Vetting a vendor before signing means checking three things: whether the vendor that will handle your customer data is really a data processor, whether its security meets the 2022 minimum standard, and whether the contract makes it report a breach within 72 hours. This guide is for DPOs, procurement and legal teams approving a new vendor in Thailand.
- PDPA section 40 paragraph three puts the duty to have a processor agreement on the data controller, not on the vendor.
- Clause 6 of the 2022 security notification says the vendor's security measures must meet the minimum standard in clause 4.
- Clause 8 of the 2022 breach notification requires the contract to make the vendor report a breach within 72 hours of becoming aware.
- Calling a vendor a processor in the contract decides nothing; TDPG 4.0 looks at who actually sets the purpose of the processing.
- A processor that fails to comply with section 40 without appropriate reasons faces an administrative fine of up to 3 million baht (section 86).
Almost no company processes all of its customer data in-house. The CRM runs in the cloud, the call centre is outsourced, payroll sits with an accounting firm and customer letters go to a print shop. Every one of them is another place where data can leak, yet when it does, the organisation that answers to Thailand's Personal Data Protection Committee Office (the PDPC Office) is still you.
Most vendor contracts come from the vendor's sales team. Procurement reads the price and the term. Personal data usually gets one paragraph saying the parties "will comply with applicable laws", which does not cover what two PDPC notifications actually require the contract to say.
This piece follows the order in which the work should be done: first decide whether the vendor is a processor at all, then what the law requires in the contract, then a ten-question vendor questionnaire tied to the rules, and finally the deadlines when the breach happens on the vendor's side.
Is this vendor a processor, or another controller?
Ask who decides what data is collected, what it is used for and how. If you decide and the vendor follows instructions, the vendor is a data processor. If the vendor also uses the data for its own business, it is another controller or a joint controller, and the contract has to be written differently.
TDPG 4.0, an industry guideline rather than law and not binding in the way the Act is, puts the point plainly: the label in the contract does not settle the question.
B28 Whether a service provider has the status of a data processor cannot be determined from the name or form of the contract alone. Even if the contract designates the service provider as a data processor, such designation in the contract has no decisive effect on the actual status; the factual circumstances must be the primary consideration.
This matters at signing more than people expect. Many standard contracts call the vendor a "processor" in one clause and, in another, allow it to use the data to "improve its services" or for "marketing analytics". That second clause is the vendor setting its own purpose, which under the TDPG 4.0 approach can change its role.
Examples TDPG 4.0 gives
Most of the TDPG 4.0 examples come from European guidance, and they map neatly onto typical Thai outsourcing. Five of them are summarised below.
The gym sets both purpose and means; the printer only follows instructions.
The client decides where, when and for how long to record; the firm has no say over purpose.
The provider stores data on the customer's behalf and does not use it for its own purposes.
Adding its own purpose makes the agency a controller for that processing, whatever the contract says.
The contract says processor, but TDPG 4.0 treats it as a joint controller with the hiring company.
What must a processor contract contain under Thai law?
At least three things: an agreement must exist, it must set security measures no lower than the minimum standard, and it must require breach reporting within 72 hours. The first comes straight from the Personal Data Protection Act B.E. 2562 (2019).
In carrying out the activities in accordance with the Data Processor's obligations as assigned by the Data Controller under paragraph one, the Data Controller shall prepare an agreement between the parties to control the activities carried out by the Data Processor to be in accordance with the Data Processor's obligations for compliance with this Act.
Section 40 paragraph three places the duty on the data controller. If there is no agreement, it is your obligation that is missing. What the agreement must say is filled in by clause 6 of the PDPC Notification on Security Measures of the Data Controller B.E. 2565 (2022).
In providing for an agreement between a data controller and a data processor, the data controller shall consider requiring the data processor to provide appropriate security measures in order to prevent loss, access, use, alteration, correction or disclosure of personal data without authority or unlawfully, as well as to notify the data controller of any personal data breach that occurs. Such security measures must comply with the minimum standards under Clause 4
Clause 6 opens with "shall consider requiring", which reads like an option, but the same clause then says the measures "must comply with the minimum standards under Clause 4". The safe reading is that the vendor's measures should be no weaker than your own, written into a security annex to the contract.
