SaaS Agreement in Hong Kong: Template, Key Clauses and Local Law (2026)

What law governs a SaaS agreement in Hong Kong? Hong Kong has no dedicated software-as-a-service statute. A SaaS contract is a commercial services agreement governed by general law, which gives the parties broad freedom to agree their terms. The main sources are: - Common law of contract, which supplies the default rules on formation, performance and breach, and leaves most terms to the parties.

• The Personal Data (Privacy) Ordinance (Cap. 486, PDPO), which applies wherever the service processes personal data, through its six data protection principles and the rules on data processors and data security.
• Consumer and fair-dealing statutes where relevant, including the Control of Exemption Clauses Ordinance (Cap. 71), which limits how far liability can be excluded, the Sale of Goods Ordinance and the Supply of Services (Implied Terms) Ordinance (Cap. 457), and the Trade Descriptions Ordinance (Cap. 362) for marketing. Because the service is hosted and often delivered from outside Hong Kong, the PDPO treatment of outsourced processing and cross-border transfers usually needs the most care. ## SaaS is a service, not a licence or a sale In SaaS the customer accesses a hosted service rather than receiving a copy of the software. That shapes the contract: - The provider grants a right to access and use the service for the term, not a perpetual licence.
• The provider keeps ownership of the software and platform.
• Availability, support and data handling are the real subject of the deal, so service levels and the data terms carry weight. ## The PDPO and outsourced processing Under the PDPO, the customer is usually the data user responsible for the personal data, and the SaaS provider processing that data on the customer's behalf is a data processor. The data user must use contractual or other means to prevent the processor from keeping data longer than necessary and to guard against unauthorised access. In practice this means the SaaS agreement should bind the provider to process only on the customer's instructions, keep data secure, and support the customer's obligations under the data protection principles. Note that the cross-border transfer provision (section 33) has not been brought fully into force, but the Privacy Commissioner recommends treating transfers as if it were, so a prudent contract addresses transfer safeguards anyway. ## Key clauses in a Hong Kong SaaS agreement ### Service description and access rights Define the service, the subscription, permitted users and usage limits, and state that this is access to a hosted service for the term, not a transfer of software. ### Fees and invoicing Set fees, billing cycle, renewal pricing, and late-payment terms. ### Service levels and support Set uptime commitments, support response times, maintenance windows, and the remedy for missed levels (usually service credits) as the agreed remedy. ### Data protection and security This is central where personal data is processed. Address processing only on instructions, security measures, use of sub-processors, retention limits, breach handling and cross-border transfer safeguards, consistent with the PDPO data protection principles. ### Customer data ownership and return Confirm the customer's data remains the customer's, the provider processes it only to deliver the service, and set export and deletion on termination. ### Intellectual property Confirm the provider owns the platform and improvements, grant a limited right to use, and deal with ownership of configurations and feedback. ### Confidentiality Protect each side's confidential information, with carve-outs and survival. ### Warranties, liability and indemnities Give a service warranty, disclaim others to the extent allowed, cap liability and exclude indirect losses, bearing in mind the Control of Exemption Clauses Ordinance limits on excluding certain liabilities, especially to consumers. ### Term, renewal, suspension and termination Set the term, auto-renewal and notice, suspension for non-payment, and data handling on exit. ### Governing law and disputes Parties usually choose Hong Kong law and courts or arbitration. Hong Kong is a leading arbitration seat and the New York Convention applies, so awards are widely enforceable. ## A clause-by-clause skeleton 1. Parties and definitions

2. Service description and access rights
3. Users, usage limits and acceptable use
4. Fees, invoicing and renewal pricing
5. Service levels, support and credits
6. Data protection and security (PDPO)
7. Customer data: ownership, export and deletion
8. Intellectual property
9. Confidentiality
10. Warranties and disclaimers
11. Limitation of liability
12. Indemnities
13. Term, renewal, suspension and termination
14. Governing law and dispute resolution ## Common mistakes to avoid - Treating a SaaS deal as a software licence or sale, which misframes ownership and risk.

• Thin data-processor terms when the PDPO requires the data user to control its processor by contract.
• Ignoring cross-border transfer safeguards because section 33 is not fully in force.
• Over-excluding liability beyond what the Control of Exemption Clauses Ordinance allows.
• Leaving renewal and price-escalation terms vague. ## Managing SaaS contracts after signing A SaaS business runs on many similar subscription agreements, each with its own renewal date, price escalator, service-level commitment and data terms. Letting renewals auto-roll unnoticed, or losing track of which customer got which bespoke terms, is where margin and risk leak. Many teams keep the whole portfolio in one AI contract workspace: generate from a tuned template, see per-clause risk, make plain-English edits across documents, and get renewal and obligation alerts on a live timeline. Adira is built this way, India-first today, with non-India jurisdiction depth such as Hong Kong on its roadmap, so treat the Hong Kong-law points here as a starting point to confirm with local counsel. This article is general information, not legal advice. Hong Kong contract, consumer and data-protection law change, and the right terms depend on your service and customers. Confirm the current law and get local advice before you sign.