How to put a data processing agreement (DPA) in place with vendors in Thailand A data processing agreement (DPA) is the agreement that Section 40 of the Personal Data Protection Act B.E. 2562 (2019) requires a data controller to put in place when a data processor handles personal data on its behalf, so the processor's work stays in line with the Act. It should bind the processor to its Section 40 duties: act only on your instructions, keep appropriate security, report breaches to you and keep a record of processing.
A mid-sized recruitment agency runs payroll on a cloud platform and uses an SMS provider to contact candidates. One morning the payroll provider mentions that its server was breached the week before. When the managing director opens the contract, it says nothing about personal data, breach reporting or deleting data.
What you need to know
The 5 points that matter most, drawn from the law and guidance cited at the end of this guide. Read just this part and you can decide your next move.
- Section 40 requires the controller to have an agreement with each processor that keeps its work in line with the PDPA.
- A processor may act only on the controller's instructions, unless an instruction is unlawful.
- A processor must keep appropriate security measures and tell the controller about any personal data breach.
- A processor that goes beyond your instructions is treated as the controller for that processing.
- The controller must still notify the PDPC Office within 72 hours under Section 37(4), so the DPA should require the processor to report quickly.
How to do it in 6 steps
Work through these 6 steps in order. Each one is written so a team in a Thai organisation can act on it without waiting for a consultant, and keep the evidence an auditor will ask for.
- Identify which vendors are processorsList the providers that handle personal data for you, such as payroll, cloud hosting, couriers, call centres or security guards, and mark those that act on your instructions as processors.
- Define scope and instructionsState which personal data, about whom and for what purpose, and require the processor to act only on your documented instructions, in line with Section 40(1).
- Bind security measuresRequire appropriate security measures under Section 40(2) and spell out the controls you expect, such as access control and encryption.
- Set a breach-reporting deadlineSection 40(2) requires the processor to report breaches to you. A good practice is a deadline well inside 72 hours, such as 24 hours, so you can still notify the PDPC Office on time under Section 37(4).
- Cover records and deletionRequire the processor to keep a record of processing under Section 40(3), and to return or delete the data when the contract ends so you can meet Section 37(3).
- Add audit rights and sub-processor controlA good practice is to reserve a right to audit or request evidence, and to require your approval before the processor uses any sub-processor.
Why do you need a data processing agreement?
Section 40 says that where a processor carries out work assigned by a data controller, the controller must put an agreement in place to keep the processor's work in line with the Personal Data Protection Act B.E. 2562 (2019).
Section 37(2) adds that when you give personal data to anyone who is not a data controller, you must take steps to stop them using or disclosing it without authority or unlawfully. A contract is the main tool for doing that.
What duties does a processor have under Section 40?
Section 40 sets three duties for processors, and a good DPA turns each one into a contractual obligation.
Duty (3) may be waived for small businesses under criteria set by the PDPC, but not where the processing risks people's rights and freedoms, is more than occasional, or involves Section 26 sensitive data.
- (1) Collect, use or disclose personal data only on the controller's instructions, unless the instruction is unlawful.
- (2) Keep appropriate security measures and notify the controller of any personal data breach.
- (3) Prepare and keep a record of processing activities under rules set by the PDPC.
What happens if a processor goes beyond your instructions?
Section 40 treats a processor that does not follow the controller's instructions as the data controller for that collection, use or disclosure, so it must then answer for that processing as a controller.
How many hours should a DPA allow for breach reporting?
Section 40(2) does not set a number of hours for the processor. But the controller must notify the PDPC Office without delay and, where feasible, within 72 hours of becoming aware under Section 37(4), so the DPA should require the processor to report much sooner.
If a breach is high-risk to people's rights and freedoms, the controller must also tell the data subjects, with remedies, without delay. The DPA should therefore require the processor to send the facts needed to assess the risk.