The third requirement sits in clause 8 of the PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022), which speaks to processor contracts directly.
the data controller must stipulate in the agreement or in the relevant contract that the data processor has a duty to notify a personal data breach to the data controller without delay and within seventy-two hours from the time the data processor becomes aware of it, so far as it is able to do so.
| Requirement | Source | How to write it |
|---|---|---|
| An agreement controlling the processor's work | PDPA section 40 paragraph three | Define scope, data categories and written instructions as the only basis for processing |
| Act only on the controller's instructions | PDPA section 40 (1) | No use for the vendor's own purposes; vendor must flag instructions it believes are unlawful |
| Security no lower than the minimum standard | 2022 security notification, clauses 6 and 4 | A security annex structured by clause 4 (1) to (7) |
| Breach report within 72 hours | 2022 breach notification, clause 8 | Channel, named recipient and the information the first report must include |
| Vendor keeps its own record of processing | PDPA section 40 (3) (small businesses may be exempt under the last paragraph) | A right to see the part that covers your processing |
If the vendor goes beyond your instructions, who is liable?
The vendor is liable for what it does outside your instructions, because section 40 paragraph two treats it as the controller for that processing. That does not release you from your own duties.
The Data Processor, who fails to comply with (1) for the collection, use, or disclosure of the Personal Data, shall be regarded as the Data Controller for the collection, use, or disclosure of such Personal Data.
A vendor that fails to comply with section 40 also faces its own administrative fine under section 86. That is useful leverage: vendors that understand their direct exposure tend to share more detail about their controls.
Any Data Processor who fails to comply with section 40 without appropriate reasons, or fails to send or transfer the Personal Data in accordance with section 29 paragraph one or three, or fails to comply with section 37 (5) which applies mutatis mutandis according to section 38 paragraph two, shall be punished with an administrative fine not exceeding Baht three million.
On the controller's side, section 37 (2) applies every time you hand personal data to someone who is not a controller, and a processor is exactly that.
(2) in the circumstance where the Personal Data is to be provided to other Persons or legal persons, apart from the Data Controller, the Data Controller shall take action to prevent such person from using or disclosing such Personal Data unlawfully or without authorization;
Read section 37 (2) together with section 40 and the practical result is clear. If you send data without checking anything and the vendor misuses it, it will be hard to show you took "action to prevent" misuse. A written questionnaire answered before signing both reduces the risk and becomes your evidence.
What should you ask a vendor before signing?
Send the questions in writing and file the answers with the contract. The first eight questions below map one-to-one to clause 4 of the 2022 security notification; the last two are good practice that the notification does not spell out item by item.
| Question | Tied to | Answer that should worry you |
|---|---|---|
| Who at your company can access our data, and how is access granted? | Clause 4 (6) (a), least privilege | Everyone on the team, for convenience |
| When staff leave or change roles, how fast is access removed, and how often is access reviewed? | Clause 4 (6) (b) | No review cycle |
| Do you prohibit staff from copying data out of the system? | Clause 4 (6) (c) | No written policy |
| Do you log access, changes and deletions, and can we see those logs? | Clause 4 (6) (d) | Logs exist but customers cannot see them |
| Do your measures cover paper records too? | Clause 4 (1) | Only systems are covered |
| How many layers of protection cover servers, clients, network and applications? | Clause 4 (5), defence in depth | A single firewall |
| Do you have incident response and recovery procedures, and when were they last tested? | Clause 4 (3) | A plan that has never been tested |
| How often are staff trained on personal data protection? | Clause 4 (7) | Once, at onboarding |
| Do you subcontract, and in which countries are subcontractors located? | Good practice, read with section 37 (2) | Refuses to name subcontractors |
| At the end of the contract, how is data returned or deleted, and will you confirm in writing? | Good practice, read with section 37 (2) | Deleted on the normal system cycle |
Question four matters more than it looks. After an incident, access logs are often the only way to tell whose data went where. The notification calls them audit trails.
(d) The provision of methods enabling retrospective verification concerning access to, alteration, correction or deletion of personal data (audit trails), appropriate to the methods and media used in the collection, use or disclosure of personal data.
TDPG 4.0 adds one more point that works well as a contract term: the processor should tell you when a more secure option exists. In TDPG it is guidance rather than a legal duty, but once it is written into the contract it becomes a contractual one.
[Proposing security alternatives] The processor has a duty to notify the data controller in cases where it considers that there is a processing alternative with higher security, so that the data controller is aware of such alternative
When the breach happens at the vendor, how do the deadlines run?
