SaaS subscription agreement: what UK businesses must check before signing
Software-as-a-Service agreements govern your use of cloud software — your CRM, your accounting platform, your project management tool, your communication software. Most businesses sign these agreements by clicking "I agree" without reading them. For low-cost consumer tools, the risk is manageable. For business-critical software that will process your customer data, the stakes are considerably higher.
Data processing and GDPR
This is the most important section for any UK business. Under UK GDPR, when you use a SaaS platform that processes personal data on your behalf — customer records, employee information, contact lists — you are the data controller and the SaaS provider is a data processor.
You must have a Data Processing Agreement (DPA) in place with any processor. Most SaaS providers offer a DPA, but you may need to actively request it or accept it separately from the main subscription agreement.
Check where your data is stored. If the SaaS provider stores data outside the UK or EU, you need to understand what transfer mechanisms are in place — Standard Contractual Clauses, adequacy decisions, or similar.
Check what the provider can do with your data. Some SaaS agreements include provisions allowing the provider to use your data for product improvement, benchmarking, or training AI models. Check whether this is opt-out or opt-in, and whether it applies to personal data.
Uptime and service levels
Most SaaS agreements include an uptime commitment — typically 99.9% or similar. As we covered in the SLA guide, the detail matters more than the headline number.
Check what the uptime commitment covers — is it 24/7 or business hours only? Does planned maintenance count against uptime? What are the service credits for downtime, and are they your exclusive remedy?
Data portability and exit
What happens to your data when you leave? Check whether you can export your data in a usable format, how long the provider retains data after termination, and whether there are exit fees.
Being locked into a SaaS platform because your data is not exportable — or is only exportable in a proprietary format — is a significant business risk. Negotiate data portability rights before you sign.
Auto-renewal and price increases
SaaS agreements almost universally include auto-renewal. Check the renewal terms, the notice period required to cancel, and whether the provider can increase prices at renewal.
Some agreements allow price increases of a specified percentage annually without renegotiation — check whether this is capped and what the cap is.
Liability and indemnification
Check the liability cap — the maximum amount the provider will pay if something goes wrong. SaaS providers typically cap liability at twelve months of subscription fees, which may be far less than the value of data lost or business disruption caused.
Check whether the provider indemnifies you against intellectual property claims — if the software infringes someone else's IP, you want the provider to defend that claim, not pass the cost to you.
Getting your SaaS agreement reviewed
PaperSafe reviews software subscription agreements and SaaS contracts in plain English, flagging data processing issues, service level gaps, and liability limitations. Upload your PDF and receive a complete review in under 2 minutes for £49.
Ready to review your contract?
Upload any contract and receive a plain-English review in under 2 minutes. Risky clauses flagged. Missing protections identified. £49.
Review my contract — £49 →