SaaS agreement

How to review a SaaS or subscription agreement

In a SaaS contract, check auto-renewal and price increases, the service-level commitment, how your data is protected and returned, and the liability cap. The most expensive surprises are silent renewals, weak uptime remedies and no right to export your data on exit.

Review your contractUpdated October 16, 2026

Legal background

  • GDPR / UK GDPR when personal data is processed (Article 28 processor terms)
  • Standard Contractual Clauses for transfers outside the EEA
  • Governing law and consumer or sector rules where applicable

Main risks

  1. 01Auto-renewal and price increases

    The subscription renews for a full term unless cancelled far in advance, and the vendor may raise prices on notice.

  2. 02Weak SLA

    Uptime target is “commercially reasonable efforts”, with no service credits or termination right for repeated failures.

  3. 03Data protection gaps

    No data-processing agreement, unclear sub-processors, no breach-notification deadline, or transfers outside your region without safeguards.

  4. 04Vendor may use your data

    Broad licence to use customer data to train models or for analytics without limits or de-identification.

  5. 05Liability cap that excludes the real risks

    A low cap applies even to data breaches, and the vendor excludes all indirect damages while you remain fully liable.

  6. 06No exit plan

    No data export format or period after termination, and no assistance on transition.

Example finding and redline

Clause in the contract

“The subscription renews automatically for successive 12-month terms unless cancelled at least 90 days before expiry.”

Why it is risky

A 90-day window makes it easy to miss cancellation and commits you to another full year.

Suggested fix

“Renewal terms are 12 months. Either party may cancel with 30 days’ notice before renewal, and Vendor must send a renewal reminder 60 days before.”

Pre-signing checklist

  • Term, renewal and notice period are clear
  • Price changes are capped or require consent
  • SLA with measurable uptime, support times and credits
  • Data-processing terms, sub-processors and breach notification
  • Rules on use of customer data and model training
  • Security standards and audit rights (for example SOC 2 or ISO 27001)
  • Liability cap with carve-outs for data breach and confidentiality
  • Data export and deletion on exit, transition help

FAQ

Do I need a DPA with a SaaS vendor?
If the vendor processes personal data on your behalf, GDPR requires a written processing agreement. Check that it lists sub-processors, security measures, breach notification and deletion or return of data.
What SLA uptime is reasonable?
Commonly 99.5% to 99.9% monthly for business software, with service credits and a right to terminate after repeated misses. What matters is how it is measured and what the remedy is.

This material is for general information and is not legal advice. Rules differ by jurisdiction; have a lawyer review any significant contract before you sign.