Last reviewed 28 September 2026
The key points to check in any SaaS contract you are buying are: what service levels are promised and what remedy you get if they are missed, how your data is protected and returned, how much the supplier can be liable for, how and when prices can rise, how renewal and termination work, and whether the supplier can change the service unilaterally.
Business customers increasingly run core operations on subscription software, from finance and HR to customer records. A contract that looked like routine click-through paperwork can become critical if the service fails or the supplier is acquired.
Identify which documents form the contract
SaaS terms are often spread across a master agreement, an order form, an online service description, an acceptable use policy, a service level document and a data processing addendum. Check which document prevails if they conflict, and whether the supplier can update online policies without your agreement.
Service levels and remedies
Look for a defined availability commitment, how it is measured and what is excluded, such as scheduled maintenance. Check whether service credits are your only remedy. For business-critical systems, seek a right to terminate for repeated or prolonged failure, and support response times that match how you use the system.
Data protection and security
If the service processes personal data, the contract must include processor terms required by UK GDPR. Check where data is hosted, how international transfers are handled, how quickly the supplier must tell you about a security breach and whether it can appoint sub-processors without notice. Ask what security standards the supplier applies and whether it will share evidence of them.
Liability and indemnities
Suppliers commonly cap liability at fees paid over a period and exclude indirect or consequential loss. Consider whether the cap is realistic compared with the harm a data breach or outage could cause, and whether higher caps apply to data protection breaches or confidentiality. Check for an intellectual property indemnity protecting you if the software infringes someone else's rights.
Price, renewal and changes
Auto-renewal is standard, so diarise the notice window. Check for limits on price increases at renewal and how overage for extra users or usage is charged. Look at clauses allowing the supplier to modify features: a right to improve the service is reasonable, but a right to remove functionality you rely on is a risk.
Exit and data return
Make sure you can export your data in a usable format during the term and for a period after termination, and that the supplier will delete it afterwards. Consider what help you would need to migrate to another provider and whether the contract offers it, even at additional cost.
Negotiating realistically
Large platforms rarely negotiate standard terms for smaller customers, but order forms, data processing terms and service levels can sometimes be varied, and mid-sized suppliers are often more flexible. Prioritise the few clauses that matter for your use case. If the terms cannot be changed, record the risks internally and plan mitigation, such as regular data exports. We review supplier contracts for businesses buying software as well as for SaaS providers.
Key points
- Check which documents form the contract and whether they can change.
- Service credits are often the sole remedy for outages unless you negotiate otherwise.
- Confirm UK GDPR processor terms, breach notice and data export rights.
- Diarise renewal notice windows and check limits on price rises.
Frequently asked questions
- Can a small business negotiate SaaS terms with a large supplier?
- Sometimes. Standard terms are rarely changed, but order-specific points, data processing terms or service levels may be. Mid-sized suppliers are often more willing to negotiate.
- What happens to our data if the SaaS supplier goes out of business?
- It depends on the contract and the circumstances. Regular exports of critical data and clear data return clauses reduce the risk of losing access.
- Is clicking I agree legally binding for a business?
- Generally yes. Online acceptance can form a binding contract in England and Wales, so business customers should review terms before accepting them.