SaaS Terms of Service in India: Uptime, Data and Liability

A Bengaluru SaaS startup publishes its terms of service as a link in the website footer. A logistics customer signs up for the inventory module, runs its entire warehouse operation on it for fourteen months, and then sues for ₹90 lakh after a database failure loses two days of stock movements. The startup's terms say liability is limited to the fees paid in the previous month — ₹40,000. The customer's lawyer points out that the terms were never presented at signup, were changed twice without notice, and the version in force at the time is not archived anywhere.

The startup's cap might have been enforceable. But it cannot prove which terms applied, when they were accepted or whether the customer ever saw them. That evidentiary failure is more common in Indian SaaS than the commercial dispute itself, and it is entirely avoidable with a few drafting and product decisions. This guide covers the terms of service clauses that matter for an Indian SaaS business — contract formation, uptime, data, billing, liability — and the Indian consumer and intermediary rules that constrain them.

Why SaaS terms of service need Indian-specific drafting

Most Indian SaaS companies start with a template drafted for Delaware law, then change the governing law clause to India and the currency to rupees. That produces documents that are internally inconsistent and, in places, unenforceable. Indian law imposes obligations that a US template does not address: the Consumer Protection Act 2019 regulates unfair contract terms and misleading advertising; the Information Technology Act 2000 and the Intermediary Guidelines 2021 impose due diligence and grievance redressal obligations on intermediaries; the DPDP Act 2023 imposes consent and notice requirements on data fiduciaries; and the GST law determines where the tax is payable and who bears it.

The terms also have to reflect how the product is sold. A self-serve signup with a card payment is a different legal instrument from an enterprise order form with a negotiated master agreement. Trying to use one document for both produces a document that is too heavy for consumers and too thin for enterprises.

Contract formation: making the terms binding

An online contract in India is enforceable under Section 10 of the Indian Contract Act 1872 read with Section 10A of the Information Technology Act 2000, which confirms that contracts formed through electronic means are valid. The question is not whether electronic contracts are recognised, but whether this particular customer agreed to these particular terms.

Clickwrap beats browsewrap

Indian courts have generally upheld clickwrap agreements — where the user actively ticks a box or clicks an "I agree" button before completing signup — where the terms were available to read and the acceptance was recorded. Browsewrap — where the terms are merely linked in the footer and acceptance is inferred from use — is much weaker, because there is no evidence the user saw the link.

The practical fix is product-level: place the link immediately above the acceptance button, make the button say "Create account and accept the Terms", record the timestamp, the user identifier, the IP address and the version identifier of the terms accepted, and store that record for the life of the account plus the limitation period. An audit log that cannot answer "which version did this customer accept and when" is not adequate.

Who is contracting

If the customer is a company, the individual clicking may not have authority to bind it. Enterprise terms should require the signatory to represent that they are authorised, and should state that the entity named in the account is the contracting party. For self-serve business signups, add a representation that the user is at least eighteen and is acting in the course of business, not as a consumer.

Changes to the terms

A clause allowing unilateral amendment is standard and generally enforceable for business customers if it requires notice and gives a right to terminate. For consumers, the position is stricter: an amendment that materially changes the bargain without a fresh acceptance may be treated as an unfair term.

A workable clause gives thirty days' notice by email and in-product, states that continued use after the effective date constitutes acceptance, and gives the customer a right to terminate before the effective date and receive a pro-rata refund. Keep every version archived with an effective date, because the version at the time of the dispute is the version that governs.

Uptime and service level commitments

SaaS marketing pages promise 99.9% uptime; the terms often promise nothing, or promise "commercially reasonable efforts". That gap is where disputes start, because the customer bought the marketing figure and the contract does not contain it.

Define availability precisely

State the measurement period (calendar month), the measurement point (the service endpoint, tested from at least two locations), the calculation method (total minutes minus unavailable minutes, divided by total minutes), and what counts as unavailable. A service that returns errors on 30% of requests is not "available" merely because the endpoint responds; define unavailability by reference to error rate and response time as well as reachability.

Exclusions must be narrow and notified

Standard exclusions cover scheduled maintenance, emergency maintenance, force majeure, customer-caused failures and third-party network failures outside the provider's control. Each should have conditions: maintenance notified at least forty-eight hours in advance and scheduled outside peak hours; emergency maintenance notified within a stated period; a monthly cap on excluded maintenance. An unlimited maintenance exclusion converts a 99.9% commitment into no commitment at all.

