What is a SaaS contract?
With Software as a Service, a provider typically makes software available for use over the internet. The customer does not operate the application itself, but pays for the agreed access and scope of service. That is precisely why comparing features and monthly prices alone is not enough.
This article concerns contracts between businesses governed by German law. Special consumer rules, sector-specific requirements and the particularities of international contracts require separate consideration. “Commercial law” is not a single statute here: contract law, the law on standard terms, data protection and, where applicable, European requirements interact.
“SaaS” is not a contract type.
The label on the offer does not determine which law applies. For the temporary online use of software, Germany’s Federal Court of Justice applied rental law to an application service providing contract. A modern SaaS contract may also include implementation, consulting, support or specific deliverables. Each of these elements needs its own legal classification.
The distinction matters when things go wrong: what constitutes a defect? Is the obligation merely to perform an activity, or to achieve a specific result? When does formal acceptance make sense? A blanket reference to “the platform” leaves these questions unanswered.
Before signing: Record features, user numbers, interfaces, storage, support, implementation and expressly excluded services in a binding service description.
Standard terms have limits in B2B, too.
“The customer is a business” does not automatically make a pre-drafted clause enforceable. Section 307 of the German Civil Code (BGB) also protects businesses against unreasonable disadvantage and non-transparent provisions. Section 309 BGB does not apply directly in B2B dealings, but its underlying principles can still matter when assessing a clause under section 307. Section 308 BGB requires a distinction: section 310(1) does not exclude points 1a and 1b concerning payment, verification and acceptance periods from direct application. The particularities of commercial dealings must also be taken into account.
Under section 305b BGB, individually agreed provisions take precedence over standard terms. A signature or the heading “individually agreed” does not, by itself, prove that a clause was genuinely negotiated.
Before signing: Agree a clear order of precedence between the order form, service description, SLA, data protection agreement and standard terms. Do not frame rights to amend the contract as an unlimited licence.
99.9 per cent means little without measurement rules.
A service level agreement is only as reliable as its definitions. Is availability measured monthly or annually? Where is it measured? Does scheduled maintenance count as downtime? Are problems involving subcontractors excluded? Does the commitment cover the entire application or only individual components?
A support response time is not the same as a restoration time. A provider may respond quickly without resolving an outage quickly. Service credits can provide financial compensation; whether they validly limit other rights requires separate assessment.
Before signing: Explicitly define measurement methods, maintenance windows, incident categories, escalation, restoration and the consequences of repeated outages.
The liability cap must fit the risk.
A cap of a few months’ fees may fall far short of the potential loss when a system is business-critical. Conversely, a provider without a reasonable cap faces risks that are difficult to quantify. It is not just the amount that matters, but also the period, the claims covered, exceptions and how several clauses interact.
Under section 276(3) BGB, liability for intentional conduct cannot be excluded in advance. Pre-drafted liability clauses are also subject to review under the law on standard terms. In particular, provisions on gross negligence, injury to life, body or health, and essential contractual obligations require careful assessment. A boilerplate clause copied from a US contract is therefore no reliable substitute for review under German law.
Before signing: Assess liability caps, exceptions, data loss, restoration and insurance coverage against the specific use case.
A processing agreement does not answer every data question.
If the provider processes personal data on the customer’s behalf, an agreement under Article 28 GDPR is generally required. The actual purposes and decision-making powers determine the roles, not merely the label in the contract. A provider’s own processing purposes may require a different classification.
Review technical and organisational measures, subprocessors, assistance with data subject rights, incidents and deletion. An EU data centre does not automatically rule out transfers to third countries, for example through access from outside the EEA. The requirements of Articles 44 et seq. GDPR must be assessed separately for such transfers.
Before signing: What data is processed, for what purposes, who can access it, where and by whom? The product contract and the data protection agreement must be consistent.
A cheap start can become expensive.
The list price is not always the total price. User tiers, minimum commitments, API calls, storage, additional features and implementation work can substantially change the cost. Automatic renewals, notice periods and price adjustment mechanisms also belong in the commercial review.
B2B SaaS contracts are not automatically subject to the same term and termination rules as consumer contracts. Nevertheless, pre-drafted provisions must, in particular, satisfy transparency requirements and substantive review.
Before signing: Model costs as usage grows or declines, renewals, the termination process and price adjustments using realistic scenarios.
Negotiate switching providers at the start.
A download button does not guarantee a workable exit. Export formats, metadata, attachments, interfaces, assistance and the time until final deletion determine whether data remains usable in the successor system. A transition period with parallel operation may also be necessary.
For data processing services within its scope, the European Data Act contains additional requirements for switching providers. Whether, and to what extent, they apply to a particular SaaS service must be assessed against the service and possible exemptions. Data protection law and contractual duties of protection continue to apply alongside them.
As at 9 November 2026, switching charges for services within scope must generally not exceed costs directly linked to switching. From 12 January 2027, Article 29 Data Act prohibits switching charges; the limited exemptions in Article 31 must be considered. Ongoing service fees and possible costs of early contract termination must be distinguished from these charges. This does not create a blanket right to terminate every SaaS contract free of charge irrespective of its term.
Before signing: Agree binding provisions on export scope, formats, deadlines, assistance, charges, secure deletion and the treatment of backups. Where possible, test the export before it becomes critical.
A short checklist for your next contract.
- Is the agreed service described specifically and completely?
- Is the order of precedence of all contractual documents clear?
- Are availability, incident resolution and legal consequences measurable?
- Does the liability provision fit the actual business risk?
- Are data protection roles, subprocessors and third-country access clarified?
- Are total costs, renewals and price adjustments understandable?
- Is a practically usable exit, including data export, secured?
For providers and customers alike: A good SaaS contract combines legal robustness with processes that work in practice. Risks should be addressed where they arise, not only when a deal stalls or the platform goes down.
Legal framework & sources.
- German Civil Code (BGB): Section 305b – Priority of individually agreed provisions, Section 307 – Review of content, Section 310 – Scope of application, Section 276 – Responsibility (German texts).
- Federal Court of Justice, judgment of 15 November 2006 – XII ZR 120/04, on classifying an ASP contract under rental law (German).
- GDPR, Regulation (EU) 2016/679, in particular Article 28 and Articles 44 et seq.
- Data Act, Regulation (EU) 2023/2854, in particular Chapter VI on switching between data processing services.
General information, not legal advice on an individual matter. The assessment depends on the specific services, contractual documents and circumstances. Law as at 9 November 2026.