There are two windows back to back. First, the vendor must tell you within 72 hours of becoming aware, as the contract must provide under clause 8. Second, you must notify the PDPC Office within 72 hours of becoming aware yourself under section 37 (4), unless the breach is unlikely to result in a risk to people's rights and freedoms.
- Vendor discovers the incidentThe vendor's 72 hours start; it must notify you without delayBreach notification 2022, clause 8
- You are notifiedRun a preliminary fact check; if the risk is high, instruct the vendor to contain or fix it as quickly as possibleBreach notification 2022, clause 5 (1) and (2)
- Within 72 hours of your awarenessNotify the PDPC Office unless there is no risk; if the risk is high, also notify data subjects with the remedial measuresPDPA section 37 (4)
- After the incidentReview your security measures, including those you require of the vendorSecurity notification 2022, clause 5 paragraph two
For how to assess risk once the vendor has reported, and when data subjects must be told, see A Data Leak at 2 a.m.: The First 72 Hours.
Where do vendors' standard contracts usually fall short?
Working through the rules above, there are seven places to check in a vendor's paper. Every one of them is easy to fix in negotiation and very hard to fix after an incident.
- No security annex, only "industry standard" wording that cannot be measured against clause 4 of the 2022 notification.
- Open-ended permission to use data "to improve the service", which may change the vendor's role under TDPG 4.0 point B28.
- Breach reporting "within a reasonable time" instead of the 72 hours required by clause 8 of the breach notification.
- Silence on subcontractors, even though data may end up with a third company or outside Thailand.
- No audit or evidence rights, so you cannot easily show you met section 37 (2).
- No terms on returning or deleting data when the contract ends.
- A very low liability cap for data breaches that nobody on your side has assessed.
If the vendor transfers data abroad, the cross-border rules also apply; see When data leaves Thailand: section 28, step by step. If what you share with the vendor is also commercially confidential, see An NDA That Actually Protects Your Trade Secrets.
With many vendors, record each one in your record of processing activities together with the vetting result and the next review date. AIPDPA has a RoPA register that prints a section 39 report and 40 ready-to-use Thai and English documents to start your side of the contract. See also the guides on processor agreements and security measures.
Frequently asked questions
A large cloud provider will not change its contract. What now?
TDPG 4.0 uses a standard cloud service with little customisation as an example and still treats the provider as a processor, because it stores data on the customer's instructions. If the contract cannot be changed, compare the provider's existing data terms with section 40, clause 6 of the 2022 security notification and clause 8 of the 2022 breach notification, and document your assessment and any compensating measures on your side.
Does a small vendor have to keep a record of processing?
The last paragraph of section 40 allows the duty in (3) to be waived for small processors under rules set by the Committee, but not where the processing is likely to result in a risk to data subjects' rights and freedoms, is not occasional, or involves data under section 26.
If the breach happens at the vendor, does the vendor notify the PDPC Office?
Notifying the PDPC Office under section 37 (4) is the controller's duty. TDPG 4.0 point B17 says the processor has no duty to notify the regulator or data subjects unless the controller assigns that task by contract. The vendor's duty to notify you within 72 hours must be written into the contract under clause 8 of the 2022 breach notification.
Can a security certification replace the questionnaire?
It can support it, because clause 4 (4) of the 2022 security notification refers to standards accepted for businesses of the same type. Still ask whether the systems handling your data were in the audited scope, and get written answers on access removal, access logs and breach reporting.
Our older contracts have none of this. What should we do?
Sign an addendum that adds the section 40 agreement, a security annex based on clause 4 and the 72-hour breach reporting duty under clause 8. If you have many vendors, start with those holding the most data or sensitive data.
Law and sources
- Personal Data Protection Act B.E. 2562 (2019) — Section 37 (2) · Section 40 · Section 86
- PDPC Notification on Security Measures of the Data Controller B.E. 2565 (2022) — Clause 4 · Clause 5 · Clause 6
- PDPC Notification on Criteria and Methods for Notification of Personal Data Breaches B.E. 2565 (2022) — Clause 5 · Clause 8
- Thailand Data Protection Guidelines 4.0 (TDPG 4.0, guidance, not law) — B15–B17 · B22–B28
Text in the "The text" boxes is copied word for word from AIPDPA's legal knowledge base, transcribed from the Royal Gazette and official documents; every edit is checked by the system against that base, character by character. English wording is an unofficial translation; the Thai text prevails. This article is general information, not legal advice for a particular case.
Do it in the system
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)