SaaS Agreement in Singapore: Template and Key Clauses (2026)

A SaaS agreement in Singapore is the contract under which a software provider gives a customer access to software hosted in the cloud, usually for a subscription fee, rather than selling a copy to install. The customer is buying a right to use a service, not owning software, so the contract turns on access, uptime, data and what happens at the end. In Singapore the data clauses matter most, because the Personal Data Protection Act 2012 (PDPA) sets real obligations whenever personal data is handled. This is general information, not legal advice. The enforceability of specific terms and data rules depend on your facts and can change, so confirm the current position before relying on a clause. ## What makes a SaaS contract different Unlike a licence for installed software, a SaaS deal is a continuing service. The customer never holds the code; it logs in. That shifts the risk. The customer worries about availability, its own data and being locked in. The provider worries about misuse, payment and unlimited liability. A good SaaS agreement balances these with clauses the installed-software world did not need, such as service levels, data handling and exit assistance. ## The PDPA and data: the Singapore-specific part If the service handles personal data of individuals, the PDPA applies. In most SaaS deals the customer is the organisation responsible for the data and the provider acts as a data intermediary processing it on the customer's instructions. The contract should say so, set out what the provider may do with the data, require appropriate security, deal with notifying the customer of a data breach, and cover return or deletion of data at the end. The PDPA is enforced by the Personal Data Protection Commission (PDPC). If data leaves Singapore, the transfer-limitation obligation applies, so the contract should address where data is stored and processed. <!-- [VERIFY] current PDPA mandatory breach-notification thresholds before citing specific figures --> ## A clause by clause skeleton Use this as a structure to adapt, not a finished document. ``` SAAS AGREEMENT Parties: [Provider name and address] and [Customer name and address] Date: [date] 1. ACCESS AND LICENCE The Provider grants the Customer a non-exclusive, non-transferable right to access and use the Service during the Term, for the Customer's business, up to [number] users. 2. SERVICE LEVELS The Provider will use [reasonable] efforts to keep the Service available [percentage] of the time, measured as set out in Schedule 1. Service credits apply as set out there. 3. SUPPORT Support is provided as set out in Schedule 1, with response targets by severity. 4. FEES AND PAYMENT The Customer pays [amount] per [user / period], invoiced [frequency], payable within [number] days. Fees exclude GST, which is added where it applies. 5. CUSTOMER DATA AND THE PDPA The Customer owns its data. The Provider processes personal data only on the Customer's instructions as a data intermediary under the PDPA, keeps it secure, and tells the Customer without undue delay of any data breach. 6. SECURITY The Provider maintains appropriate technical and organisational security measures, described in Schedule 2. 7. INTELLECTUAL PROPERTY The Provider keeps all rights in the Service. The Customer keeps all rights in its data and content. 8. WARRANTIES The Provider warrants the Service will perform materially as described. Other implied terms are excluded so far as the law allows. 9. LIABILITY Neither party is liable for indirect or consequential loss. Total liability is capped at [for example, fees paid in the prior 12 months], subject to liabilities that cannot be excluded by law. 10. TERM AND RENEWAL The Term is [period], renewing automatically for [period] unless either party gives [number] days notice. 11. TERMINATION AND EXIT Either party may end the agreement for material breach. On ending, the Provider makes the Customer's data available for export for [period], then deletes it. 12. GOVERNING LAW Governed by Singapore law. Disputes resolved by [the courts of Singapore / arbitration in Singapore]. Schedule 1: Service levels and support Schedule 2: Security

- Treating data as an afterthought, when the PDPA requires clear roles, security and breach handling.
- No exit or data-export clause, leaving the customer unable to retrieve its own data if the relationship ends.
- Auto-renewal with a long notice period buried in the fine print, which surprises customers at renewal.
- An uncapped or one-sided liability clause that neither party would accept if they read it closely. ## Keeping the agreement and its schedules together A SaaS relationship generates more than one document: the master agreement, the service-level schedule, the security schedule, the data-processing terms, order forms and renewals. When these scatter across inboxes and drives, nobody is sure which uptime number or data term is actually in force. Drafting an agreement like this, checking a data or liability clause against the PDPA and the customer's needs, editing a term in plain language and holding every version with its date can live in one AI workspace tuned to how your company contracts. Adira is built around that single workspace, running on Claude, with per-seat pricing shown up front and a 7-day trial, India-first and built to work across jurisdictions. You can see more at [its site](https://adiralaw.com). For a single subscription the skeleton above is enough on its own. The point worth taking is that the agreement and its schedules are easier to trust when they stay in one place and in step.