Key points
- A SaaS contract structures the relationship between the provider and the user of software accessed over the internet, and it has had to include GDPR clauses since the regulation became applicable on 25 May 2018.
- It requires a precise allocation of roles: the provider generally acts as processor and the customer as controller.
- The contract must clearly define the provider’s role: hosting personal data is already processing, which makes the provider at least a processor subject to GDPR obligations.
- The provider must undertake to process the data only on the customer’s documented instructions and to apply appropriate technical and organisational measures.
- The DPA (Data Processing Agreement) sets out the scope, the duration, the nature of the data, requests for access or erasure, and breach notification.
- The contract must provide in advance for reversibility and data retrieval at the end of the relationship, to limit the risk of disputes.
The SaaS contract, or Software as a Service agreement, is the cornerstone of the relationship between provider and user when software is accessed over the internet. Since the GDPR became applicable on 25 May 2018, every party, whether controller or processor, must include essential clauses to provide optimal protection for personal data. This guide gives you a detailed overview of the must-have GDPR clauses to include in any SaaS contract, with practical templates and sound advice for negotiating them successfully.
The legal structure of a SaaS contract under the GDPR
A SaaS contract is a genuine service agreement in which the provider handles not only hosting and software maintenance but also, frequently, data storage. This set-up requires a precise allocation of roles between the provider (generally the processor) and the customer (the controller), with strict obligations under the GDPR covering data security and legal compliance.
Taking a rigorous approach from the drafting stage limits the risk of disputes, prevents non-compliance and clarifies each party’s legal liability. The indispensable clauses must be adapted to the nature of the processing, its sensitivity and the volume of data involved. The contractual relationship must also anticipate any potential difficulty, particularly regarding reversibility or data retrieval at the end of the relationship.
Essential GDPR clauses for a compliant SaaS contract
Including specific provisions in every SaaS contract is imperative to ensure the protection of personal data in accordance with the GDPR. If you want to put your compliance with European standards on a sound footing, it may be wise to consult a GDPR lawyer to assist you in drafting or reviewing these sensitive clauses. Here are the points to address systematically, with template clauses to tailor.
By doing so, the parties clarify their respective obligations and, in the event of an inspection, demonstrate a genuine legal compliance approach. The following examples provide a solid basis to adapt to the specific context of each SaaS service.
Defining the roles: processor or controller?
It is essential that the contract clearly defines the provider’s role. Even simple hosting is processing of data, since storage appears in the definition of processing (Article 4(2) GDPR): the provider is then at least a processor, with the resulting obligations under the GDPR.
Example wording: “The provider acts exclusively as a processor within the meaning of the regulations applicable to the protection of personal data.” This unambiguous identification of the controller (the customer) and the processor (the SaaS provider) puts the handling of any inspections and audits on a sound footing.
Obligations relating to the protection of personal data
The SaaS contract must contain precise undertakings by the provider regarding data security, compliance with the customer’s written instructions, and assistance in the event of an incident or a request from the competent authorities.
Constant developments in cloud technology and the SaaS model make it indispensable to include specific clauses. In this respect, it makes sense to rely on a professional such as a technology lawyer (in French) to anticipate all the technical and legal issues relating to security and SaaS contracting.
Template clause: “The provider undertakes to process personal data only on behalf of the customer and on its documented instructions, and to implement all appropriate technical and organisational measures ensuring the confidentiality, integrity and availability of the data processed.”
Framing the DPA (Data Processing Agreement)
The DPA (data processing agreement), annexed to or incorporated into the main contract, sets out precisely the scope of the processing, its duration, the nature of the data concerned and the categories of data subjects involved. It also details how requests for access, portability or erasure are handled, and how a personal data breach is notified.
This document also formalises the audit conditions and the expected technical documentation, and strengthens the overall legal compliance of the contractual framework.
In practice: template clauses to adapt to your needs
To make implementation easier, here are several standard wordings that can easily be tailored and inserted into your SaaS contracts.
- Handling data security breaches: “The processor shall notify the controller of any security breach affecting personal data without undue delay after becoming aware of it, together with all relevant information.”
- Data retrieval/reversibility: “On request or on expiry of the contract, the processor shall return or delete all of the customer’s data in a usable format, at no additional cost other than those expressly provided for.”
