PDPA Thailand S40: Section 40 Duties of the data processor and the controller-processor agreement

The processor must (1) process only on the controller's instructions unless they are contrary to law or the Act; (2) provide appropriate security measures against unauthorised or unlawful loss, access, use, alteration, correction or disclosure and notify the controller of any breach; and (3) prepare and keep records of processing activities under Committee rules. A processor that goes beyond instructions is treated as a controller for that processing. The controller must put an agreement in place to control the processor's activities in line with its obligations under the Act. Item (3) may not apply to a small organisation under Committee rules unless the processing risks data subjects' rights, is not occasional or involves section 26 data.