropriate security measures in order to prevent loss, access, use, alteration, correction or disclosure of personal data without authority or unlawfully, as well as to notify the data controller of any personal data breach that occurs.
To make the clause testable, attach a security schedule that follows Clause 4 of the Notification: access control on a least-privilege basis, review and removal of user rights, audit trails of access and changes, and staff awareness. Each item is explained in one security checklist for both the PDPC and the NCSA.
Clause 5: breach reporting, the one clause a notification orders into the contract
Clause 8 of the 2022 Breach Notification says the controller "must stipulate" it in the agreement or contract. It is not optional; a contract without it means the controller has not complied with the Notification.
the data controller must stipulate in the agreement or in the relevant contract that the data processor has a duty to notify a personal data breach to the data controller without delay and within seventy-two hours from the time the data processor becomes aware of it, so far as it is able to do so.
Note the two clocks. The processor's 72 hours run from when the processor becomes aware. The controller's 72 hours to notify the PDPC Office under Section 37(4) run from when the controller becomes aware. If the processor uses all 72 hours before telling you, you are left with very little time to investigate. TDPG 4.0 allows the contract to set a shorter period, but not a longer one.
- The processor must report every breach to the controller, without the risk assessment the controller makes (TDPG 4.0, Chapter J).
- A processor serving several companies must report details separately to each controller (TDPG 4.0, Chapter J).
- The contract may let the processor notify the PDPC Office on the controller's behalf with proper authorisation, but legal responsibility stays with the controller (TDPG 4.0, Chapter J).
- Specify who to notify, through which channel, and what the report must contain, such as when the incident happened, the systems involved and the number of records affected (AIPDPA team practice).
A data processor may notify a data breach on behalf of the data controller, if the data controller has given proper authorization and such action is part of the agreement made between the data controller and the data processor.
Clauses 6-10: the ones nobody thinks about until the contract ends
These clauses look minor at signing and become the problem at exit: a customer asks for erasure and the vendor does not delete; you switch providers and cannot say where the old data went; or you discover the vendor quietly passed the work to a company abroad.
TDPG 4.0, at K5, suggests stating the number of days for deletion after termination, requiring the processor to share its deletion policy, and following the Committee's 2024 (B.E. 2567) notification on erasure or destruction when a data subject asks for erasure. Transfers abroad should be barred unless the controller consents in writing, because cross-border transfers carry their own conditions under Section 28.
B21 A processor may wish to engage another processor (sub-processor) to carry out part or all of the processing activities on its behalf. Such engagement must have the prior authorization of the controller, which may be specific authorization or general authorization.
The last clause restates the processor's own statutory duty under Section 40(3): to prepare and keep a record of its processing activities under the Committee's rules. Repeating it in the contract, with a right to see that record, helps the controller know which systems hold its data.
Can you make the processor carry all the liability?
Between the parties, yes. Against the data subject, no. TDPG 4.0, at K6, gives the example of a processor that ignores an erasure request: the controller, which has the statutory duty to erase, remains liable to the data subject and can then claim against the processor for breach of contract.
the data controller still cannot invoke the provisions in such agreement to relieve itself from legal liability.
What should you check before signing?
- List every vendor that handles personal data on your behalf, starting from the recipients column of your RoPA.
- Decide which are processors and which are separate controllers, based on what they actually do (TDPG B28).
- Read the large providers' own DPAs, which usually exist as addenda. Check for a 72-hour breach clause under Clause 8 of the Notification, since DPAs written for foreign law may use a different timeframe.
- Where there is no DPA, use your own agreement and make it part of the principal contract.
- Attach a security schedule that follows Clause 4 of the 2022 Notification.
- Name breach contacts on both sides and test that channel once a year (good practice).
- Record each processor in your RoPA so that, when an incident happens, you can say at once who holds the data.
If a breach has already happened, the first-72-hours sequence is in Data breach: what to do in the first 72 hours. If your vendor is overseas, continue with Section 28 step by step.
Frequently asked questions
Do we need a separate contract when we outsource data processing?
PDPA Section 40, paragraph three requires the controller to put an agreement in place with the processor; it does not require a separate document. TDPG 4.0 suggests a separate agreement made part of the principal contract, without terminating the existing one.
What breach-reporting deadline should a processor contract set?
Clause 8 of the 2022 Breach Notification requires the contract to oblige the processor to notify the controller without delay and within 72 hours of the processor becoming aware. TDPG 4.0 allows a shorter period.
Our foreign cloud provider already has its own DPA. Can we just use it?
Often as a base, but check it covers what Thai rules require, especially 72-hour breach reporting under Clause 8 of the Notification and the cross-border conditions in Section 28.
Who is liable if the processor goes beyond our instructions?
Section 40, paragraph two treats the processor as a controller for that processing. The original controller should still consider its own duties, such as Section 37(2) on preventing recipients from misusing data.
Can the contract make the processor bear all liability?
Between the parties, yes, but TDPG 4.0 at K6 says the controller cannot rely on that clause to escape statutory liability. It answers to the data subject first and then claims against the processor under the contract.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (2) · 40
- PDPC Notification on Security Measures of Data Controllers B.E. 2565 (2022) — Clause 4 · Clause 6
- PDPC Notification on Rules and Procedures for Personal Data Breach Notification B.E. 2565 (2022) — Clause 8
- TDPG 4.0 Thailand Data Protection Guidelines (industry guidance, not law) — TDPG4.0-B Clause B21 · TDPG4.0-J · TDPG4.0-K Clause K5 K6
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)