Remedies: credits and termination

The usual remedy is a service credit, expressed as a percentage of the monthly fee scaled to the shortfall. State whether credits are automatic or must be claimed, the deadline for claiming (thirty days is common), whether credits are the sole remedy and whether they carry forward. For business customers, make credits the exclusive remedy for availability shortfalls but preserve termination for a chronic failure — three consecutive months below the threshold, or a shortfall below a floor such as 95% in any month.

For consumer subscribers, a credit regime is not a substitute for statutory rights. A consumer who pays for a service that does not work can seek a refund or compensation under the Consumer Protection Act 2019 regardless of what the terms say.

Data ownership, use and portability

Three questions must be answered in the terms, and most Indian SaaS documents answer only the first.

• Who owns the customer data. The customer does. The provider holds a limited licence to host, process and display it for the purpose of providing the service. Say so expressly, and exclude any right to use it for the provider's own product development or benchmarking.
• What the provider may do with aggregated data. If the provider wants to use anonymised or aggregated data for analytics, say so, define the anonymisation standard, and give the customer an opt-out. "Aggregated and anonymised" is often used loosely to cover data that is still re-identifiable.
• How the customer gets the data back. State the export formats, the frequency, and what happens on termination. A provider that offers a CSV export of the main tables but not attachments, history or configuration has not really provided portability.

AI features and model training

If the product includes AI-assisted features, the terms must state whether customer inputs are used to train models, whether outputs may be used by other customers, and who owns the output. Indian customers increasingly ask these questions during procurement. A term that is silent will be read against the provider when a customer discovers that its data improved a competitor's experience.

DPDP Act obligations in the terms

Under the Digital Personal Data Protection Act 2023, the provider is usually a data processor and the customer is the data fiduciary. The terms should incorporate a data processing annexure covering the categories of personal data, the purpose, the security measures, the sub-processor rules, breach notification, assistance with data principal requests and deletion on termination. Where the provider also collects account data for its own purposes — billing, marketing, support analytics — it is a data fiduciary for that data and needs its own notice and consent basis.

Billing, auto-renewal and the RBI recurring mandate rules

Subscription billing is a legal issue, not just a product one. Indian card networks and the Reserve Bank's rules on recurring transactions require additional factor authentication at the time the mandate is created, and a pre-debit notification to the customer at least twenty-four hours before each charge. A SaaS product that silently charges a stored card without the notification is exposed to chargebacks and to complaints.

The terms should state the billing cycle, the amount or the basis for calculating it, the renewal date, the notice period for cancellation and the refund policy. Auto-renewal should be disclosed prominently at signup, not buried in clause 14. For consumers, the Consumer Protection Act 2019 treats a contract that imposes an unfair condition as actionable, and the Central Consumer Protection Authority has taken an interest in misleading subscription practices, including hard-to-cancel renewals.

Price changes should require notice — thirty days is typical — and should not apply mid-term to a prepaid annual subscription. State the tax treatment: GST is chargeable at the applicable rate, and for Indian customers the place of supply rules determine whether it is CGST and SGST or IGST. For customers outside India, state whether the price is inclusive or exclusive of taxes and who bears withholding.

Liability: caps, exclusions and consumer limits

A liability cap is the most negotiated clause in any SaaS agreement and the least understood. For business subscribers, Indian courts generally enforce a clear cap between commercial parties. The standard structure limits aggregate liability to the fees paid in the twelve months preceding the claim, excludes indirect and consequential loss, and carves out breach of confidentiality, data breach and intellectual property infringement.

Two refinements matter. First, exclude liability for lost data only if you also commit to a backup and restoration obligation; a provider that loses data and disclaims all liability for it will find the disclaimer hard to sustain. Second, do not cap liability for gross negligence or wilful misconduct — an attempt to do so is likely to fail and undermines the credibility of the rest of the clause.

For consumers, Section 2(46) of the Consumer Protection Act 2019 defines an unfair contract as one that causes a significant change in the rights of the consumer, including terms that unilaterally permit termination or impose a disproportionate penalty. A liability cap of one month's fee in a consumer contract for a year-long prepaid subscription may be treated as unfair. Consumer terms should be shorter, clearer and more generous on refunds than business terms.

Intermediary obligations and content

If the SaaS platform hosts customer content that is visible to third parties — a marketplace, a community feature, a document-sharing tool — the provider may be an intermediary under Section 79 of the Information Technology Act 2000. Safe harbour is available only if the provider complies with the due diligence requirements in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, including publishing terms of use that prohibit specified content, appointing a grievance officer, and responding to takedown requests within the prescribed timelines.

