SaaS and Cloud Contracts Under German Law

What SaaS and cloud contracts are under German law

SaaS and cloud contracts give the customer access to software, platforms or infrastructure that the provider operates on its own systems. German law has no specific contract type for them. Courts and practitioners analyse the bundle of obligations: providing access to software and storage space looks like a rental (Mietvertrag, §§ 535 ff. BGB); support and implementation look like services or work; data hosting may have elements of custody. The Federal Court of Justice (BGH) has long treated the provision of software over the internet as predominantly rental-type, and most commentators apply that approach to modern SaaS.

The classification matters because rental law gives the customer a statutory right to a usable object throughout the term and a rent reduction for defects that reduce usability (§ 536 BGB), and makes the provider liable without fault for defects that existed at the start of the contract (§ 536a BGB). Providers therefore draft carefully around these rules, and customers need to know which of those protections survive the provider's terms.

This guide covers the main building blocks: standard terms control, service levels, data protection, security, and exit management under the EU Data Act. It is written for buyers and providers of SaaS and cloud contracts in Germany.

Standard terms control in SaaS and cloud contracts

Most SaaS and cloud contracts are concluded on the provider's pre-formulated terms. In German law, these are standard business terms (Allgemeine Geschäftsbedingungen, AGB) unless they were genuinely negotiated. Between businesses, the specific clause bans in §§ 308 and 309 BGB do not apply directly, but the general fairness test of § 307 BGB does, and courts use the values behind the clause bans as guidance (§ 310(1) BGB).

Clauses that regularly attract scrutiny include:

• Unilateral changes to the service or the terms without a valid reason, notice and a right to terminate;
• Exclusion of the rent reduction for defects, or reducing all remedies to service credits;
• Blanket liability exclusions covering gross negligence or essential contractual duties;
• Short cut-off periods for claims and broad suspension rights for the provider;
• Automatic renewals with long notice periods, which are less of an issue between businesses but still need clear drafting.

Global providers often use terms governed by foreign law. A choice of law is generally possible in B2B contracts, but customers should check how the chosen law treats limitation of liability and whether German mandatory rules, such as data protection and sector regulation, apply regardless.

Service levels and remedies

Service level agreements (SLAs) are the technical heart of SaaS and cloud contracts. An availability promise of "99.9%" means little unless the contract defines what counts as available, how it is measured, over which period, and what is excluded. Typical exclusions cover scheduled maintenance, force majeure and customer-caused outages; customers should cap maintenance windows and require notice.

Making service credits the exclusive remedy for all performance failures is a typical point of conflict. If the contract is rental-type, excluding the statutory rent reduction in standard terms is risky. A balanced clause treats credits as a lump-sum reduction that is credited against any further damages, while preserving the right to terminate for good cause.

Data protection, security and confidentiality

Whenever the provider processes personal data on the customer's behalf, the customer remains the controller and the provider acts as processor. Article 28 GDPR then requires a contract that sets out the subject matter, duration, nature and purpose of processing, the types of data and categories of data subjects, and the processor's duties, including instructions, confidentiality, security measures, sub-processor approval, assistance and deletion or return of data at the end.

For international providers, the transfer rules in Chapter V GDPR also apply: the customer needs a transfer mechanism such as an adequacy decision or standard contractual clauses and, where relevant, a transfer impact assessment. Many providers now offer EU data residency, but support and sub-processor access from third countries still needs to be covered.

On security, buyers in Germany frequently ask for a current attestation under the Federal Office for Information Security's Cloud Computing Compliance Criteria Catalogue (C5). The BSI describes C5 as minimum information security requirements for cloud services and recommends that customers request the audit report initially and then annually.

The BSI itself does not audit the provider or evaluate the reports, so the customer must read the report and identify gaps relevant to its use case. Entities covered by NIS2 or by financial regulation have additional supply-chain duties, explained in our article on IT outsourcing in regulated sectors.

Liability, price changes and term

Liability is the most heavily negotiated topic in SaaS and cloud contracts after service levels. Providers typically offer an annual cap equal to the fees paid in the previous twelve months and exclude indirect and consequential loss, lost profit and loss of data. Under German law, a cap in standard terms is more likely to be upheld if it is proportionate to the damage typically foreseeable for the contract.

