SaaS Agreements

The legal framework

A software-as-a-service (SaaS) agreement is a subscription to software that runs on someone else's infrastructure. It is not a licence of software in the traditional sense. The provider controls availability, security and the data, and the contract is how the customer keeps those under control. There is no special SaaS statute in most countries. The contract is governed by the general contract law of the member state whose law applies, together with the specific EU instruments below.

Unfair terms between businesses. Standard SaaS terms are typically non-negotiable, which is exactly where the B2B unfair-terms rules in Book VI of the Code of Economic Law (in force since 1 December 2020) apply. A clause that creates a manifest imbalance is void, and the Code contains lists of prohibited and presumed-unfair clauses, such as unilateral changes to the contract without a valid reason. Liability caps are not unfair as such, but a cap that leaves the customer without a real remedy can be.

Personal data. If the provider processes personal data for the customer, Article 28 GDPR requires a processing agreement with prescribed content, and the provider needs authorisation for subprocessors. Hosting or support outside the EEA raises the transfer rules in Chapter V GDPR.

The Data Act. Regulation (EU) 2023/2854 has applied since 12 September 2025. Its rules on switching between data-processing services (including most SaaS) give the customer the right to switch provider or to move to its own infrastructure. The provider cannot require more than two months' notice to start switching, must support a transition period of up to 30 days (extendable in specific cases), and must allow data retrieval afterwards. Switching charges may cover only actual costs until 11 January 2027 and are prohibited from 12 January 2027. The contract must describe these rights, so that older standard terms may need updating.

AI. If the service includes AI features, the roles of provider and deployer under the AI Act (Regulation (EU) 2024/1689) should be reflected in the contract. See AI clauses in vendor contracts.

In practice

What the contract should cover

Subscription scope: which modules, how many users or what volume, acceptable use, and how overage and downgrades work. Service levels: uptime commitment, how it is measured, service credits and support tiers. A credit-only remedy is thin comfort for a serious outage, so for business-critical services consider a right to terminate after repeated or sustained failure.

Data: the customer keeps ownership of its data, and the provider receives a limited right to process it to deliver the service. Watch for clauses allowing the provider to use customer data for its own analytics or to train models, and negotiate them expressly.

Liability and IP: expect a cap, usually linked to fees paid, and check the carve-outs. The provider should indemnify the customer against claims that the service infringes third-party IP. If the service includes open-source components, their licence terms may carry obligations of their own.

Exit: guaranteed export of data in a usable format, a transition period, and return or deletion afterwards. Continuity measures such as escrow or a wind-down period protect the customer if the provider fails.

An example

A Leuven clinic group signs up to a scheduling platform for three years. The standard terms allow the provider to change the service "at its discretion", cap liability at three months of fees even for data breaches, and say nothing about exporting appointment data. Two things can be done before signature: ask for a carve-out of data breaches and confidentiality from the cap, and add an exit clause that aligns with the Data Act switching rules. Under the unfair-terms rules, the unilateral change clause is also questionable. A processing agreement under Article 28 GDPR is needed in any case, since the platform handles health data.

Frequently asked questions

Who owns the data we put into a SaaS platform?

You do, and the provider should have only the rights it needs to run the service. Be careful with terms that grant broader rights, especially to train models.

What is the most overlooked SaaS term?

Exit. It is easy to sign up and hard to leave if the contract does not guarantee data export and a transition period. The Data Act now sets a minimum, but the contract should still spell it out.

Can the provider change the service or the price during the term?

Only to the extent the contract allows, and a unilateral right to change essential terms can be challenged as unfair between businesses. Look for a notice period and a right to terminate if a change is detrimental.

Is a service-credit-only remedy enough?

Not for business-critical services. Credits compensate for minor downtime. A right to terminate, and some liability for serious or repeated failure, are worth negotiating.

How this connects

SaaS agreements are part of our commercial contracts and transactions work. We draft them with our Document Studio and review a provider's terms with our contract review. For the framework model, see Master Services Agreements and SOWs.