SaaS Agreements – Data Protection – IT Security Requirements

In January 2013 Sony was fined 250,000 GBP for failing to take “appropriate technical measures” to protect the security of personal data stored on its PlayStation Network (PSN) in breach of the Data Protection Act (DPA). In light of the lack of guidance currently provided by the Information Commissioner’s Office (ICO) on data protection security SaaS suppliers should be aware that the ICO plans to draw up new guidelines.

Appropriate Technical and Organisational Measures

Under the DPA, SaaS suppliers must take appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and accidental loss, destruction or damage to personal data. However there is currently no legal definition, or guidance from the ICO, on what are “appropriate” organisational and technical measures.

In the past the ICO has stated that personal data should be encrypted, if loss or theft of the data would cause damage or distress to the individuals concerned. More recently in the case of Sony, the ICO found that Sony’s software was not up to date and that passwords were not secure.

However, in light of the lack of any specific guidance on this matter, the ICO seems to determine fines based on the facts of each individual case.

Factors to Consider

Often the following factors are taken into consideration by the ICO:

  • the financial resources of a SaaS supplier;
  • the number of individuals whose data is affected;
  • the harm actually caused to those individuals;
  • how a SaaS supplier responds to a breach;
  • what technology the SaaS supplier uses; and
  • any mitigating factors, such as voluntarily reporting of a breach.

How to Avoid Fines

Regardless of what any future guidelines might say, SaaS suppliers should already have in place their own technical and organisational measures. Not only to avoid the risk of incurring a substantial ICO fine, but moreover to prevent substantial damage to their reputation and financial losses which could result from the publication of internal security system failures and vulnerabilities following an ICO investigation. Sony gave this as one of the reasons why they dropped their appeal against the ICO fine.

Measures to be Taken

Such technical and organisational measures should include:

  • cryptographic controls to protect passwords;
  • ensuring that sub-contractors provide sufficient technical and organisational guarantees in writing;
  • carrying out regular security risk assessments;
  • auditing the compliance of sub-contractors with their contractual obligations.


The ICO is increasingly taking action against companies and imposing large fines for breaches of the DPA. In August penalty notices were issued against the Bank of Scotland, Aberdeen City Council and Islington Borough Council. Statistics on the type of companies being targeted, the nature of breaches occurring and levels of fine are published quarterly on the ICO website and SaaS suppliers should review these to see if they are operating in a particular “risky” area.


Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

To register for my newsletter click here


Other related articles: