SaaS Data Loss Liability: Who Is Responsible When Client Data Is Lost?

By Maître Arnaud Touati
06/10/2026

Reviewed and approved by Arnaud Touati (Maître), partner and co-founder of the firm

Key points

When client data is lost, the SaaS provider’s liability is assessed on two parallel grounds: contractual liability (Article 1231-1 of the French Civil Code) and the GDPR (Article 82).
The contract usually caps liability, for example at 12 months of fees, but this cap does not apply in the event of gross negligence or wilful misconduct, and it cannot be relied on against data subjects who bring a claim under the GDPR.
How the obligation is characterised is decisive: an enhanced obligation of means, with a presumption of fault if data is lost, offers a compromise between an obligation of means and an obligation of result.
Article 32 of the GDPR requires technical and organisational measures (encryption, backups). In the event of a breach, the provider, as processor, informs its client without undue delay, and the client, as controller, notifies the CNIL (French data protection authority), where feasible within 72 hours, if there is a risk.
Article 28 of the GDPR requires a written data processing agreement (DPA) between the client and the provider; failure to perform its security commitments amounts to a contractual breach.
The provider remains exposed to a residual risk that cannot be capped, as the CNIL can impose fines of up to €20 million or 4% of annual worldwide turnover, depending on the infringement.

When client data is lost, the SaaS provider’s liability is assessed on two parallel grounds: contractual liability (Article 1231-1 of the French Civil Code) and liability under the GDPR (Article 82 of the Regulation). The contract usually sets a liability cap (for example 12 months of fees), but this cap does not apply in the event of gross negligence or wilful misconduct, and it cannot exclude GDPR liability towards data subjects. The provider remains exposed to a residual risk that cannot be capped.

Table of Contents

Two sets of rules apply

A loss of client data simultaneously triggers:

Contractual liability under Article 1231-1 of the French Civil Code (Code civil) (in French): compensation for the loss suffered by the client (loss of profit, reconstruction costs, damage to reputation).
Liability under the GDPR if the lost data is personal data: compensation for the damage caused to data subjects (the client’s customers, employees and contacts).
Administrative liability, with possible fines from the CNIL of up to €20 million or 4% of annual worldwide turnover, whichever is higher (Article 83 of the GDPR).
Criminal liability in the most serious cases: processing data without implementing the prescribed security measures, in particular those required by Article 32 of the GDPR, is punishable by five years’ imprisonment and a fine of €300,000 (Article 226-17 of the French Criminal Code (Code pénal) (in French)).

Why the nature of the obligation is decisive

Is the SaaS provider’s commitment to retain data an obligation of means or an obligation of result?

If it is an obligation of result (a quantified contractual commitment on availability, guaranteed backups): the loss automatically makes the provider liable, except in cases of force majeure or an external cause.
If it is an obligation of means (a commitment to implement reasonable measures without guaranteeing retention): the client must prove the provider’s fault (inadequate backups, insufficient security).
If it is an enhanced obligation of means (presumption of fault if data is lost): the provider must show that it exercised the required diligence in order to avoid liability.

An enhanced obligation of means, combined with concrete commitments on backup frequency and retention, is a compromise often sought in B2B SaaS.

The provider’s obligations under the GDPR

Article 32 of the GDPR requires the provider (as processor) to implement appropriate technical and organisational measures to ensure the security of processing, including:

the pseudonymisation and encryption of personal data;
the ability to ensure the confidentiality, integrity, availability and resilience of systems;
the ability to restore the availability of and access to data in the event of an incident;
a process for regularly testing and evaluating the effectiveness of the measures.

Article 33 of the GDPR requires the controller, in the event of a personal data breach that presents a risk, to notify the CNIL without undue delay and, where feasible, within 72 hours; the provider, as processor, must notify the breach to its client without undue delay. In some cases, the data subjects must also be informed (Article 34).

The data processing agreement (DPA)

Article 28 of the GDPR requires a written contract between the controller (the client) and the processor (the SaaS provider), covering:

the subject matter and duration of the processing;
the nature and purpose of the processing;
the type of data and the categories of data subjects;
the obligations and rights of the controller;
the processor’s commitments on security, confidentiality, sub-processing and assistance.

