PDPA in Contracts

Do we need a data processing agreement under Thai PDPA

Here is how “Do we need a data processing agreement under Thai PDPA” works in practice: Where one party processes personal data on behalf of the other, the Personal Data Protection Act B.E. 2562 (2019) section 40 requires the data processor to act only on the controller's instructions and to implement appropriate security measures, which in practice requires a written processing arrangement. Cross-border transfers are subject to sections 28 and 29, and section 37(4) requires the controller to notify the Office of the PDPC of a personal data breach without delay and within 72 hours where feasible. This is general guidance based on applicable Thai statutes, not legal advice on your specific matter and not a court ruling. Please have counsel review the actual draft before signing. Some documents are only accepted within a validity window set by the receiving authority, so submit inside that window. Talk to our staff to sequence the certification chain for your receiving authority — phone, LINE @nycli, or email.