SaaS Agreement in the UK: Template and Key Clauses (2026)

A SaaS agreement in the UK is the contract under which a provider lets a customer access cloud software on a subscription, rather than selling a copy to install. The customer pays per user or per tier for the right to use the service while the subscription lasts. Because the provider usually hosts the customer's data, the agreement has to do two things well: define the service and its availability, and deal properly with data protection under the UK data regime. This is general information, not legal advice. Data protection and liability terms carry real risk, so take advice for business critical or high volume services. ## Key clauses, clause by clause 1. Parties and the service. Name the provider and customer and describe the software and what it does. 2. Licence to access. Grant a non exclusive right to access and use the service during the subscription. Make clear the customer does not own the software and gets no source code. 3. Users and acceptable use. Define authorised users, any per seat limits, and prohibited uses. 4. Subscription term, fees and renewal. Set the term, the fees, how they are billed, any increase mechanism, and whether the subscription renews automatically with what notice to stop it. 5. Service levels and support. Set an availability target, for example a monthly uptime percentage, planned maintenance windows, support hours and response times, and a remedy such as a service credit if the target is missed. 6. Customer data and ownership. Confirm the customer owns its data and the provider only processes it to deliver the service. Set out return and deletion of data on exit. 7. Data protection. This is the clause that cannot be skipped. Where the provider processes personal data on the customer's behalf, it acts as a processor and the customer as controller. The UK GDPR and the Data Protection Act 2018 require a written contract with specific processor terms: processing only on documented instructions, confidentiality, security measures, rules on sub processors, help with data subject rights, breach notification, and deletion or return at the end. International transfers of personal data outside the UK need an approved safeguard such as the UK addendum to the standard contractual clauses. 8. Security. State the security measures and any breach notification commitment. Name certifications only if genuinely held. 9. Intellectual property. The provider keeps all rights in the software. Address ownership of any configuration or feedback. 10. Warranties and disclaimers. Warrant that the service will perform materially as described, and disclaim beyond that within the law. 11. Liability. Cap liability and exclude indirect loss, but remember the Unfair Contract Terms Act 1977: you cannot exclude liability for death or personal injury from negligence, or for fraud, and other limits must be reasonable. Consider a higher or separate cap for data protection breaches. 12. Suspension and termination. Set rights to suspend for non payment or misuse, to terminate for material breach or insolvency, and the data export window on exit. 13. Governing law and disputes. Choose the law and courts. ## Data protection in more detail For most SaaS deals the customer decides why and how personal data is processed, so it is the controller, and the provider follows instructions, so it is the processor. The law requires the processor terms listed above, often set out in a data processing agreement attached to the main contract. Getting this wrong is not just a drafting slip: both parties can face enforcement by the Information Commissioner. Confirm where data is hosted and that any transfer abroad is covered by a valid safeguard. ## Common mistakes to avoid - No data processing terms, or a data processing agreement that does not meet UK GDPR requirements.

• An uptime promise with no definition of downtime and no remedy if it is missed.
• Selling the software as if it were a perpetual licence when it is really a subscription.
• Auto renewal with a long notice period the customer never spots.
• No clear data export and deletion rights, so the customer is locked in at the end.
• Claiming security certifications the provider does not actually hold. ## Price increases and renewal traps Subscriptions often renew automatically, and many disputes start with a renewal the customer did not expect or a price rise it did not agree to. Read the renewal clause closely. Note the notice you must give to stop the subscription renewing, diarise it, and check whether the provider can raise the price on renewal and by how much. If price certainty matters, negotiate a cap on increases or a fixed price for an agreed number of years. The same discipline applies to usage based fees, where going over a tier can trigger charges that were easy to miss at signing. ## Keeping SaaS contracts governed A business today signs many SaaS agreements, each with its own renewal date, price review, uptime commitment and data processing terms. The ongoing work is tracking those renewals, holding the current version, and checking the data protection terms are adequate. Spread across inboxes, renewals auto trigger at a higher price and data risks go unreviewed. Adira is an AI workspace, built on Claude, where you can draft or review a SaaS agreement and its data processing terms, check a liability cap for risk, sign electronically, and track renewals and key dates in one place, with public per seat pricing and a 7 day trial. It is India first and global capable, and a command centre view of your subscriptions and obligations is on its roadmap. The underlying advice holds on its own: define uptime and its remedy, get the UK GDPR processor terms right, and never lose a renewal date.