- Audit and documentation: “The customer reserves the right to carry out an annual GDPR compliance audit, subject to reasonable notice. The provider shall supply all the information needed to demonstrate compliance with its obligations.”
Adding a structured responsibility matrix makes it easier to identify the key points of the SaaS contract and quickly spot any grey areas, particularly regarding incident management or maintenance operations that affect the protection of personal data.
| Clause | Description | Responsible party(ies) |
|---|---|---|
| Breach notification | Inform the customer of a personal data breach without undue delay | Processor |
| Assistance with data subject rights | Respond to requests for access, rectification or erasure from data subjects | Processor & Controller |
| Erasure/return of data | Delete or return the data at the end of the contract | Processor |
| GDPR audit | Allow and support external audits | Processor |
Further points not to overlook in negotiation
Negotiating GDPR clauses requires particular attention to certain aspects such as service performance and availability, the geographical location of servers, and the use of sub-processors.
Paying attention to these points reduces the risk of joint and several liability or exposure to a penalty in the event of a breach. Discussions will cover in particular the granularity of reporting, the frequency of security testing, and the level of assistance provided in the event of a major incident.
Service availability and performance
Provide for a service level agreement (SLA) clause specifying the expected availability rates, outage handling procedures and applicable compensation. This clause should also state the potential impact of downtime on compliance with the regulatory requirements relating to the protection of personal data.
A summary table can structure this section:
| Availability target | Period covered | Compensation provided |
|---|---|---|
| 99.9% guaranteed availability | Monthly | Service credits/compensation |
| 24/7 support | All year round | Immediate handling of critical incidents |
Controlling cross-border data flows and chains of sub-processors
The location of servers or data centres directly affects the conditions for international transfers of personal data. Where sub-processors are used, a complete list, regularly updated and accessible to the customer, remains indispensable to maintain legal compliance.
Each sub-processor must be bound by the same data protection obligations as the initial processor, formalised in successive Data Processing Agreements. These clauses prohibit any transfer of data outside the European Economic Area without a specific framework: an adequacy decision of the European Commission, standard contractual clauses adopted by the Commission or another appropriate safeguard provided for in Article 46 GDPR.
FAQ on the essential GDPR clauses in a SaaS contract
Which clauses must a SaaS contract contain to comply with the GDPR?
A GDPR-compliant SaaS contract must include several essential clauses: clear designation of the controller and the processor, a commitment on data security, procedures for notifying security incidents, assistance to the customer in handling data subject rights, conditions for returning or destroying the data, and prior authorisation for engaging other processors. The DPA must explicitly reflect all these commitments.
- Designation of the parties and responsibilities
- Deletion or return of data at the end of the contract
- Handling security breaches
- Conditions for engaging other processors
How do you draft a GDPR-compliant reversibility clause in a SaaS contract?
The reversibility clause must define precisely how all of the customer’s data will be made available again in a standardised, reusable format as soon as the contract ends. It must also set out the return timetable, any costs and the provider’s commitment to permanently delete the remaining copies after transfer. This clause protects the customer’s business continuity and ensures access to its data when it changes provider.
- Transfer of data in a usable format
- Commitment to deletion after transfer
- Clear completion deadlines
Who is liable for a failure to protect personal data under a SaaS contract?
As a general rule, the customer remains responsible for compliance with the GDPR, because it is the controller. However, the provider (the processor) is liable for its contractual commitments and, towards data subjects, for the damage caused where it has not complied with the obligations specific to processors or has acted outside the customer’s lawful instructions (Article 82(2) GDPR): lack of security measures, missing documentation, or use of the data for purposes other than those intended.
| Failure | Primarily liable | Secondary liability |
|---|---|---|
| Failure to follow the customer’s instructions | Processor | Customer (if instructions are incomplete) |
| Physical security flaws | Processor | - |
| Inadequate information given to data subjects | Customer | Processor (if it failed to provide information) |
Should the DPA be a separate document or part of the main SaaS contract?
Annexing a DPA (Data Processing Agreement) to the SaaS contract is the most common practice. It clearly separates commitments relating to the protection of personal data from purely functional provisions. However, the DPA can be incorporated into the body of the main contract if this makes the whole easier for both parties to understand.
- Annex a DPA to isolate confidentiality and technical aspects
- Use consistent contractual terminology across all documents
- Update the DPA when new services or additional processing are added
