--- title: "SaaS Agreements | Pitch, European law firm for IP, IT & data" description: "Subscriptions, service levels, data ownership, liability and exit in SaaS contracts, with the GDPR, the Data Act and national contract rules." url: https://www.pitch.law/academy/saas-agreements --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Commercial](https://www.pitch.law/academy/topics/commercial) # SaaS Agreements Subscriptions, service levels, data ownership, liability and exit in SaaS contracts, with the GDPR, the Data Act and national contract rules. - By By Bart Lieben, Attorney-at-Law - Published 26 October 2026 ## The legal framework A software-as-a-service (SaaS) agreement is a subscription to software that runs on someone else's infrastructure. It is not a licence of software in the traditional sense. The provider controls availability, security and the data, and the contract is how the customer keeps those under control. There is no special SaaS statute in most countries. The contract is governed by the general contract law of the member state whose law applies, together with the specific EU instruments below. **Unfair terms between businesses.** Standard SaaS terms are typically non-negotiable, which is exactly where the B2B unfair-terms rules in Book VI of the Code of Economic Law (in force since 1 December 2020) apply. A clause that creates a manifest imbalance is void, and the Code contains lists of prohibited and presumed-unfair clauses, such as unilateral changes to the contract without a valid reason. Liability caps are not unfair as such, but a cap that leaves the customer without a real remedy can be. **Personal data.** If the provider processes personal data for the customer, Article 28 GDPR requires a processing agreement with prescribed content, and the provider needs authorisation for subprocessors. Hosting or support outside the EEA raises the transfer rules in Chapter V GDPR. **The Data Act.** Regulation (EU) 2023/2854 has applied since 12 September 2025. Its rules on switching between data-processing services (including most SaaS) give the customer the right to switch provider or to move to its own infrastructure. The provider cannot require more than two months' notice to start switching, must support a transition period of up to 30 days (extendable in specific cases), and must allow data retrieval afterwards. Switching charges may cover only actual costs until 11 January 2027 and are prohibited from 12 January 2027. The contract must describe these rights, so that older standard terms may need updating. **AI.** If the service includes AI features, the roles of provider and deployer under the AI Act (Regulation (EU) 2024/1689) should be reflected in the contract. See [AI clauses in vendor contracts](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts). ## In practice ### What the contract should cover Subscription scope: which modules, how many users or what volume, acceptable use, and how overage and downgrades work. Service levels: uptime commitment, how it is measured, service credits and support tiers. A credit-only remedy is thin comfort for a serious outage, so for business-critical services consider a right to terminate after repeated or sustained failure. Data: the customer keeps ownership of its data, and the provider receives a limited right to process it to deliver the service. Watch for clauses allowing the provider to use customer data for its own analytics or to train models, and negotiate them expressly. Liability and IP: expect a cap, usually linked to fees paid, and check the carve-outs. The provider should indemnify the customer against claims that the service infringes third-party IP. If the service includes open-source components, their licence terms may carry obligations of their own. Exit: guaranteed export of data in a usable format, a transition period, and return or deletion afterwards. Continuity measures such as escrow or a wind-down period protect the customer if the provider fails. ### An example A Leuven clinic group signs up to a scheduling platform for three years. The standard terms allow the provider to change the service "at its discretion", cap liability at three months of fees even for data breaches, and say nothing about exporting appointment data. Two things can be done before signature: ask for a carve-out of data breaches and confidentiality from the cap, and add an exit clause that aligns with the Data Act switching rules. Under the unfair-terms rules, the unilateral change clause is also questionable. A processing agreement under Article 28 GDPR is needed in any case, since the platform handles health data. ## Frequently asked questions ### Who owns the data we put into a SaaS platform? You do, and the provider should have only the rights it needs to run the service. Be careful with terms that grant broader rights, especially to train models. ### What is the most