SaaS contracts: 10 clauses Australian businesses should check before signing
By the ITLAW Team · General information, not legal advice
In short
- Standard SaaS terms are written to protect the provider.
- The most important clauses are about your data, security, liability and how you leave.
- Small businesses may be protected by unfair contract terms laws, but negotiating is better than litigating.
Most businesses now run on software they do not own. Subscription (SaaS) and cloud contracts decide what happens to your data, what the provider must do when things go wrong and how easily you can switch. These are the ten clauses to check.
1. Ownership and use of your data
Confirm you own your data and any outputs, and that the provider may use it only to provide the service. Check whether your data can be used to train AI models or create “aggregated” data.
2. Data location and overseas access
Know where data is stored and who can access it from overseas. This matters for APP 8 if you hold personal information. See our guide to the APPs.
3. Security obligations
Look for specific security standards or certifications, not just “reasonable security”, and rights to see audit reports.
4. Breach notification
The provider should notify you of a security incident affecting your data within a short, fixed time so you can meet your own obligations under the Notifiable Data Breaches scheme.
5. Service levels
Check uptime commitments, how they are measured, exclusions and whether service credits are your only remedy.
6. Price increases and renewals
Many contracts auto-renew and allow price rises on notice. Negotiate caps, notice periods and a right to exit if prices rise.
7. Unilateral changes
Terms that let the provider change the contract or features at will are common and can be unfair for small businesses under the unfair contract terms laws.
8. Liability caps and indemnities
Liability is usually capped at fees paid in the last 12 months. Seek higher caps or carve-outs for data breaches and IP infringement claims.
9. Termination and exit
Make sure you can export your data in a usable format, with enough time after termination, and that the provider deletes it afterwards.
10. Governing law and disputes
Overseas law and courts make disputes expensive. Aim for Australian law where possible.
Need advice?
Our articles are general information only. For advice on your circumstances, send us an enquiry and an ITLAW lawyer will reply by email, usually within one business day.
Frequently asked questions
Can I negotiate a SaaS contract?
Often, particularly for larger subscriptions or enterprise plans. Even where standard terms are fixed, unfair contract terms laws can protect small businesses from some one-sided terms.
Who owns data in a SaaS platform?
It depends on the contract. Make sure the contract confirms you own your data and limits how the provider can use it.
What should a SaaS exit clause include?
A right to export your data in a usable format within a reasonable period after termination, and confirmation that the provider will then delete it.
