SaaS agreement

A SaaS agreement is the contract under which a supplier makes its software available as a service over the internet. The customer receives no copy and installs nothing, but buys access, availability and maintenance. In legal terms it is therefore closer to a services contract than to a licence.

Legal basis

There is no separate statutory regime for SaaS. The contract is governed by the general law of obligations in Book 6 of the Dutch Civil Code, and in particular the rules on services in Article 7:400 and following. Because the supplier processes the customer’s personal data, Article 28 GDPR applies and a data processing agreement is compulsory. For contracts with consumers, Articles 7:50aa and following of the Civil Code have applied since 2022 to digital content and digital services, with their own conformity and update obligations. Where the supplier serves an essential or important entity, the Dutch Cybersecurity Act feeds through into the security arrangements.

How it works in practice

The heart of any SaaS agreement lies in four schedules: the service description, the service levels with availability percentages and response times, the security schedule and the data processing agreement. The exit arrangement is equally decisive: in what format do you get your data back, within what period, at what price, and how long does the supplier keep them afterwards? Price indexation and the right to change the service unilaterally deserve particular attention, because a customer can rarely walk away easily once migration is complete.

Where it goes wrong

An availability figure of 99.9 per cent sounds demanding, but without a measurement method, measurement period and maintenance exclusions it means little. Many disputes also turn on whether an outage falls within the indemnity or under force majeure. The greatest exposure, however, arises at the end: contracts that fail to address the return of data leave the customer in a negotiating position with nothing left to negotiate.