Common problems and how to fix them
Most organisations slip on the same 3 points. The table shows how to fix each one yourself, and how AIPDPA gets it done faster with the evidence in place.
| Problem | Fix |
|---|---|
| ✗ Relying on a standard service contract with no personal data terms. | ✓ Attach a data processing agreement to the main contract that covers all three Section 40 duties. AIPDPA's DPA template comes in Thai and English, ready to use once you add the vendor's details. |
| ✗ Not knowing which vendors still lack a DPA. | ✓ Keep a vendor register showing each vendor's role and contract status. AIPDPA's vendor register records whether a vendor is a processor, whether its contract has DPA terms, how many hours it has to report a breach and whether you have audit rights, and scores each vendor's risk. |
| ✗ No reporting deadline, so the 72-hour window has closed before you hear about the breach. | ✓ Write a reporting deadline and the facts to be supplied into the contract. Once you log the breach, AIPDPA's breach register starts a 72-hour countdown and gives you a risk assessment and ready-to-use letters to the PDPC Office. |
Ready-to-use DPAs, and an instant view of which vendors lack one
AIPDPA's vendor register flags processors without DPA terms, and its Thai and English DPA template, is ready to use. See the demo account, no sign-up needed.
Included in the GROWTH, PRO and ENTERPRISE plans, from 4,900 THB/year · demo account, no sign-up
Frequently asked questions
The questions people search for most on this topic. Each answer is short, direct and stands on its own.
What is the difference between a data controller and a data processor?
In practice, a processor handles personal data on the controller's behalf, and Section 40(1) says it may act only on the controller's instructions. A processor that acts outside those instructions is treated as the controller for that processing.
Do we need a DPA with every vendor?
You need one with every vendor that processes personal data on your behalf, because Section 40 requires an agreement to control a processor's work. Vendors that never touch personal data do not need one.
Does the DPA have to be a separate contract?
Section 40 requires an agreement but does not prescribe its form, so a separate contract or an annex to the main contract both work. A good practice is to put it in writing so you can prove it.
Do processors have to keep their own RoPA?
Yes. Section 40(3) requires processors to keep a record of processing activities, unless a small-business exemption set by the PDPC applies and the processing is not of a type that cannot be exempted.
Does an overseas cloud provider need to sign a DPA?
If it processes personal data on your behalf, you need an agreement under Section 40. Large providers often offer standard terms, so check they cover all three Section 40 duties; cross-border transfer rules are a separate question.
Sources
This guide relies on 4 sources. Statutes are cited by section or clause; guidelines and standards are guidance, not law.
- Personal Data Protection Act B.E. 2562 (2019), Section 40
- Personal Data Protection Act B.E. 2562 (2019), Section 37(2)
- Personal Data Protection Act B.E. 2562 (2019), Section 37(3)
- Personal Data Protection Act B.E. 2562 (2019), Section 37(4)
The law cited here comes from AIPDPA's legal knowledge base, transcribed from the Royal Gazette · This is general information; if your situation has unusual facts, our lawyers can review it with you.
Tools and services that help right now
Want to do it yourself, faster? Use the tools in AIPDPA. Want a lawyer to handle it, or to learn the skill yourself? Pick the service in our network that fits.
Know who processes data for you, how risky they are and whether the contract is in place.
Join the waitlist →40 ready-to-use documents in Thai and English, with all 88 AI-added clauses confirmed, filled from your registers, with a QR to verify the approved copy.
Join the waitlist →A 72-hour countdown starts the moment you log an incident, with a risk assessment and ready-to-send letters to the PDPC Office and data subjects.
Join the waitlist →A lawyer-led team checks your readiness and sets up PDPA end to end — ideal for SMEs without the time.
See the service →Plain explanations of Thai contracts with the sections, stamp duty and tax.
Open the knowledge base →
Who stands behind this guide?
Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel
Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)
Keep reading
Guides that usually come next after this one. Read them in the order your organisation needs.