Data Processing Agreement in Thailand: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in Thailand is the contract a data controller signs with a data processor so that personal data is handled lawfully under Thailand's Personal Data Protection Act B.E. 2562 (2019), known as the PDPA. The controller decides why and how personal data is processed. The processor acts only on the controller's documented instructions. The DPA writes that relationship down and binds the processor to the security, confidentiality and compliance duties the law expects. This guide explains what goes into a Thai DPA, the clauses that matter most, and the local rules you should check. It is general information, not legal advice. For a specific deal, confirm the current position with a Thai lawyer. ## When you need a DPA in Thailand You need a DPA whenever one business processes personal data on behalf of another. Common examples are a cloud or SaaS vendor hosting your customer records, a payroll provider, an email or analytics service, or an outsourced support team. Under the PDPA the controller stays responsible for the data, so the contract is how the controller passes clear instructions down and keeps evidence that the processor is bound. The PDPA also reaches organisations outside Thailand. If a foreign controller or processor offers goods or services to people in Thailand, or monitors their behaviour in Thailand, the Act can still apply. A DPA is useful on both sides of a cross-border arrangement. ## What law governs a DPA in Thailand The core statute is the Personal Data Protection Act B.E. 2562 (2019). It is enforced by the Personal Data Protection Committee (PDPC). The key points for a DPA are: - The processor must process personal data only within the scope the controller instructs. A processor that processes outside those instructions can be treated as a controller for that activity, and takes on controller duties.

• Both the controller and the processor must keep records of processing activities and must put in place appropriate security measures.
• The controller must notify the PDPC of a reportable personal data breach without delay, and where feasible within 72 hours. The processor's job is to tell the controller fast enough for the controller to meet that window.
• There is no general requirement to register the controller or processor with the PDPC.
• Cross-border transfers need an adequate standard at the destination or a recognised safeguard, such as appropriate contractual clauses. Standard contractual clauses or ASEAN model contractual clauses can serve as that safeguard if they carry the content the PDPC requires. The general law of contract in the Civil and Commercial Code sits underneath the PDPA and governs formation, breach and remedies. ## Key clauses in a Thai DPA ### Subject matter and instructions State what personal data is processed, the categories of data subjects, the purpose, and the duration. Make clear the processor acts only on the controller's documented instructions. ### Security measures Require appropriate organisational and technical security suited to the risk, in line with the PDPA. Name concrete controls where you can, such as encryption, access control and logging. ### Confidentiality Bind the processor and everyone it authorises to confidentiality over the personal data. ### Sub-processors Set whether sub-processors are allowed, require prior approval or notice, and flow the same duties down to any sub-processor. ### Breach notification Require the processor to notify the controller without undue delay after becoming aware of a breach, with enough detail for the controller to assess and, if needed, report to the PDPC within the 72-hour target. ### Data subject rights Require the processor to help the controller answer requests to access, correct, delete, or object, which the PDPA gives to data subjects. ### Cross-border transfer If data leaves Thailand, record the safeguard relied on and the destinations involved. ### Return or deletion and audit At the end of the contract, require return or deletion of the data. Give the controller a right to audit or receive evidence of compliance. ## A simple drafting checklist - Name the controller and processor and confirm which is which.
• Describe the data, data subjects, purpose and retention period.
• Limit processing to the controller's written instructions.
• Set the security standard and the breach notice timeline.
• Deal with sub-processors and cross-border transfers.
• Cover data subject rights, audit, and return or deletion on exit.
• Add the governing-law and dispute clause and keep a signed copy on file. ## Keeping your DPAs in order A DPA is only useful if you can find it, prove what it says, and track its deadlines. Many teams end up with signed PDFs scattered across inboxes, so the breach-notice clock and the audit rights get lost. Keeping contracts in one workspace, where clauses, obligations and key dates are structured instead of buried in flat text, makes compliance far easier to run. Tools such as Adira bring drafting, review and obligation tracking together in a single place. Adira's depth is strongest for India today, with other jurisdictions on its roadmap, so for Thai-law specifics confirm the position with local counsel.