Five clauses to re-read in a SaaS contract

Introduction

SaaS (Software as a Service) contracts have become unavoidable for B2B businesses. Yet many vendors and customers make mistakes that can have significant financial and legal consequences.

I regularly review poorly drafted SaaS contracts that expose both parties to significant risks.

This guide presents the 5 most frequent mistakes and how to avoid them.

Mistake #1: No precise SLA

The problem

A vague or non-existent Service Level Agreement (SLA) exposes both parties to disputes. Without a precise SLA, there is no way of knowing what the vendor must deliver.

What an SLA must contain

• Contractual availability rate: 99.9%? 99.5%? Beware, the difference is huge (8 hours versus 44 hours of downtime a year)
• Penalties for non-compliance: credits, proportional refund
• Exclusions: planned maintenance, force majeure, customer's fault
• Reporting process: how is the rate measured and communicated?

Example of a clause to negotiate

"The vendor warrants 99.9% availability measured monthly. Each percentage point below this threshold entitles the customer to a credit of 5% of the monthly fee."

Mistake #2: Insufficient exit clauses

The problem

What happens at the end of the contract? Without a clear exit (reversibility) clause:

• Your data may be deleted immediately
• The export format is not fixed
• Retrieval times are uncertain
• You are locked in to the vendor (vendor lock-in)

What to negotiate

• Retrieval period: at least 90 days after the end of the contract
• Export format: standard formats (CSV, JSON, XML)
• Migration assistance: technical help from the vendor
• Cost: often free for a basic export

Recommended clause

"The vendor shall make available to the customer, for 90 days after the end of the contract, a complete export of the data in [CSV/JSON] format. The export may be carried out at any time through the user interface."

Mistake #3: Unlimited liability for the customer

The problem

Many SaaS contracts heavily limit the vendor's liability (one month's fee, for example) while leaving the customer's liability unlimited. This imbalance is dangerous.

Points to negotiate

• Symmetrical cap: if the vendor caps its liability, so do you
• Exclusion of indirect damage: loss of turnover, damage to reputation
• Insurance cover: check the vendor's professional liability insurance
• Exceptions: gross negligence, fraud, breach involving personal data

Example of a balanced clause

"Each party's liability is capped at the amount of the fees paid over the last 12 months. This cap does not apply in the event of gross negligence, fraud or a breach of the GDPR."

Mistake #4: Unclear intellectual property

The problem

Who owns what? The contract must clarify the intellectual property in the various elements:

• Does the data remain the customer's property?
• What happens to bespoke developments?
• May the vendor use your data to train its algorithms?

What to specify

The data:

"Data imported or generated by the customer remains its exclusive property. The vendor acquires no intellectual property right in that data."

Bespoke developments:

"Developments carried out at the customer's request are assigned to it in full ownership / are the subject of an exclusive licence."

AI and algorithms:

"The vendor shall not use the customer's data to train artificial intelligence models, except with prior written agreement."

Mistake #5: Poorly framed GDPR

The problem

The contract must include a GDPR processing agreement (Article 28) setting out the vendor's obligations. Without this agreement, you are in breach.

The mandatory clauses (Article 28)

• Authorised purposes: the vendor may only process the data for the service
• Security measures: encryption, access control, logs
• Data location: EU or outside the EU? What safeguards?
• Sub-processors: list and conditions of use
• Notification obligations: security breaches, access requests
• Fate of the data: deletion or return at the end of the contract

Beware of transfers outside the EU

If the vendor uses sub-processors outside the EU, a transfer must rest on a basis provided for by the GDPR:

• For the United States, the adequacy decision of 10 July 2023 (EU-US framework), provided the recipient is certified
• Failing that, standard contractual clauses (SCCs)
• With SCCs, a transfer impact assessment and, if necessary, supplementary technical measures

SaaS contract checklist

• SLA with defined penalties
• Detailed exit clause
• Capped and symmetrical liability
• IP clearly allocated
• Compliant DPA/GDPR agreement
• Reasonable termination clause
• Sub-processors listed
• Data location specified

Conclusion

A well-drafted SaaS contract protects both parties and avoids costly disputes. Before signing, take the time to negotiate the clauses above.

The 3 priorities:

1. Check the SLA and the penalties
2. Negotiate the exit clause
3. Require a GDPR-compliant DPA

Have your contracts reviewed by a lawyer before signing them.

SaaS contract to sign?

I review and negotiate IT contracts. Book a scoping call to go through yours.

Translated from the French original published on 15 January 2026. The analysis concerns Belgian and European Union law. Read the French original.