In-House or Outsourced: How an SME Should Decide and What the Contract Needs

As a business grows, owners keep meeting the same questions. Should we hire a full-time bookkeeper or use an accounting firm? Should we have our own IT team or hire a company to look after the systems? Should we do marketing ourselves or use an agency? Should cleaners and security guards be our employees or come from a contractor? The answer is not that outsourcing is always cheaper or that doing it yourself is always better. It depends on how important the work is to the business's competitive advantage, how much damage is done if the people are missing, and whether the contract really protects the company.

A common problem in practice is deciding on monthly cost alone, then finding later that all the data sits with the provider, that the provider suddenly stops work, or that the work you paid for does not belong to the company. This guide walks through the decision function by function, then points to the contract terms and legal issues to prepare before work is handed out.

The core answer

Decide function by function, looking at three things: whether the work is at the core of your competitive advantage, how much control and company-specific knowledge it needs, and how much the company is hurt if the provider stops work or the relationship ends. Core work involving important data should usually stay under your control, while specialised work or work with fluctuating volume usually suits outsourcing.

The rule (Thai law). Outsourcing does not transfer the company's legal duties. The company remains responsible for its own bookkeeping and tax filing. If a contractor sends people to work in the business, section 11/1 of the Labour Protection Act B.E. 2541 deems the operator the employer of people supplied by others to do work that is part of its production process or business, and requires that they receive fair benefits without discrimination. If a provider processes personal data for the company, the provider is a data processor under the PDPA with duties under section 40, while the company is the data controller and remains responsible to data subjects.

Our practical view. Before outsourcing, write three things into the contract: who gets access to which data and accounts, who owns the work delivered, and how, and within how many days, the work will be handed over if the relationship ends. These three decide whether the company can stand on its own feet when something goes wrong.

1. Decision framework: 4 questions

1. Is this work what customers buy from us? If so, for example production skill or specialised knowledge, keep it in the company.
2. If the provider disappeared tomorrow, would the business stop? If so, you need a backup plan, or keep copies of the data, documents and access rights at the company.
3. Is the volume steady or fluctuating? Work that swings widely usually suits engagement by the job. Work that arises daily and needs knowledge of the company's context usually suits a permanent employee.
4. Can you realistically find the specialist yourself? For some work, such as complex tax or system security, a specialist provider has knowledge that a small business would not find worthwhile to hold in-house.

Do not use cost figures as the only criterion. The costs often forgotten are the owner's time spent supervising the provider, the damage when something goes wrong, and the cost of switching when you must change provider.

2. Comparison table by function

3. What an outsourcing contract needs

The principle is to write it as if preparing for the end of the relationship from the start.

1. Scope of work and exclusions. List the work as items, and require anything outside the scope to be agreed afresh in writing.
2. Service levels (SLA). Response time, fix time, availability, and the consequences of falling below the standard. See MSA and SLA for monthly service contracts.
3. Access to data and systems. The main administrator account should belong to the company, and the provider should use accounts with only the access it needs.
4. Confidentiality and PDPA. A confidentiality agreement, and a data processing agreement if the provider sees personal data.
5. Intellectual property. Who owns work created for the company, when the rights transfer, and how the provider's pre-existing tools remain its own.
6. Liability and insurance. A liability cap, what sits outside the cap, such as breach of confidentiality or fraud, and the insurance the provider must carry.
7. Termination and handover. The advance notice period, what the provider must return, and help during the transition.
8. Subcontractors. Whether the provider may have others carry on the work, and whether it must give notice first.

Sample wording on handover at the end of the contract (adapt to the actual work)
When this contract ends for any reason, the Service Provider must deliver the
documents, data, original files, passwords and administrator rights relating to
the work under this contract to the Company within the specified time, and
provide the assistance necessary to change service provider during the agreed
transition period.

4. Data and PDPA when others access customer data

When a provider collects, uses or discloses personal data on the company's instructions, it is a data processor. Section 40 of the Personal Data Protection Act B.E. 2562 sets the processor's duties, such as acting on the instructions received from the data controller, putting appropriate security measures in place, notifying the controller of a data breach, and keeping records of processing activities.

What the company should do

• Check where the provider stores the data, including whether data is sent abroad.
• Make a written data processing agreement setting the purpose, scope, measures, and deletion or return of data when the contract ends.
• Set the time within which the provider must notify the company of a leak, because the company has its own deadline for notifying the Office. See the data breach response plan.
• Tell data subjects as appropriate in the privacy notice. See the PDPA checklist.

