Reviewing a SaaS vendor's terms before your business signs up

A SaaS vendor's terms are accepted by clicking, updated by posting, and written so that the vendor can change the service, the price and the terms while the customer's data sits on the vendor's platform. For a business that will run its operations on the service, the terms decide what happens when the service fails, when the price rises, and when the business wants to leave with its data. I review the terms from the customer's side and return them marked up with a written explanation of the changes and which ones a vendor will accept, for a fixed fee of £495 in three working days.

Who this is for

Businesses in England and Wales about to subscribe to a cloud application for accounting, CRM, HR, project management, e-commerce, communications or a line-of-business function, and want to know what the terms and the data processing addendum commit them to before the first payment. The subscriber is a business, so the consumer subscription rules do not apply to it.

What to look for in a SaaS vendor's terms

The data processing terms and where the data goes

Where the service processes personal data on the customer's behalf, the vendor is a processor and the contract must contain the terms required by Article 28 of the UK GDPR and the Data Protection Act 2018: processing on documented instructions, confidentiality, security, sub-processors, assistance, deletion or return, and audit. The review checks the vendor's data processing addendum against Article 28, identifies the sub-processors and the countries where data is hosted, and confirms the transfer mechanism under Article 46 for any processing outside the UK. The Data (Use and Access) Act 2025 is amending these rules and the review notes the current position.

Service levels, credits and the vendor's exclusions

The service level commitment should state the availability target, how it is measured, what is excluded (planned maintenance, the customer's own systems, third-party outages) and the credit for a miss. The review checks that credits are meaningful, that the customer can terminate for persistent failure rather than only collect credits, that support hours and response times match the business's working hours, and that the vendor commits to notice of planned maintenance outside those hours.

Auto-renewal, price rises and the right to change the terms

SaaS terms renew for a further term unless notice is given in a window, allow the vendor to increase the price at renewal, and reserve the right to change the terms and the service by posting an update. The review asks for notice of renewal in advance of the window, a cap on price increases at renewal, a right to terminate if a change to the terms or the service is materially adverse, and no change to the data processing addendum without consent. The consumer subscription rules in Part 4 Chapter 2 of the Digital Markets, Competition and Consumers Act 2024 do not protect a business subscriber, so the contract has to.

Suspension, termination and the vendor's insolvency

Vendors reserve the right to suspend the service for late payment, suspected breach of acceptable use or security risk, and to terminate on short notice. The review asks for notice and a period to remedy before suspension for non-payment, for suspension to be proportionate and lifted when the cause is resolved, for the customer's own termination rights for the vendor's breach, and for the effect of the vendor's insolvency: section 233B of the Insolvency Act 1986 restricts a supplier from terminating because the customer has entered insolvency, but nothing keeps a failed vendor's servers running, so the exit provisions matter more.

Data return, export and deletion on exit

The terms should give the customer a right to export its data in a usable format at any time and for a period after termination, and should oblige the vendor to delete the data after that period and confirm deletion. The review checks the format, the period, whether export is self-service or a chargeable professional service, whether the vendor may keep the customer's data for its own purposes, and whether the customer's content and configuration remain the customer's property.

Liability, security incidents and the acceptable use policy

The liability clause will cap the vendor's liability at the fees paid in a period and exclude data loss. The review asks for a higher cap for data protection and confidentiality breaches, for the vendor to bear the cost of notifying regulators and individuals after a breach it caused, and for the security commitments to be stated in the contract rather than in a web page the vendor can change. Where the terms are the vendor's standard form, section 3 of the Unfair Contract Terms Act 1977 subjects the exclusions to the reasonableness test, and the Late Payment of Commercial Debts (Interest) Act 1998 governs interest on unpaid subscription fees.

What it costs

Standard review, £495. Marked-up document and a written explanation of the changes. Three working days.

Buying online forms the engagement on payment. The scope is what the contract review page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• Your own contract returned with my amendments as tracked changes, plus a clean version with every change accepted, ready to send to the other side
• Comments in the document where a point needs explaining
• A written explanation of what I have changed and why, by email or as an attachment if it is lengthy, marking the points I would hold firm on and the ones that are negotiable
• A view on what is normal market practice and what is the other side pushing their luck
• One round of follow-up questions by email, included

What is not included

• Negotiating directly with the other side, which I quote separately once I know who is on the other side. Where the other side is willing to share a live document, I can work in that document directly
• Drafting a replacement contract from scratch
• Advice on the law of any jurisdiction other than England and Wales
• Tax, accounting or regulatory advice
• Disputes about a contract that is already signed

Questions I am often asked

We accepted the terms by clicking. Can we still negotiate them?

The click-through terms bind you for the current term, but vendors selling to businesses negotiate order forms and data processing addenda, and what matters can be added in an order form that overrides the online terms. The review produces the order form points to ask for at signature or at renewal.

The vendor can change its terms by posting an update. Is that enforceable?

Between businesses it can be, if you agreed to it. The review asks for changes to be notified in advance, for a right to terminate without penalty if a change is materially adverse, and for the data processing addendum, the security commitments and the price to be changeable only with your agreement.

How do we get our data out if we leave?

Only in the way the terms provide, which is why the review checks them before you sign. You should have a self-service export in a usable format during the term and for a period after it ends, with deletion confirmed afterwards, and a commitment that the vendor will assist with migration at a stated rate.

Related guidance and services

• Contract review, £495, the service this page describes
• Data protection agreements and privacy terms, £795
• SaaS and technology contracts, £995
• Reviewing a software licence from a vendor
• Reviewing a cloud hosting agreement

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.