Liability for intent and for injury to life, body or health cannot be excluded in standard terms, and limiting liability for gross negligence or for the breach of essential contractual duties (Kardinalpflichten) is only possible within narrow limits. A blanket exclusion of liability for data loss is risky where the provider's core promise is to store the customer's data securely.

Customers should pay particular attention to loss of data. A practical solution is to define the provider's backup obligations precisely – frequency, retention, geographic separation and restore times – and to link liability for data loss to breaches of those duties. Separate, higher caps for data protection and confidentiality breaches are common in enterprise deals.

Price adjustment clauses are another source of disputes. A clause that lets the provider raise prices at its discretion during a fixed term will usually fail the fairness test unless it is tied to objective criteria, such as a published index or documented cost increases, and gives the customer a right to terminate if the increase exceeds a threshold. For multi-year commitments, customers often negotiate price protection for the initial term and a cap on increases at renewal.

Finally, the term structure should fit the customer's planning. Long initial terms with automatic renewals are legitimate between businesses, but the notice periods should be manageable, and the customer should have an extraordinary termination right if the provider is acquired by a competitor, materially changes the service or fails to meet regulatory requirements that apply to the customer.

Intellectual property and customer data

The contract should state that the customer retains all rights in its data and content, and that the provider may use such data only to provide the service. If the provider wants to use customer data to train AI models or to create aggregated statistics, that use should be expressly agreed, limited and, for personal data, assessed under the GDPR. Rights in configurations, workflows and custom developments should also be allocated, because they often have significant value at exit.

Exit management and the Data Act's switching rules

Exit is where cloud arrangements most often fail customers. Since 12 September 2025, the Data Act (Regulation (EU) 2023/2854) has applied, and Chapter VI contains binding rules on switching between data processing services. Providers must set out switching rights in a written contract, which must include at least:

• a right to switch to another provider or to on-premises infrastructure, with a maximum transitional period of 30 calendar days, during which the provider must assist and maintain continuity (Article 25(2)(a));
• a maximum notice period for initiating the switch, which must not exceed two months (Article 25(2)(d));
• an exhaustive specification of exportable data and digital assets (Article 25(2)(e));
• a minimum data retrieval period of at least 30 calendar days after the transitional period (Article 25(2)(g));
• full erasure of the customer's exportable data after successful switching (Article 25(2)(h)).

Switching charges are being phased out. Between 11 January 2024 and 12 January 2027, providers may charge only reduced switching charges that do not exceed their direct costs; from 12 January 2027 they may not impose any switching charges (Article 29). Contracts concluded before September 2025 should be reviewed so that their exit and fee provisions are consistent with these rules. Our guide to cloud switching under the Data Act covers the details, and the Data Act practice page explains the wider framework.

Beyond the Data Act, well-drafted contracts also address what happens to integrations, configurations and custom code, provide for transition assistance at agreed rates and set out how backups and logs are handled during and after the transition.

Negotiating SaaS and cloud contracts: checklist

1. Scope and documentation. Describe the service by reference to a dated service description; restrict unilateral changes that reduce functionality.
2. SLAs. Define availability and resolution times precisely; preserve statutory rights beside service credits; agree a termination right for chronic failure.
3. Liability. Agree caps that match the risk, with carve-outs for intent, gross negligence, injury and data protection breaches where appropriate.
4. Data protection. Attach an Article 28 GDPR agreement, a list of sub-processors and the transfer mechanism.
5. Security. Incorporate a security annex and the right to receive audit reports such as C5 or ISO certificates.
6. Exit. Implement the Data Act switching clauses and agree formats, assistance and retrieval periods.
7. Price changes. Tie increases to objective indices or notice and termination rights.

How TRW & Co helps

We advise customers and providers on SaaS and cloud contracts, from enterprise software subscriptions to platform and infrastructure services. We review provider terms against German standard terms law, negotiate SLAs, liability and data protection terms, prepare Data Act-compliant switching and exit provisions, and support procurement teams with negotiation playbooks. For providers, we design terms that hold up under § 307 BGB and meet the Data Act's requirements. Our work links with our GDPR and data protection practice and our article on IT contracts for agile projects. To discuss a contract, contact us. This article is general information and not legal advice.