Passing the work to a provider does not relieve the company of responsibility. As data controller, the company must choose a provider with adequate measures and keep checking.

5. Accounting and tax liability stays with the company

If you hire an accounting firm, the company is still the person with the duty to keep accounts under the accounting law and to file the juristic person's tax returns. The accounting firm acts as a helper. The consequences are:

• Keep original documents, tax invoices, contracts and receipts at the company, not only at the accounting firm.
• Set in the contract within how many days the accountant must deliver the financial statements and tax returns to the company for review before filing.
• The company should check that returns said to be filed have real filing evidence, and not rely on word of mouth alone.
• If you find the former accountant filed incompletely or made mistakes, see how to fix it and hand over the work in changing accountants when tax filings are missing.

For many types of service fees paid to providers, the company has a duty to withhold tax and remit it under the Revenue Code. The category of income and the rate depend on the nature of the service and the recipient, so check with your accountant before the first payment. For fees paid abroad, see VAT and withholding tax on overseas service fees.

6. Labour law: cleaners, security guards and contractors who send people

Hiring a contractor to send people to do work that is part of our business does not mean the company escapes labour law. Section 11/1 of the Labour Protection Act B.E. 2541 deems the operator the employer of people supplied by others to do work that is part of its production process or business, whether or not the supplier controls them or pays their wages, and requires that subcontracted workers receive fair benefits and welfare without discrimination compared with direct employees doing the same kind of work.

In practice

• Check whether the work is part of the company's production process or business; for example, production staff and general cleaning may differ.
• Check that the contractor really pays wages, social security and statutory entitlements, and ask for evidence periodically.
• State in the contract the right to inspect and the right to deduct from the service fee if the contractor does not pay its own workers their entitlements.
• Although section 11/1 does not depend on who controls the work, the risk rises further if the company gives orders as if the people were its own employees.

For detail see outsourced labour and subcontracted workers. For a freelancer who has worked continuously for one company for several years, see long-term freelancer or employee.

7. Knowledge and dependency risks

The risk that does not show in a cost table is that the company slowly loses its own knowledge.

• Knowledge sits with the provider. Require documentation, work procedures and manuals to be delivered to the company periodically, not only when the contract ends.
• Locked in to one provider. Avoid contracts with heavy penalties on exit, or file formats that open only in the provider's system.
• Key accounts in the provider's name, such as the domain, page or advertising account, which is the cause of common disputes. See employee or agency not returning the company's accounts.
• The provider as an indirect competitor. If it knows our customers and prices, have a confidentiality agreement and a ban on using the information for other purposes.

8. Changing provider or bringing the work back in-house

Whether you move to a new provider or take the work back, plan before giving notice.

1. Read the existing contract on notice periods and termination conditions.
2. Ask for copies of all data, documents and access rights before formally giving notice, if the contract gives that right.
3. Have the new provider or the in-house team take over while the old provider is still working for a short period.
4. Check and confirm the data received before closing the old provider's access.
5. For legal advisers or other professional services, see switching company legal advisers and handing over work.

9. Checklist before deciding

• Answer the 4 questions in section 1 for each function
• Identify the legal duties that remain with the company, such as accounting, tax and data protection
• The contract has scope of work, SLA, consequences of falling below standard, and a liability cap
• The main administrator account and key data are under the company's control
• There is a data processing agreement with any provider that sees personal data
• The owner of copyright or right to use the work produced is stated
• There is a handover procedure at the end of the contract and an advance notice period
• For contractors who send people, check the effect of section 11/1 (the company may be treated as the employer) and ask for evidence that entitlements are paid
• Agree with your accountant on value added tax and withholding tax on the service fees

Further reading

• MSA and SLA for monthly service contracts for drafting service level agreements
• Outsourced labour and subcontracted workers for section 11/1 in detail
• Long-term freelancer or employee when you engage an individual to work continuously
• Changing accountants when tax filings are missing when you have to change provider
• Switching company legal advisers and handing over work for the handover steps
• Employee or agency not returning the company's accounts on pages, domains and LINE OA

You can outsource without losing control if the company holds the main accounts and data itself, writes the scope and SLA clearly, and sets the handover procedure before the day the relationship has to end.

We draft and review service contracts, confidentiality agreements and data processing agreements, and help with handover documents when you change provider. For an initial consultation, call +66 92 254 2045 or send us the details. See also contracts and documents and monthly legal retainer.

This guide is published by Suwanvara Law Firm — a Khon Kaen law firm established in 1986. General information only, not legal advice on a specific matter.