Monthly Service Contract in Thailand: What the MSA and SLA Must Say

The core answer

A monthly service business (IT support, agency work, outsourced operations, consulting) should not run on one short quotation or a copied template. Use three layers: a master service agreement (MSA) with the terms that never change, a statement of work (SOW) or order form for each package, and an SLA that sets measurable service levels and the consequence of missing them.

The rule (Thai law). There is no special statute for MSAs or SLAs. They are ordinary contracts under the Civil and Commercial Code. Four rules shape the drafting: penalty clauses can be reduced by a court (section 383), advance exclusions of liability for fraud or gross negligence are void (section 373), standard-form terms that give one side an unreasonable advantage are enforceable only as far as fair (Unfair Contract Terms Act B.E. 2540), and a provider that handles customer personal data is usually a data processor (PDPA section 40).

Our practical view. Most disputes over monthly services are about three things: what was in scope, whether the service level was met, and how much the provider must pay if not. Put those three in plain numbers, and the rest of the contract becomes easier to defend.

For contracts that deliver custom software, read software development contracts and source code as well. This guide covers the recurring-service side.

1. How should the MSA, SOW and SLA fit together?

Write an order of precedence in the MSA, for example: SOW first for scope and price, then SLA for service levels, then MSA. Without it, a customer's purchase order terms or an old quotation can compete with your contract. Also state that the customer's own standard terms do not apply.

Section 587 of the Civil and Commercial Code defines hire of work as a promise to complete a job for a fee payable for the result. A monthly package often mixes result-based work (a report, a delivered fix) with ongoing effort (monitoring, support hours). Say in the SOW which parts are results and which are effort, because the legal consequences of "not finished" differ.

2. How do we define scope and handle change requests?

• List what is included, and what is expressly excluded (for example hardware faults, third-party outages, training).
• State volumes: support hours, number of tickets, number of posts or campaigns, number of users. Say what happens above the limit (rate card or a change request).
• Set a change request procedure: written request, impact on scope, fee and timeline, and no work counted as in scope until both sides approve in writing. Email approval is fine if the contract says so.
• Name the customer's duties: access, data, decisions within a set number of working days. State that SLA time stops while the provider waits for the customer.

Fee payable on acceptance is the default for hire of work (section 602), unless the contract provides otherwise. For monthly packages, write the invoice date and the payment period yourself.

3. How should service levels and credits be written?

Pick a few measures you can actually count, and state how and by whom they are measured.

The rule (Civil and Commercial Code). Sections 379 to 383 deal with penalty clauses. A creditor may claim the penalty instead of performance (section 380), and, where the clause covers defective or late performance, both performance and the penalty (section 381), but if it accepts late performance it keeps the penalty claim only by reserving that right when it accepts. Under section 383, if the penalty is disproportionately high the court may reduce it to a reasonable amount, looking at all of the creditor's lawful interests, not only money. Once the penalty has been paid, the right to ask for reduction ends.

Our practical view. A service credit is safest when it looks like a price adjustment for a lower service, not a punishment. Keep it as a percentage of the monthly fee for the affected service, cap total credits per month, and say whether credits are the sole remedy for that kind of failure. Add a right to terminate for repeated failure (for example, the same target missed in three months out of six). A court may still review the figure, so do not build a business case on a large credit being enforced in full.

Hypothetical example. A monthly support package costs 100,000 baht. The SLA gives a 5% credit for each 0.5% of availability below target, capped at 20% of the monthly fee. The credit is easy to explain as a price reduction and unlikely to look disproportionate. A clause demanding 100% of the fee for any outage would invite a challenge.

4. How should fees, price changes and late payment be handled?

• State the fee as exclusive of VAT, and say who pays bank charges.
• Allow a price change only by written notice a fixed number of days before the renewal date, with the customer's right to leave instead of accepting. A clause letting the provider raise prices at any time is the kind of term that can be struck down if it sits in your standard form (see section 5).
• For late payment, specify the interest rate and a right to suspend service after written notice. If the contract is silent, a statutory default rate applies; ask us to confirm the current figure before you rely on a number.
• For acceptance, say what counts as accepted (a signed form, or silence for 7 days) and who may accept. Under section 598, a customer who accepts work with a defect and raises no objection releases the contractor, except for defects that could not be found at handover or that the contractor concealed. Section 600 sets a one-year default period for defects unless the contract provides otherwise. Many providers shorten or restate this in the SLA.

5. How far can we cap or exclude liability?

The rule (section 373). An advance agreement that excludes the debtor's liability for its own fraud (kon chalam) or gross negligence is void. The section does not use the word "wilful", so our usual carve-out also covers intentional breach and misconduct, to avoid argument.

The rule (Unfair Contract Terms Act B.E. 2540). Section 4 applies to consumer contracts, standard-form contracts (written contracts whose essential terms one party fixed in advance for use in its business), and sale-with-redemption contracts. A term that gives the drafter an unreasonable advantage binds only as far as is fair and appropriate, and doubts are read in favour of the party that did not draft the form. Its examples include terms excluding or limiting liability for breach, terms letting a party end the contract without good reason, terms letting a party not perform or perform late without good reason, and terms that increase the other side's burden after signing. Section 10 lists the factors: good faith, bargaining power, economic position, understanding, industry practice and how heavy the burden is. Section 8 says an advance exclusion of liability for harm to another person's life, body or health caused by intent or negligence cannot be relied on, and other advance exclusions that are not void bind only as far as fair and appropriate. Section 8 is not worded as limited to standard forms, so we do not assume a negotiated cap is outside the Act.

