Service Level Agreement

The Service Level Agreement (SLA) is the document that decides whether an outsourced service relationship works or quietly degrades. It sits behind every IT managed-service, SaaS subscription, cloud-hosting contract, BPO arrangement, payroll-outsourcing engagement, payment-gateway integration, logistics-API contract and customer-support outsourcing in India. The Master Services Agreement sets the commercial frame; the SLA is where the actual promises live — uptime, response time, resolution time, accuracy, reporting, security and the financial consequences of falling short.

Indian SLAs in 2026 are no longer the one-page 'best efforts' annexures of the early-2000s outsourcing era. They are commercially specific, technically measurable and legally enforceable — and they have to account for a layered legal framework: the Indian Contract Act, 1872 (Sections 73–74 on damages and liquidated damages, Section 56 on frustration / force majeure), the Information Technology Act, 2000 (Section 43A on reasonable security practices, Section 72A on unauthorised disclosure), the Digital Personal Data Protection Act, 2023 (Significant Data Fiduciary obligations, processor / fiduciary contracts under Section 8(2), 72-hour breach notification), the Specific Relief (Amendment) Act, 2018 (specific performance and injunctive relief), and increasingly sectoral regulators — RBI for payment service providers, IRDAI for insurance outsourcing, SEBI for market-infrastructure outsourcing.

We draft and negotiate SLAs end-to-end — vendor-side and customer-side — with measurable metrics, calibrated service credits, DPDP Act 2023 alignment, exit and portability discipline, and the dispute-resolution architecture that lets either party walk out cleanly when the relationship breaks.

Metrics That Actually Mean Something

• Uptime / Availability:: 99.9% (~ 8.7 hours downtime / year), 99.95% (~ 4.4 hours), 99.99% (~ 53 minutes) — chosen on criticality, not boilerplate; measurement window (monthly / quarterly), exclusions (planned maintenance, force majeure), measurement methodology (synthetic monitoring, real-user) defined.

• Response & Resolution Time (Severity-Based):: Severity 1 (system down) — 15-minute response, 4-hour resolution; Severity 2 (degraded) — 1-hour response, 8-hour resolution; Severity 3 (minor) — next-business-day; Severity 4 (informational) — 5 business days. Each severity level defined by impact, not vendor self-classification.

• Accuracy / Quality Metrics:: For BPO / payroll / data services — error rate (e.g., < 0.5% on payroll runs), defect rate, rework rate, first-time-right percentage; sampled and audited.

• Reporting & Governance:: Monthly SLA dashboard, quarterly business review, annual security review; defined escalation matrix (L1 / L2 / L3) with names and contacts.

Consequences That Actually Bite

• Service Credits (Tiered):: 5% of monthly fee for first SLA breach, 10% for second, 25% for third; capped at 25–50% of monthly fee; sole-and-exclusive remedy carve-out resisted (because it lets the vendor breach with impunity beyond the cap).

• Termination Right (Persistent Breach):: 3 SLA breaches in any 6 months, or 1 critical-severity breach unresolved beyond X hours — triggers customer's right to terminate without further cure period.

• Force Majeure — Defined, Not Open-Ended:: Specific events listed (war, pandemic by formal declaration, sovereign action, internet backbone failure attributable to upstream); 'any event beyond reasonable control' — resisted as too elastic post-COVID jurisprudence.

• Change Control:: SLAs reviewed quarterly; metric changes only by written change order signed by both sides; vendor cannot unilaterally degrade SLAs by updating its standard terms.

• Exit, Transition & Portability:: 6–12 month transition assistance on termination; data return in machine-readable format (DPDP Act 2023 portability right); knowledge transfer, runbook, code escrow (where IP-relevant); reverse-transition fees pre-agreed.

• DPDP Act 2023 & IT Act Section 43A:: Processor / fiduciary roles defined; reasonable security practices (ISO 27001 / SOC 2); 72-hour breach notification cascade; sub-processor consent; cross-border transfer where data leaves India.