Software as a Service: Drafting a Legally Sound SaaS Contract

With SaaS products, a provider makes a software solution available to the customer over the internet for a limited time, without local installation and without a license purchase in the traditional sense. The software remains on the provider’s servers, and the customer accesses it through an internet connection. Software updates, security measures, and the technical infrastructure remain entirely the provider’s responsibility. Well-known examples include Microsoft 365, Google Workspace, Salesforce, and Adobe Creative Cloud, as well as specialized B2B solutions for ERP or HR management used in corporate settings.

Compared to on-premises software, SaaS offers substantial practical advantages: lower acquisition costs, location-independent access, and reduced IT overhead. Outsourcing to external infrastructure, however, brings specific legal risks that can lead to significant liability and compliance problems without careful contract drafting.

Well-known SaaS providers include:

• Adobe: Adobe’s product range focuses primarily on digital creativity, documentation, and communication, as well as marketing, e-commerce, and data analytics.
• Google: Google Workspace offers tools and apps such as Calendar, Drive, and Gmail.
• Microsoft: Microsoft offers a wide range of products, the best known of which is likely Microsoft 365.
• Zoom: Usage of this cloud-based communication software grew enormously, particularly at the outset of the pandemic in spring 2020. It offers video and chat services that enable mobile communication and collaboration.

Questions of liability and warranty depend largely on how the specific provisioning model is classified under German law. Concluding a contract for a SaaS product can draw on several types of agreements and areas of law:

• Service contract law, Section 611 et seq. BGB
• Lease law, Section 535 et seq. BGB
• Work contract law, Section 631 et seq. BGB

A SaaS contract is therefore a mixed-type contract, one that German law does not explicitly regulate in this particular form. Because the use of a cloud-based product amounts to a time-limited provision of software comparable to the transfer of possession familiar from lease law, lease law forms the main basis for a SaaS contract. Work contract law and service contract law typically govern secondary elements of the contract: work contract law applies to success-based obligations such as data migration or software customization, while service contract law applies to the mere performance of services, such as training. Which law and which provisions apply in the event of a dispute between the contracting parties depends on the specific matter at issue and the law governing it, at least in a B2B context. Where one of the contracting parties is a consumer, Section 327 et seq. BGB apply instead.

A SaaS contract should reflect the underlying business model in full legal detail. This starts with a precise description of the services owed, including which modules, interfaces, and functions are covered, and extends to service level agreements on availability and support, as well as remuneration models, contract duration, and termination rights. Data protection requirements add a further layer: if the SaaS provider processes personal data on behalf of the customer, who remains the data controller, a data processing agreement under Article 28 of the General Data Protection Regulation (GDPR) is required. The contract should also address usage and exploitation rights, data portability, and exit management. Well-drafted SaaS contracts address these points explicitly and establish a clear allocation of risk for both sides, providers and client companies alike.

SaaS contracts are typically pre-formulated. As a result, the statutory rules on standard business terms (Allgemeine Geschäftsbedingungen), set out in Section 305 et seq. BGB, apply. This is particularly relevant when concluding contracts with foreign providers, since such contracts may contain clauses that conflict with German law. A clause that violates German law becomes invalid, while the remainder of the contract stays in effect (Section 306 BGB). The statutory provisions then take the place of the invalid clauses. It is also worth noting that the SaaS product on offer can change over the course of the contract term. Any such change must be documented and incorporated into the contract.

A SaaS contract is typically supplemented by a Service Level Agreement (SLA). An SLA can set out provisions on specific aspects of performance, such as the availability of the software provided, the parties’ contractual obligations, and how service failures are handled. Because uninterrupted software availability is often not guaranteed in practice, even though lease law would otherwise require it, any departure from that obligation, along with its consequences, should be recorded in the contract. Response times for outages, penalty clauses, compensation provisions, and termination rights are typically set out in the SLA.

Because SaaS contracts are typically concluded as standard-form contracts, they are subject to review under the law on standard business terms, Section 305 et seq. BGB. Clauses that do not withstand this review are replaced by the statutory provisions, sometimes with significant consequences for the provider. A legally sound contract must therefore address the following core areas:

• Usage rights: granting a non-exclusive, non-transferable right to use the software, limited to the contract term, with copyright remaining with the provider.
• Scope of services and contract term: a clear definition of the SaaS services provided, the contract duration, and the rules governing termination and renewal.
• Liability and limitation of liability: Excluding the no-fault damages claim under Section 536a(1) BGB is permissible under the law on standard terms. However, limiting liability for intent or gross negligence, or for harm to life, body, or health, is never permissible.
• Data protection and data processing: where personal data is processed, a data processing agreement under Article 28 GDPR is mandatory, and the contract should also expressly provide for compliance with applicable data protection requirements.
• Service Level Agreement (SLA): setting availability targets, response times, and billing arrangements for shortfalls against agreed service levels.

Regularly reviewing and updating the contract helps ensure that it continues to meet evolving legal requirements and the needs of both parties over time. Given the complexity of these areas, it is advisable to involve specialized legal counsel at the drafting stage.

Our lawyers advise clients on the full range of legal questions relating to SaaS contracts and cloud services. Our specialized IT and contract law team reviews existing contracts for critical clauses, including those concerning contract duration, termination conditions, data protection, and liability, and supports clients in drafting legally sound new agreements, including the associated Service Level Agreements. SaaS providers still in the founding phase should also address company law questions, from the choice of legal form to the protection of intellectual property in the underlying source code, at an early stage. Our guide on founding a SaaS company in Germany covers these issues in detail. Given how quickly IT law continues to develop, ongoing legal support is essential: what qualifies as compliant today may be superseded by new regulations tomorrow. We stand by our clients not only before and during the conclusion of a contract but also in the event of service failures during an ongoing contractual relationship.