In practice, the DPA sets out security commitments: encryption, backups, audits, certifications (ISO 27001, SecNumCloud, HDS for health data). Failure to perform these commitments amounts to a contractual breach.

The contractual liability cap

SaaS contracts often cap contractual liability:

12 months of fees: the classic B2B SaaS standard.
24 months of fees: critical service, negotiation with a major client.
Fixed amount: sometimes seen, to be handled with care because it is disconnected from the value of the contract.

Limits of the cap:

Gross negligence or wilful misconduct: the cap does not apply, and Article 1231-3 of the Civil Code (in French) then sets aside the rule limiting compensation to foreseeable damage. Gross negligence (faute lourde) is negligence of exceptional seriousness, bordering on wilful misconduct.
Breach of an essential obligation: according to the Faurecia ruling (French Supreme Court (Cour de cassation), commercial chamber, 29 June 2010, No. 09-11.841), only a limitation clause that contradicts the scope of the essential obligation is deemed unwritten; Article 1170 of the Civil Code (in French) deems unwritten any clause that deprives the debtor’s essential obligation of its substance.
Harm to data subjects under the GDPR: the cap agreed between provider and client cannot be relied on against data subjects, who can bring a claim directly against the provider where it has failed to comply with the obligations specific to processors or has acted outside the client’s lawful instructions (Article 82(2) of the GDPR).

Common exclusions of liability

Force majeure within the meaning of Article 1218 of the Civil Code.
Act of the client: handling error, deliberate deletion, misconfiguration.
Act of a third party: large-scale cyberattack, undisclosed zero-day vulnerability.
Indirect losses: loss of opportunity, loss of profit, damage to reputation. A common exclusion, but to be handled with care.

Warning: a total exclusion of indirect losses may be recharacterised as a clause that empties the essential obligation of its substance. The drafting must specify what is excluded and what is not.

Concrete commitments to include in the contract

Backup frequency: hourly incremental, daily full, weekly archives.
Backup location: main data centre, geographically distant secondary site.
Retention period: 30 days minimum, often 90 days for full backups.
Restoration procedure: response time, restorable scope, validation process.
Restoration tests: frequency (typically quarterly), evidence provided to the client.
RPO and RTO commitments: Recovery Point Objective (maximum tolerable data loss, for example 1 hour) and Recovery Time Objective (time to restore service, for example 4 hours).
Security audit: provider certifications, independent audits, reports shared with the client.

Handling a data loss incident

Detection and assessment: identify the extent, scope and cause.
Internal notification and notification to the client: within the contractual deadlines (often 24 hours).
Notification to the CNIL if there is a risk to individuals: without undue delay, where feasible within 72 hours, by the controller.
Notification to data subjects: if there is a high risk to their rights and freedoms (Article 34 GDPR).
Implementation of the restoration plan: document the actions taken, as evidence for later.
Post-incident analysis (post-mortem): report to the client, corrective measures.
Assessment of losses: contractual compensation (SLA, penalty clauses), possible additional damages.

Cyber insurance

Cyber insurance generally covers:

Incident management costs (forensics, communication, expert assessment).
Administrative fines (depending on the jurisdiction).
Professional liability towards clients.
The costs of notifying data subjects.
The provider’s business interruption losses.

Recommendation: the SaaS provider should take out cyber insurance sized above the contractual cap. The client can contractually require annual proof of cover.

Common pitfalls

A single cap that does not distinguish between grounds: applying the same cap to contractual liability and to the GDPR hides the uncapped GDPR risk towards data subjects.
“All damages combined” clause: ambiguous, and a source of disputes over whether indirect losses are excluded.
Untested backups: the client discovers during the incident that the backups are corrupted or cannot be restored.
Unsigned or generic DPA: the data processing agreement is not detailed enough, a source of GDPR disputes.
Unquantified RPO/RTO commitments: without a quantified objective, there is too much room for interpretation.
Late notification: GDPR deadlines exceeded, CNIL sanction.
Insufficient cyber insurance: in the event of a major incident, the provider must absorb the loss from its own funds.

Managing data loss in the contract requires careful coordination between contractual requirements, GDPR obligations and insurance cover. Every situation is different and calls for a case-by-case analysis.