B2B SaaS Agreement – India template

Overview

A B2B SaaS Agreement governs the subscription relationship between an Indian software-as-a-service provider and a business customer, covering access to the software, service levels, data handling, fees, and the parties' respective liabilities. Its enforceability as a contract rests on the Indian Contract Act 1872, and it is typically formed and signed electronically, which is expressly permitted under the Information Technology Act 2000. Electronic formation and signature: Sections 4 and 5 of the Information Technology Act 2000 give legal recognition to electronic records and electronic signatures, meaning a SaaS agreement validly entered into and signed online is enforceable in the same way as a paper contract, subject to the requirements the Act and its rules set for the signature method used. Where the provider handles sensitive personal data or information (as defined under the IT Rules), the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 require the body corporate to maintain documented reasonable security practices and to notify affected parties in the event of a security breach affecting such data. Data protection under the DPDP Act 2023: where the SaaS product processes personal data belonging to the customer's own end users (employees, customers, or other data principals), the Digital Personal Data Protection Act 2023 becomes relevant. The customer will typically be the Data Fiduciary determining the purpose and means of processing that personal data, while the SaaS provider acts as a Data Processor processing that data on the customer's instructions. The agreement should allocate the parties' respective obligations accordingly — including instructions-based processing, deletion or return of data on termination, and cooperation with the Data Fiduciary's obligations to data principals and to the Data Protection Board of India, as the DPDP Act's rules and enforcement mechanisms come into force. GST treatment: the supply of SaaS is generally treated as a supply of service under India's GST law. Whether a particular transaction attracts Central GST plus State GST (an intra-state supply) or Integrated GST (an inter-state supply, including exports) depends on the place-of-supply rules applicable to the transaction, which in turn depend on the location of the supplier and the recipient and, in some cases, on whether the transaction qualifies as an export of services. Where the customer is located outside India, the transaction may qualify for export-of-service treatment subject to conditions under the IGST Act, including receipt of payment in convertible foreign exchange. Parties should confirm the correct GST treatment and invoicing for their specific arrangement rather than assume a single default. Data localisation and cross-border transfer: depending on the sector and the nature of the data processed (for example, payment data subject to sector-specific localisation requirements, or personal data subject to the DPDP Act's cross-border transfer provisions), the parties may need to address where data is stored and processed, and any restriction on transferring it outside India. Core commercial terms: scope of the software service and permitted use, subscription fees and payment terms, service level commitments (uptime, support response times) and any service credit remedy for failure to meet them, data ownership and processing terms consistent with the DPDP Act framework described above, limitation of liability and indemnity provisions, intellectual property ownership (the provider retaining ownership of the software, the customer retaining ownership of its data), and termination provisions including the customer's right to export its data within a reasonable period after termination. When to use this agreement: whenever an Indian SaaS provider is onboarding a new business customer on a subscription basis, whether the customer is based in India or abroad. Common drafting mistakes: failing to clearly allocate Data Fiduciary and Data Processor roles under the DPDP Act, omitting a data export or deletion commitment on termination, assuming a single GST treatment without checking the place-of-supply analysis for the specific customer, and setting a limitation of liability clause without considering whether it would be enforceable under the reasonableness standards applied by Indian courts to standard-form contracts.