Software as a Service (SaaS) Agreement

A Software as a Service (SaaS) agreement is the operating contract between a SaaS provider and its enterprise customer — defining what the service is, what level of performance is guaranteed, who owns the data, what happens at exit, and how disputes are resolved. By 2026, the Indian SaaS ecosystem has matured to a stage where almost every enterprise customer (CIO / GC / Procurement) has its own paper, and almost every B2B SaaS vendor needs a strong own-paper master agreement to negotiate from. The agreement landscape is now shaped by three forces: India's Digital Personal Data Protection Act 2023 (DPDP Act) with its data fiduciary / consent manager / data principal architecture; GDPR / UK GDPR / California CCPA / CPRA for global customers; and industry-specific compliance overlays (HIPAA for healthcare, PCI-DSS for payments, RBI / SEBI for financial services).

The legal architecture of a B2B SaaS agreement spans the Indian Contract Act 1872, the IT Act 2000 with IT Rules 2021 / 2023, the DPDP Act 2023, the Specific Relief (Amendment) Act 2018, the Copyright Act 1957 for software IP, and increasingly the EU AI Act and India's draft AI framework for AI-enabled SaaS. Cross-border data transfer, sub-processor obligations, encryption / DPIA / DPO requirements all need to be hard-coded into the agreement.

We draft SaaS agreements end-to-end — vendor-side master service agreement, customer-side review / negotiation, SLA, DPA (Data Processing Addendum), exit / data-portability obligations — for B2B SaaS companies, API providers, AI / ML SaaS, fintech / healthcare / e-commerce verticals, and global SaaS vendors selling into India.

What a Real SaaS Agreement Locks Down

• Subscription & Pricing:: Subscription model (per user / per transaction / capacity / consumption-based), term (1-3 years), renewal (auto / opt-in), price escalation cap, mid-term price changes, true-up / true-down mechanism.

• Service Level Agreement (SLA):: Uptime commitment (99.9% / 99.95% / 99.99%), response time, resolution time, support tiers, service credits / liquidated damages for breach, exclusions (force majeure, scheduled maintenance, customer-caused issues).

• Data Protection & DPDP Act:: DPDP Act 2023 — data fiduciary / data processor / data principal roles; lawful purpose; consent / deemed consent; significant data fiduciary obligations; cross-border transfer restrictions; breach notification; data principal rights (access, correction, erasure, grievance); DPA addendum for the customer relationship.

• Cross-Border Data Transfer:: For global customers — GDPR Standard Contractual Clauses (SCCs), UK IDTA, EU-US Data Privacy Framework alignment; DPDP Act cross-border transfer rules.

• IP & Licensing:: SaaS provider retains software IP; customer gets a non-exclusive, non-transferable subscription licence; usage data ownership (typically vendor-aggregated for product improvement); customer-uploaded data ownership remains with customer.

• Indemnity & Liability:: IP infringement indemnity (vendor); customer indemnity for misuse; aggregate liability cap (typically 12 months fees, but heavily negotiated for enterprise deals); carve-outs for confidentiality / data / IP breaches.

• Confidentiality & Security:: Bilateral confidentiality, security commitments (ISO 27001, SOC 2 Type II, encryption at rest and in transit), breach notification timeline, audit rights.

• Exit & Data Portability:: Termination triggers, data export format and timeline, data deletion / retention, transition assistance, post-termination obligations — the most under-drafted clause in most SaaS agreements.

• Governing Law & Dispute Resolution:: For India-customer deals — Indian law and Indian arbitration seat; for global deals — Singapore / Delaware / English law; arbitration via SIAC / LCIA / ICC.

Why Most SaaS Agreements Fail at Real-World Disputes

SLA without measurable definitions of uptime / response / resolution. DPA missing — DPDP Act compliance fails. Exit clause vague — vendor holds customer data hostage. Liability cap too high (vendor-side) or too low (customer-side) for the actual risk. Cross-border transfer not addressed for global customers. IP indemnity carved out for AI-generated outputs. Each is preventable.