A master services agreement (MSA) sets the legal terms once; order forms or statements of work add the commercial detail for each purchase. SaaS contracts follow the same pattern. Indian companies sign these on both sides — buying cloud tools and selling their own software or services — and the same clauses matter either way.
Structure and precedence
State which document wins when the MSA, an order form and a statement of work disagree. Usually the order form wins on commercials and the MSA wins on legal terms. Without a precedence clause, an order form with the vendor's standard terms printed on the back can quietly override your negotiated MSA.
Limitation of liability
This is the clause that decides how much either side can recover. A cap equal to the fees paid in the previous twelve months is a common starting point. What matters as much as the number is what sits outside the cap:
- Breach of confidentiality and data-protection obligations.
- Intellectual-property infringement indemnities.
- Fraud, wilful misconduct and gross negligence (and amounts that cannot be limited by law).
- Unpaid fees.
Also check the exclusion of indirect and consequential loss. “Loss of data” and “loss of profits” are often excluded in the same sentence — for a SaaS buyer, data loss caused by the vendor is precisely the risk you need covered.
Under Sections 73 and 74 of the Indian Contract Act, compensation follows the loss that naturally arises from the breach or was in contemplation of the parties, and a pre-agreed sum is treated as a ceiling on reasonable compensation rather than an automatic payment. Draft service credits and liquidated damages with that in mind.
Service levels
- Uptime percentage and how it is measured (monthly, excluding scheduled maintenance announced in advance).
- Response and resolution times by severity.
- Service credits as a percentage of monthly fees — and whether they are the sole remedy. A sole-remedy clause means you cannot terminate or claim damages for chronic outages unless the contract says so; add a right to terminate after repeated misses.
Data protection
Under the Digital Personal Data Protection Act, 2023, the business that decides why and how personal data is processed is the data fiduciary; a vendor processing on its behalf is a data processor, and the fiduciary remains responsible. The rules under the Act are coming into force in phases, so check which obligations apply on your contract date. The MSA should cover processing only on instructions, reasonable security safeguards, breach notification within a short period so the fiduciary can meet its own obligations, sub-processors (list and notice of changes), assistance with data principal requests, and deletion or return at the end.
If data will be stored or processed outside India, note the government's power to restrict transfers to notified countries, and any sector rules (for example, financial-sector data localisation directions) that apply to you.
Exit
- Data export in a usable format, for a stated period after termination, at no or a stated cost.
- Deletion and a certificate of deletion after export.
- Transition assistance for services contracts.
- Auto-renewal: notice period to stop renewal and any cap on price increases at renewal.
Tax and payments
SaaS and IT services from an Indian supplier carry GST (generally at 18%). Buyers deduct tax at source on payments for professional or technical services at the rate in force; the contract should state that fees are exclusive of GST and that TDS will be deducted and certificates issued. If you buy from a foreign SaaS provider without an Indian GST registration, you may have to pay GST under reverse charge — check with your adviser.
Disputes
Arbitration under the Arbitration and Conciliation Act, 1996, with a named seat (city), number of arbitrators and institution or ad hoc rules. Keep the right to seek urgent interim relief from courts.
Review routine
- Precedence and the order form's fine print.
- Liability cap, carve-outs and consequential-loss wording.
- SLA metrics, credits, sole-remedy language and termination for chronic failure.
- Data-processing terms and sub-processors.
- Exit, renewal and price changes.
The MSA & SaaS sheet in the free workbook lists these with status and risk columns.
Buyer's and seller's priorities
If you are buying software, your priorities are usually: data protection and exit, liability carve-outs for data breaches, a termination right for chronic SLA failures, and caps on renewal price increases. If you are selling, your priorities are: a clear cap tied to fees, exclusion of indirect loss, service credits as the remedy for downtime, a right to suspend for non-payment, and acceptance deemed after a set period. Knowing which side's priorities you are trading lets you concede the points that matter less to you.
Common mistakes
- The order form's linked online terms quietly override the negotiated MSA.
- Data loss excluded as “consequential loss”.
- No data-export period after termination.
- Auto-renewal with a 90-day notice window nobody diarised.
- Fees stated “inclusive of taxes”, leaving the GST and TDS treatment unclear.
Frequently asked questions
What is a typical liability cap in a SaaS agreement?
Are service credits the only remedy for downtime?
Who is responsible for personal data under the DPDP Act — the customer or the SaaS vendor?
Should TDS be deducted on SaaS fees?
What is a reasonable notice period for non-renewal?
Last reviewed 5 November 2026 by the Bebaak team. Law and practice change — check the current position with your adviser before relying on it.
