SaaS Agreements – Data Protection – BYOD

Employees are increasingly using their privately owned devices (i.e. Ipads, tablets, mobile phones and laptops) for business purposes and may be accessing SaaS customer data using them. SaaS suppliers who allow staff to use such “bring your own devices” (BYOD) for work purposes should be aware of their duties to protect any SaaS customer personal data being accessed by staff using such BYODs.

Continue reading

SaaS Agreements – Terms and Conditions – Risk Assessment

SaaS customers often complain that the security provisions in SaaS agreements are inadequate and lack transparency. Following a risk assessment, often using external auditors and regulators, SaaS customers often ask SaaS suppliers to add numerous additional terms and warranties to their SaaS terms. By including the security provisions set out below in your standard SaaS agreement, SaaS suppliers can avoid having more rigorous provisions imposed upon them.

Continue reading

SaaS Agreements – Legal Requirements – Online SaaS Sales

SaaS suppliers making online sales of SaaS services to business customers in the UK need to ensure that they have the necessary legal documents and information available on their website to comply with English law. Simply having a SaaS agreement online will not cover all legal obligations in the UK when providing SaaS services online. Below is a summary of the documents and information that you should have available on a UK website.

Continue reading

SaaS Agreements – Terms and Conditions – Safe Harbor Adequacy

European data protection authorities have recently raised serious reservations about the effectiveness of the safe harbour scheme and its ability to adequately protect SaaS customer data to the same standard as European data protection laws. If you are a SaaS supplier and are considering/or are already using a company located in the US to provide part of your SaaS services i.e. for hosting, you should be aware of the existence and limitations of the safe harbor scheme.

Continue reading

SaaS Agreements – SLAs – Business Continuity and Escrow Agents

SaaS customers are increasingly asking for disaster recover provisions to be included within the terms of a SaaS agreement to ensure that they have access to their data and continuity of service if a problem arises at the SaaS supplier’s data centre. The costs of providing disaster recovery used to be prohibitive, due to the requirement of having mirrored servers and transferring data, however there is now a new market opening up with former escrow providers offering a variety of disaster recovery options at affordable prices.

Continue reading

SaaS Agreements – Data Protection – Update on the EU Draft Data Protection Regulation

SaaS suppliers should be aware of the recent changes made by the EU Parliament to the draft EU Data Protection Regulation (Regulation). If this amended version of the Regulation becomes law next year the obligations of SaaS suppliers who process personal data on behalf of customers will radically change. A summary of the current main proposed provisions is set out below.

Continue reading

SaaS Agreements – Hosting – Encryption of Stored Data

Under the Data Protection Act (DPA), SaaS customers are required to take “appropriate technical and organisational measures” to prevent the unauthorised or unlawful processing of personal data and accidental loss or destruction of, or damage to, personal data. SaaS providers who process personal data on behalf of SaaS customers are required to include such obligations in their SaaS agreement (or SLA).

Continue reading

SaaS Agreements – Terms & Conditions – Insolvency and ERRA

From April 2014 the UK government plans to change the Insolvency Act under the provisions of the Enterprise and Regulatory Reform Act 2013 (ERRA). This will make the SaaS supplier’s right to terminate or alter the terms of an existing SaaS agreement if a SaaS customer becomes insolvent. From this data no SaaS agreement may be terminated or have the pricing and payment terms changed due to a customer’s insolvency. Furthermore the SaaS supplier must continue to provide SaaS services without receiving any payment or having any right to arrears.

Continue reading