Currently most SaaS suppliers and SaaS customers do not take put specific cyber insurance and rely upon the provisions of a general insurance policy to cover liabilities in the event of a claim for a cyber incident or a data breach. This is partly due to the fact that few insurers offer adequate cyber insurance policies and SaaS customer and SaaS supplier’s failure to consider the need for a specialist policy of insurance, to ensure that they are covered in the event of a claim being denied under a general insurance policy.
Continue readingYear: 2016
SaaS Agreements – Data Protection – Privacy Shield Update
Similar to the rules under the Safe Harbor scheme, SaaS customer and SaaS suppliers need to self-certify their compliance with the principles of the Privacy Shield. The following are the core principles which must be adhered to.
Core Principles
Notice must be given to data subjects about specific issues;
Choice to opt out of disclosure of data to third parties;
Accountability for onward transfer to third parties;
SaaS Agreements – Data Protection – Microsoft Irish Data Centre Decision
Many SaaS customers are concerned whne using data centres which are owned by a US parent company i.e. Microsoft or Amazon, that even if their SaaS data is stored in a data centre located in the EU it will not be protected against disclosure to US authorities. The recent US court of appeal ruling won by Microsoft has confirmed the position, namely that SaaS suppliers and SaaS customers who use data centres located in the EU, owned by US companies, can prevent US authorities from accessing their data in some circumstances.
Continue readingSaaS Agreements – Data Protection – Privacy Shield Approved
EU data protection law prohibits SaaS suppliers and SaaS customers from transferring personal data to countries or territories outside the EEA unless they are considered to provide adequate protection. Below is a summary of the current position following the recent announcement that the EU-US Privacy Shield has been adopted by the EU Commission and will now replace Safe Harbor.
Continue readingSaaS Agreements – FAQs – Disaster Recovery
Do SaaS suppliers need to included disaster recovery provisions in a SaaS agreement? If so, what provisions should be included and where.
Continue readingSaaS Agreements – Terms and Conditions – Limitation Clauses
SaaS suppliers should always include limitation clauses in their SaaS terms and conditions to attempt to limit or exclude liability for certain types of losses and to cap their financial liability for breaches of contract. However, in order for limitation clauses to be valid, SaaS suppliers must ensure that the wording of the limitation clause is clear and unambiguous, otherwise the whole clause could be ruled void by a court and the SaaS supplier’s liability will then be unlimited.
Continue readingSaaS Agreements – FAQs – Reseller Agreements
SaaS suppliers who decide to use a local partner to resell their SaaS software to customers outside of the countries in which they are based, will need to have a reseller/distributor agreement in place between themselves and each SaaS reseller/distributor. What is a SaaS Reseller/Distributor? A SaaS reseller is the
Continue readingSaaS Agreements – FAQs – EU Standard Contractual Clauses
EU model clauses are standard data processing agreements that have been approved by the EU Commission as providing adequate protection. There are currently two sets of standard contractual clauses for transfers of personal data between data controllers and one set for transfers between a data controller and a data processor. EU model clauses must be used unamended (other than where specific details may be added, as set out in the notes to the clauses).
Where personal data is transferred from:
a data controller in the EU (SaaS customer) to a data processor outside of the EEA (SaaS supplier); or
a SaaS supplier within the EU to a sub-processor located outside of the EEA;
the SaaS supplier will need to enter into EU model clauses with the SaaS customer or SaaS sub-processor, as applicable.
Continue readingSaaS Agreements – Data Protection – General Data Protection Regulation (GDPR)
At the end of 2015 the European Commission published the test of the new Data Protection Regulation (“GDPR”) which will replace the existing EU Data Protection Directive and harmonise European data protection law. The GDPR is expected to be adopted in Spring 2016. Once adopted, the GDPR will come into force within 2 years and in the UK the GDPR will replace the Data Protection Act 1998. This will have a significant effect on both SaaS suppliers and SaaS customers.
Continue readingSaaS Agreements – Data Protection – EU US Privacy Shield
A new privacy agreement called the Privacy Shield has been agreed by the US and EU to replace the safe harbour scheme. The Privacy Shield is based upon safe harbour but has additional protections, particularly with regard to public authority access to personal data. The Privacy Shield must now be reviewed by the European Commission before it can be relied upon and adopted by SaaS suppliers or customers. The European Commission is currently assessing whether or not the Privacy Shield provides adequate protection in accordance with EU data protection laws. This process is expected to take up to 3 months.
Continue reading