SaaS Agreement in Thailand: Template, Key Clauses and Local Law (2026)

A software-as-a-service (SaaS) agreement in Thailand lets a customer use software hosted by a provider over the internet, in return for a subscription fee. It is a services and licence contract, not a sale of software. Thailand has no dedicated SaaS statute, so the agreement draws on general contract law plus the data-protection and electronic-transaction rules that apply to online services. This guide explains the local framework, lists the clauses a Thai SaaS agreement should contain, and gives a skeleton you can adapt. It is general information, not legal advice. Confirm the current position with a qualified Thai lawyer before you sign. ## The law that governs SaaS in Thailand Several laws shape a SaaS deal in Thailand: - Civil and Commercial Code. The general law of contract governs formation, performance, breach, and remedies for the subscription.

• Personal Data Protection Act B.E. 2562 (2019) (PDPA). This is the central law for any SaaS that processes personal data. It sets rules on lawful basis, consent, data-subject rights, security measures, data-breach notification, and cross-border transfers. The provider is often a data processor acting for the customer, so the contract needs a clear data-processing arrangement.
• Electronic Transactions Act B.E. 2544 (2001). This gives legal effect to electronic contracts and electronic signatures, which supports click-through acceptance and online order forms.
• Foreign Business Act B.E. 2542 (1999). A foreign provider supplying services in Thailand may face restrictions on certain service activities and need a licence, so check how the service is classified.
• Consumer protection law. If the customer is a consumer rather than a business, consumer-protection rules may limit exclusions and unfair terms. ## Why PDPA shapes the contract Because most SaaS handles personal data, the PDPA is usually the most important part of the deal. The agreement (or a data-processing addendum) should: - Say who is the controller and who is the processor.
• Limit the provider to processing data only on the customer's instructions.
• Require appropriate security measures.
• Set breach-notification duties.
• Deal with sub-processors and cross-border transfers, which the PDPA restricts unless adequate safeguards apply.
• Cover help with data-subject requests and deletion or return of data at the end. ## Key clauses in a Thailand SaaS agreement ### 1. Parties and definitions Name the provider and customer and define the service, users, and the subscription. ### 2. Grant of access and licence Give the customer a non-exclusive, non-transferable right to access and use the service for the term, within stated user limits. ### 3. Subscription, fees and renewal Set the fees, billing cycle, renewal terms, and price-change mechanism, plus taxes and withholding tax treatment. ### 4. Service levels and support State uptime commitments, support hours, response times, and remedies such as service credits. ### 5. Customer data and ownership Confirm the customer owns its data, and that the provider gets only the limited rights needed to run the service. ### 6. Data protection (PDPA) Add the controller and processor roles, processing instructions, security, breach notification, sub-processors, and cross-border transfer safeguards under the PDPA. ### 7. Security Set security standards, access controls, and audit rights proportionate to the data involved. ### 8. Intellectual property Confirm the provider keeps ownership of the software and any improvements, and license only the right to use the service. ### 9. Acceptable use Set out prohibited uses and the provider's right to suspend for breach or security risk. ### 10. Warranties and disclaimers Give limited performance warranties and disclaim the rest to the extent Thai law allows. ### 11. Liability Cap liability and exclude indirect loss, keeping the Unfair Contract Terms Act B.E. 2540 (1997) in mind, since a Thai court can adjust terms that are excessively one-sided. ### 12. Term, termination and exit Set the term, termination grounds, and what happens at the end, including return or deletion of customer data and a transition period. ### 13. Confidentiality Protect each party's confidential information during and after the term. ### 14. Governing law and disputes Choose Thai law if the service is used in Thailand, and a forum (Thai courts or arbitration). Note the contract language and whether a Thai version prevails. ## A simple clause skeleton 1. Parties and definitions

2. Access and licence
3. Subscription, fees and renewal
4. Service levels and support
5. Customer data and ownership
6. Data protection (PDPA)
7. Security
8. Intellectual property
9. Acceptable use
10. Warranties and disclaimers
11. Liability
12. Term, termination and exit
13. Confidentiality
14. Governing law and disputes
15. General provisions ## One workspace to draft, review and track the agreement SaaS contracts rarely stand still. Renewal dates, auto-renewal notice windows, price changes, and the data-processing addendum all have to be tracked, and a provider often runs many versions of the same base contract across different customers. When these sit across inboxes and drives, the live version and the next renewal date are easy to lose. Adira is an AI legal operating system that keeps drafting, review, clause-level editing, version history, and key-date tracking in one workspace, so the master SaaS terms, each customer's signed version, and renewal dates stay connected. Indian law is deepest today, and wider non-India jurisdiction depth, including Thailand, is on the roadmap, so treat this page as general guidance and verify Thai specifics locally. You can see the product at Adira. ## Frequently asked questions