overlooked SaaS term? Exit. It is easy to sign up and hard to leave if the contract does not guarantee data export and a transition period. The Data Act now sets a minimum, but the contract should still spell it out. ### Can the provider change the service or the price during the term? Only to the extent the contract allows, and a unilateral right to change essential terms can be challenged as unfair between businesses. Look for a notice period and a right to terminate if a change is detrimental. ### Is a service-credit-only remedy enough? Not for business-critical services. Credits compensate for minor downtime. A right to terminate, and some liability for serious or repeated failure, are worth negotiating. ## How this connects SaaS agreements are part of our [commercial contracts and transactions](https://www.pitch.law/solutions/commercial-contracts-transactions) work. We draft them and review a provider's terms with [Document Studio](https://www.pitch.law/technologies/contract-studio), our proprietary document analysis and development system. For the framework model, see [Master Services Agreements and SOWs](https://www.pitch.law/academy/master-services-agreements-sow). ## In short - Subscription scope, service levels and credits - Data ownership, GDPR and AI Act overlay - Liability, IP indemnity and open source - Switching rights under the Data Act ## Related solutions - [Solutions](https://www.pitch.law/solutions/commercial-contracts-transactions) ### [Commercial Contracts & Transactions](https://www.pitch.law/solutions/commercial-contracts-transactions) [Supply, distribution, services, SaaS and procurement contracts, and the deals around them, drafted and reviewed with the IP, data and tax angles in view.](https://www.pitch.law/solutions/commercial-contracts-transactions) ## Technology we use - [Technology](https://www.pitch.law/technologies/contract-studio) ### [Document Studio](https://www.pitch.law/technologies/contract-studio) [Our Document Studio drafts and analyses legal documents in a secure, on-premise environment, and keeps the documents behind your matters up to date as new data comes in and procedural steps fall due.](https://www.pitch.law/technologies/contract-studio) - [Technology](https://www.pitch.law/technologies/clause-library-risk-review) ### [Contract Review](https://www.pitch.law/technologies/clause-library-risk-review) [Send us the contract the other side drafted and we check it clause by clause against our playbook, with a risk ranking an attorney has verified.](https://www.pitch.law/technologies/clause-library-risk-review) - [Technology](https://www.pitch.law/technologies/contract-obligations) ### [Contract Management: Rights and Obligations](https://www.pitch.law/technologies/contract-obligations) [Once a contract is final, we pull out each party's duties and rights with the clause they come from, have a person confirm them, and follow them with reminders.](https://www.pitch.law/technologies/contract-obligations) ## More in Commercial - ### [Commercial Contracts: a Map](https://www.pitch.law/academy/commercial-contracts-overview) [The main families of commercial contract, the EU and national rules that frame them, and where risk and value tend to sit.](https://www.pitch.law/academy/commercial-contracts-overview) - ### [Distribution and Reseller Agreements](https://www.pitch.law/academy/distribution-reseller-agreements) [How to structure distribution and reseller agreements in the EU: exclusivity, termination protection, online sales, and the brand provisions that keep control.](https://www.pitch.law/academy/distribution-reseller-agreements) - ### [Licensing Agreements](https://www.pitch.law/academy/licensing-agreements) [How to structure an IP licence: scope, royalties, improvements, quality control, termination, and the EU rules that frame it.](https://www.pitch.law/academy/licensing-agreements) - ### [Manufacturing and Supply Agreements](https://www.pitch.law/academy/manufacturing-supply-agreements) [What a manufacturing or supply agreement must settle: specifications, quality, liability, exclusivity and, above all, who owns the tooling, know-how and improvements.](https://www.pitch.law/academy/manufacturing-supply-agreements) - ### [Master Services Agreements and Statements of Work](https://www.pitch.law/academy/master-services-agreements-sow) [How a master services agreement and statements of work split the legal terms from the project detail, and how EU and national rules shape the key clauses.](https://www.pitch.law/academy/master-services-agreements-sow) - ### [Running a Request for Information or Proposal](https://www.pitch.law/academy/rfi-rfp-procurement) [How to run a request for information or proposal so that confidentiality, IP and your contract terms are protected before you choose a vendor.](https://www.pitch.law/academy/rfi-rfp-procurement) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)