Our practical view. If you present your MSA as a non-negotiable template, treat it as a standard form and draft the cap so you can explain it. Typical structure:

1. Overall cap per contract year, often tied to fees paid in the previous 12 months.
2. Carve-outs outside the cap: fraud, gross negligence, intentional misconduct, breach of confidentiality or IP indemnity if you agree to them, and any liability that cannot lawfully be limited.
3. Exclusion of indirect and consequential loss, written clearly.
4. A mutual cap, not only for the provider.

A genuinely negotiated cap is easier to defend than a template term, so keep the negotiation log (changes and emails) with the file.

6. What data protection terms do we need?

The rule (PDPA section 40). A data processor must collect, use or disclose personal data only on the controller's instructions, unless an instruction breaks the law or the Act. It must provide appropriate security, notify the controller of a breach, and keep processing records, though a small organisation may be exempt from the records duty unless the processing risks data subjects' rights, is not occasional, or involves sensitive data. A processor that acts outside the instructions is treated as a controller for that processing. The controller must prepare an agreement with the processor.

The rule (PDPA section 37(4)). The controller must notify the PDPC of a breach without delay and, where feasible, within 72 hours after becoming aware, unless the breach is unlikely to create a risk to people's rights and freedoms.

Our practical view. Add a data processing schedule that covers: purpose and instructions, categories of data, security measures, sub-processors, deletion or return at the end, cooperation with data-subject requests, and breach notice to the customer within a short, fixed time (hours, not days) so the customer can still meet its own 72 hours. Check whether you are in fact a controller for some data, such as your own staff or marketing contacts. See our PDPA compliance checklist.

7. Who owns the IP, and what happens to the customer's data and tools?

• Say that pre-existing materials (your tools, templates, know-how) stay yours, with a licence to the customer to use deliverables.
• Say who owns custom deliverables and when ownership passes (on payment is common). Where you create copyrighted work for a customer, do not rely on defaults; a written assignment avoids argument. The software guide linked above explains this.
• Say the customer's data and accounts remain the customer's, and that you may use them only to provide the service.
• Cover third-party and open-source components, and state who holds the licences.

8. How do termination and transition work?

• Term and renewal: fixed term with auto-renewal, or rolling monthly. State the notice period (for example 30 or 60 days) and how notice is given.
• Termination for cause: a serious breach not cured within a stated period, insolvency, repeated SLA failure.
• Termination for convenience: if allowed, state the notice and any early-exit fee, and make it work both ways if you want the clause to look balanced.
• Transition help: a defined period after the end, handover of documentation and credentials, return or deletion of data with a certificate, and the rate for extra help.
• Surviving clauses: confidentiality, IP, payment of fees due, liability, governing law.
• Accrued fees and credits are settled to the end date.

9. What about withholding tax on service fees?

The rule (Revenue Department). Order Tor.Por. 4/2528, clause 12/1, covers service fees. A company, partnership or other juristic person paying service fees to a company or partnership doing business in Thailand, or to an individual, withholds income tax at 3.0%. The order says withholding applies if the amount payable under one contract totals 1,000 baht or more, and the withheld tax is remitted within seven days after the end of the month in which the income was paid. The page also records temporary reduced rates for some periods, so check the current rate before you quote one in a contract.

Our practical view. Your contract should say that: (a) fees exclude VAT, (b) the customer deducts withholding tax where the law requires and pays the net amount, (c) the customer gives you the withholding certificate by a set date, and (d) the provider is not required to bear the tax if the customer fails to remit it. If the customer is a foreign company, the analysis is different; read overseas service payments, VAT and withholding tax first.

10. Checklist before you sign

1. MSA, SOW and SLA are separate documents with a written order of precedence.
2. Scope lists inclusions, exclusions and volumes; there is a written change request procedure.
3. SLA measures are countable, with a named measuring source and agreed exclusions.
4. Service credits are modest, capped, and say whether they are the sole remedy.
5. A right to terminate for repeated SLA failure exists.
6. Fees, indexation or price change, payment period, late interest and suspension rights are stated.
7. Liability cap is mutual, justified, and carves out what the law will not allow to be excluded.
8. Data processing schedule exists, with a fixed breach-notice time.
9. IP, customer data and third-party components are allocated.
10. Notice, exit, transition help and surviving clauses are written.
11. The withholding tax and VAT wording matches your actual invoicing.
12. The signatory is authorised and the signed copy is stored; see signing company contracts electronically.

Further reading

• Software development contracts and source code
• PDPA compliance checklist
• Overseas service payments, VAT and withholding tax
• Signing company contracts electronically
• Choosing corporate legal counsel

A monthly service contract holds up when scope, service levels and the cost of missing them are written as plain, countable terms inside an MSA, SOW and SLA that agree with each other.

We draft and review MSAs, SOWs and SLAs for IT firms, agencies and B2B service providers, and can support you on an ongoing basis. Initial consultation is free — call +66 92 254 2045 or send us the details. See also contracts and documents and legal retainer.

This guide is published by Suwanvara Law Firm — a Khon Kaen law firm established in 1986. General information only, not legal advice on a specific matter.