SaaS Limitation of Liability Clause: How Providers Manage Contractual Risk

A SaaS provider delivers a continuous service to clients whose business may depend on it directly. Prolonged downtime, data loss, a security flaw or a processing error can cause significant operational and financial harm. The question, on the provider’s side, is simple: how do you set the limits of your liability in the contract so that they are both protective and legally robust?

On the client’s side, the question is the mirror image: are the limitations proposed by the provider acceptable in view of the real risks taken by deploying the service? Every situation is different; the principles below set out the general framework of French law.

The limitation of liability clause, centrepiece of the SaaS contract

The limitation of liability clause organises how the provider’s contractual risk is managed. It generally combines two levels of protection. First, the exclusion of certain categories of damage: indirect damage, operating losses, data loss, reputational harm. Second, a compensation cap for direct damage.

The basis of contractual liability is laid down by Article 1231-1 of the Civil Code: the debtor is ordered to pay damages for non-performance or delay in performance, unless there is force majeure. The limitation clause frames this liability: it does not remove it, it calibrates it.

What French law regulates

Between businesses, limitation of liability clauses are valid in principle. Three limits nevertheless apply to freedom of contract.

First limit: the essential obligation. Article 1170 of the Civil Code provides that any clause which deprives the debtor’s essential obligation of its substance is deemed unwritten (our unofficial translation; only the French text is authoritative). A clause drafted so as to make the provider not liable for any non-performance, even of its main commitment to provide the service, is deemed unwritten.

Second limit: the derisory cap. The French Supreme Court (Cour de cassation), commercial chamber, set out the test in the Faurecia case (Cass. com., 29 June 2010, No. 09-11.841, published in the Bulletin): a negotiated compensation cap, consistent with the overall economics of the contract, does not deprive the essential obligation of its substance. Conversely, a purely symbolic cap, with no real counterpart, remains vulnerable.

Third limit: gross negligence and wilful misconduct. However the clause is worded, it is set aside when the non-performance results from negligence of extreme seriousness or from deliberate non-performance. A provider can therefore never treat its cap as absolute.

Calibrating the compensation cap

The cap is most often expressed as a multiple of the fees paid over a reference period. In practice:

• a cap of one month’s billing is rarely acceptable for a client whose service is critical;
• a cap of three to six months can serve as a basis for negotiation for a standard SaaS;
• a cap of twelve months of fees may be justified for critical services or high-value contracts;
• specific sub-caps (data breach, breach of confidentiality) may be negotiated at a higher level.

The right cap is not a standard figure: it results from the relationship between the price paid, the real risk borne by the client and the provider’s professional liability insurance cover. Aligning the contractual cap with the insurance policy limit is sound practice.

How the cap interacts with the SLA

Service level commitments (SLA) and the liability clause must be consistent. If the SLA provides for automatic credits in the event of downtime, the contract must state whether they count towards the overall cap or constitute an exclusive remedy. An inconsistency between the two clauses creates legal uncertainty for both parties.

It is also useful to distinguish contractual remedies (service credits, right of termination) from civil liability claims. These mechanisms are not necessarily mutually exclusive, but how they fit together must be explicit: exclusive or cumulative remedy, trigger thresholds, claims procedure.

Indirect damage: make the exclusion precise

Excluding indirect damage is standard in SaaS contracts, but the line between direct and indirect is often blurred. Is lost revenue caused by downtime direct or indirect damage? The answer depends on the wording of the contract and the circumstances. Wording that expressly lists the excluded categories – operating losses, loss of customers, reputational harm, data reconstruction costs – is preferable to a generic formula.

Force majeure and suspension of the service

Article 1218 of the Civil Code defines force majeure: an event beyond the debtor’s control, which could not reasonably have been foreseen when the contract was concluded and whose effects cannot be avoided by appropriate measures. In a SaaS contract, the force majeure clause deserves particular attention: failure of a cloud infrastructure supplier, a massive cyberattack, network outages. Not everything is force majeure: the failure of a subcontractor chosen by the provider remains, in principle, its own business risk.

Security incidents and personal data

In the event of a personal data breach, the SaaS provider acts as a processor within the meaning of Article 28 of the GDPR (Regulation (EU) 2016/679). This status carries its own obligations: a compliant data processing agreement, security of processing, assistance to the controller and notification without undue delay of any breach, so that the client can fulfil its own obligations towards the CNIL (French data protection authority) and the data subjects.

The contract must specify how this notification works, the cooperation obligations in the event of an incident and who bears the related costs. This regulatory dimension combines with the liability clauses, but they do not cover it automatically: administrative fines cannot be capped by contract. For more detail, see our GDPR lawyer page.

On the client’s side: the points to negotiate

A client deploying a critical SaaS can usefully negotiate: the amount of the cap and its calculation basis, higher sub-caps for security and data, the contractual definition of direct damage, a reversibility plan with return of data in a usable format, and proof of professional liability insurance up to the agreed caps.

What a lawyer can do

Drafting liability clauses in a SaaS contract requires a command of the law of obligations and of the technical realities of the service. A SaaS contracts lawyer builds a coherent contractual architecture that protects the provider without making the contract unacceptable to its clients. On the client’s side, the lawyer analyses whether the proposed limitations are acceptable in view of the real risks of the deployment. For a broader perspective, see our IT contracts lawyer page.

FAQ

Can a SaaS provider exclude all liability?
No. A clause that deprives the essential obligation – providing the service – of its substance is deemed unwritten under Article 1170 of the Civil Code. Gross negligence and wilful misconduct also set aside any limitation.

What liability cap is considered valid?
There is no statutory threshold. The Faurecia case law upholds caps that are negotiated and proportionate to the economics of the contract. A symbolic cap, with no counterpart, remains fragile.

Do SLA service credits replace damages?
Only if the contract expressly says so. Without a clear provision, the client can combine the SLA remedies with a contractual liability claim based on Article 1231-1 of the Civil Code.

Who is liable in the event of a data leak?
The client, as controller, is answerable to the data subjects and to the CNIL; the provider, as processor, is answerable for its breaches of the obligations in Article 28 of the GDPR and of its contractual security commitments.

Sources

• Article 1170 of the French Civil Code (in French) – clause depriving the essential obligation of its substance
• Article 1231-1 of the French Civil Code (in French) – contractual liability
• Article 1218 of the French Civil Code (in French) – force majeure
• Cass. com., 29 June 2010, No. 09-11.841 (in French) (Faurecia), published in the Bulletin
• Regulation (EU) 2016/679 (GDPR), Article 28 – processor’s obligations