SaaS agreement checklist for UK companies

A UK SaaS agreement should cover the subscription grant, fees and renewal, service levels, support, liability caps with mandatory carve-outs, IP ownership, UK GDPR data processing, confidentiality, termination and data return, and governing law. Each clause does distinct work. Getting one wrong usually only becomes visible on renewal, on a dispute, or at an acquirer's due diligence.

Below is the checklist we work through on every SaaS matter at MrBondLegal, with the common pitfalls highlighted. Our SaaS agreement service is from £690, delivered in 48 to 72 hours, with sign-off by an SRA-regulated solicitor.

1. Licence grant and scope

Define the licence precisely: who can use the service, where, for what purpose, and for how long. The usual structure is a non-exclusive, non-transferable subscription for the term, terminable as set out in the agreement, to use the software for the customer's internal business purposes, by named or counted users.

Pitfalls: granting a "perpetual" licence where you meant "subscription", silence on affiliates (can group companies use it?), and silence on territory where you intended to carve out certain jurisdictions.

2. Fees, renewal and price changes

Three things to spell out:

• Fee basis. Per user, per seat, per usage, or flat subscription. Each has consequences for billing and audit.
• Renewal mechanics. Auto-renew with a notice window for non-renewal is common but should be reasonable (30 to 90 days). Short notice windows combined with multi-year auto-renew are a frequent source of dispute.
• Price increases. On renewal, uncapped increases are a problem. A cap tied to a published index (CPI, RPI) with a reasonable floor and ceiling is standard.

3. Service levels (SLA)

An SLA sets measurable uptime targets, exclusions from measurement (planned maintenance, force majeure, customer-side issues), measurement methodology, and the remedy for failure. Service credits are the standard remedy; make sure they are expressed as a percentage of the fees for the affected period and that they are the sole remedy for a given SLA failure.

Pitfalls: SLA metrics with no measurement methodology (what counts as downtime?), service credits with no cap or no floor, and promises of "100% uptime" that no provider actually delivers.

4. Support

Specify support hours, response targets, severity classifications, escalation path and language. "Business hours UK time", "critical response within 2 hours", "severity-1 definition", "named technical contact", all have real operational consequences.

5. Liability caps with mandatory carve-outs

A liability cap sized to the fees paid in the preceding 12 months is a common commercial position for SaaS. Any cap must carve out items that cannot lawfully be limited:

• Death or personal injury caused by negligence (Unfair Contract Terms Act 1977).
• Fraud and fraudulent misrepresentation.
• Items under the Consumer Rights Act 2015 where consumers are involved.
• Often: wilful breach, breach of confidentiality, and breach of data protection obligations.

A cap without these carve-outs may be unenforceable or fail the UCTA reasonableness test in the exact case where you need to rely on it.

6. IP ownership

Three IP buckets to distinguish:

• Provider IP. The software, documentation and know-how underlying the service remain with the provider.
• Customer data. The customer's data (including inputs and outputs attributable to them) remains the customer's. The provider has a licence to use it to deliver the service and improve it on an aggregated, anonymised basis if that is agreed.
• Developments. Anything developed during the contract (bug fixes, feature additions, custom work) needs a clear owner. Default to the provider for product improvements; carve out any bespoke work the customer paid for.

7. UK GDPR data processing

If the SaaS provider processes personal data on behalf of the customer (which almost all SaaS does), UK GDPR requires processor terms with specific content, usually drafted as a Data Processing Agreement (DPA). The DPA must address:

• Processing instructions and purpose limitations.
• Confidentiality obligations on provider staff.
• Technical and organisational security measures.
• Sub-processor authorisation and notification.
• International transfer safeguards (where processing happens outside the UK).
• Audit rights and assistance.
• Data breach notification timing.
• Return or deletion of personal data at the end of the contract.

The DPA can sit in the SaaS agreement itself or as a separate schedule.

8. Confidentiality

A confidentiality clause with reasonable duration (3 to 5 years post-termination, longer for trade secrets), standard exclusions (publicly known, independently developed, legally compelled), and permitted recipients. Many SaaS contracts also expressly cover the terms of the agreement as confidential.

9. Termination and data return

Set out termination for cause, termination for convenience (and the notice window), and what happens to data on termination:

• Suspension pending resolution of a serious breach.
• Termination triggers (persistent SLA failure, non-payment, breach of key covenants).
• Transition services (short extension at the standard rate to help the customer migrate).
• Data return format and timing (common: 30 days to download in a standard format, after which the provider deletes).

10. Governing law and dispute resolution

For a UK SaaS deal, English law and the exclusive jurisdiction of the English courts is the standard choice. If dispute escalation is agreed, build in a short internal escalation window before court proceedings (e.g. a 10-business-day senior-management discussion before any proceedings are issued, which does not stop urgent injunctive relief).

Common SaaS pitfalls

• Perpetual licence where a subscription was intended.
• Uncapped automatic price increases on renewal.
• SLA with no measurement methodology or no cap on remedies.
• Liability cap with no mandatory carve-outs.
• No DPA, or a DPA that is a generic template not matched to the actual processing.
• IP ownership silent on customer data.
• No data return or deletion on termination.
• A foreign governing law where English law is the natural fit.

Frequently asked questions

Do I need a separate data processing agreement?

If you process personal data on behalf of customers, UK GDPR requires processor terms. These can sit in the SaaS agreement or in a separate DPA. Either is acceptable; omitting them is not.

What is a reasonable liability cap for SaaS?

A cap set at the fees paid in the 12 months preceding the event is a common commercial position. The cap must carve out mandatory items.

How much does a SaaS agreement cost?

MrBondLegal drafts and reviews SaaS agreements from £690, delivered in 48 to 72 hours, with sign-off by an SRA-regulated solicitor.

Can you review a customer's SaaS terms I have received?

Yes. That is a Contract Review from £390, in 24 to 48 hours.