Even where the platform is purely internal, the terms should prohibit unlawful content, include a takedown mechanism, and reserve the right to suspend an account that creates a security or legal risk. Suspension clauses should require notice except in emergencies, and should state what happens to the customer's data during suspension.

Dispute resolution and governing law

Indian SaaS terms commonly choose Indian law and arbitration in a named city. For business customers that is workable, provided the arbitration clause is clear about the seat, the number of arbitrators and the language. Under the Arbitration and Conciliation Act 1996, an unclear clause produces a preliminary dispute about the tribunal before the real dispute is heard.

For consumers, an arbitration clause is more fragile. Consumer commissions have generally taken the view that a statutory remedy under the Consumer Protection Act 2019 cannot be taken away by an arbitration clause in standard terms, and a clause that ousts their jurisdiction may be treated as unfair. If the product has consumer subscribers, consider carving consumer disputes out of arbitration and allowing them to approach the consumer commission.

Stamp duty on the terms of service is usually not an issue because the document is accepted electronically and is not separately stamped; the order form or master agreement, where one exists, carries the stamp duty for the arrangement. Confirm the position with your adviser if the order form includes an assignment of intellectual property or a licence of premises.

Common mistakes in Indian SaaS terms of service

• Terms only linked in the footer. No acceptance record, so no proof of agreement.
• No version archive. Nobody can say which terms applied on the date of the dispute.
• Marketing uptime not matched in the terms. The customer bought a number the contract does not contain.
• Unlimited maintenance exclusion. Availability commitments become meaningless.
• Credits as the only remedy for data loss. A small credit for a catastrophic failure invites litigation.
• Silent on AI training. Customer data used to improve the product without a contractual basis.
• No processor annexure. Personal data handled without DPDP-compliant terms.
• Auto-renewal buried in clause 14. Chargebacks and consumer complaints follow.
• No suspension or takedown mechanism. No way to act on unlawful content without breaching the contract.

Frequently asked questions

Are clickwrap terms of service enforceable in India?

Generally yes, where the user actively accepted the terms, the terms were available to read before acceptance, and the provider kept a record of the acceptance. Indian courts have enforced online standard-form contracts on that basis, applying ordinary contract law under the Indian Contract Act 1872 and Section 10A of the Information Technology Act 2000.

Browsewrap is much weaker. A link in the footer without an affirmative acceptance step is difficult to prove and, for consumer users, may not bind at all.

What uptime should an Indian SaaS commit to?

99.9% monthly is the common commitment for business products; 99.5% is acceptable for non-critical tools; 99.95% or higher should be offered only if the architecture genuinely supports it and the measurement method is agreed. The commitment is only as good as its definition, so agree the measurement point, the error-rate threshold and the exclusions before agreeing the number.

Publish a status page and retain historical data. A provider that cannot evidence its own uptime history will struggle to defend a credit claim either way.

Can a SaaS provider change its terms without notice in India?

It can include a variation clause, but the clause needs to be reasonable and, for consumers, needs to give real notice and a genuine right to exit. A term permitting silent amendment at any time may be treated as an unfair contract under the Consumer Protection Act 2019.

Best practice is thirty days' notice, a summary of the changes, an effective date and a right to terminate before that date with a pro-rata refund.

Who owns the data a customer puts into a SaaS platform?

The customer does. The provider should hold a limited licence to process the data to deliver the service, and should not acquire ownership by virtue of hosting it. The terms should say this expressly, and should restrict the provider from using customer data for its own product development, benchmarking or model training without consent.

Where the provider wants to use aggregated data, define what aggregation means and offer an opt-out.

Is a liability cap valid in a consumer SaaS contract in India?

It is harder to sustain. The Consumer Protection Act 2019 allows a consumer to challenge a contract term that causes a significant change in the consumer's rights, and a cap set far below the loss may be treated as unfair. For business customers, caps are generally enforced between commercial parties where they are clear and the parties had equal bargaining power.

The practical approach is to use separate consumer and business terms, with the consumer version offering refunds and a straightforward cancellation right rather than an aggressive cap.

Does a SaaS platform need a grievance officer in India?

If the platform is an intermediary under the Information Technology Act 2000 — for example, it hosts content uploaded by users that is visible to others — the Intermediary Guidelines 2021 require a grievance officer, a published complaints mechanism and response timelines. A pure internal business application that hosts only its customers' private data is usually not an intermediary in that sense.

Where the obligation applies, publish the officer's name and contact details, and keep a complaint log with resolution dates.

Drafting Support

Our drafting team prepares SaaS terms of service for Indian providers, including business and consumer versions, service level schedules, data processing annexures and acceptance records.