Tag: software as a service

SaaS Agreements – GDPR – The General Data Protection Regulation

The General Data Protection Regulation (GDPR) has now replaced the existing EU Data Protection Directive in an aim to harmonise European data protection law. In the UK the GDPR and the Data Protection Act 2018 (DPA) replaced the Data Protection Act 1998 on the 25th of May 2018. These changes in data protection law will have a significant effect on both SaaS suppliers and SaaS customers who must comply with both the terms of the GDPR and the DPA. Below is a summary of the main provisions of the GDPR that SaaS suppliers and customers need to be aware of.

Brexit

The GDPR will continue to apply in the UK after any future Brexit.

SaaS Agreement Terms

SaaS suppliers and SaaS customers must ensure that all contractual documents that involve data processing, such as SaaS agreements, privacy policies and hosting and support agreements comply with the new rules under the GDPR and the DPA.

Harmonisation

SaaS suppliers and SaaS customers should be aware that the GDPR does not fully harmonise data protection law throughout Europe. Each EU country may introduce their own requirements in certain instances under the various derogations permitted under the GDPR.

New Data Processor Obligations

The GDPR applies to data controllers (SaaS customers) and data processors (SaaS suppliers) and in particular SaaS suppliers should be aware that some GDPR obligations apply directly to data processors who are now subject to compliance obligations and sanctions for non-compliance.

Consent

SaaS suppliers and SaaS customers relying on consent to process personal data will need to show that the consent is:

  • freely given;
  • specific and informed; and
  • an “unambiguous indication” of a data subject’s wishes and expressed either by a statement or a clear affirmative action (i.e. ticking a consent box when visiting a website).

Consent must be purpose limited i.e. related to explicitly specified purposes.

The default age for giving valid consent and using online services is 16, however each EU country will be able to reduce this to 13, if they wish to. The UK has already included this derogation in the DPA.

Penalties

The maximum penalty for a breach of the GDPR will be substantially higher than under current legislation. Fines can be imposed on SaaS suppliers or SaaS customers. Fines of up to 4% of annual global turnover or up to 20m Euros (whichever is higher) can be applied.

Applicable to Non-EU Entities

The GDPR will apply not just to EU SaaS customers and suppliers but also to non-EU SaaS customers and suppliers who:

  • offer goods or services to data subjects in the EU; or
  • monitor the behaviour of EU citizens to the extent that the behaviour takes place in the EU.

Enforcement – One Stop Shop

SaaS suppliers and SaaS customers will be regulated by a single regulator in the place of their main establishment, which shall be their main administrative location in the EU. Data subjects will be able to make complaints to regulators in their own EU country.

Data Protection Officer

An independent data protection officer (“DPO”) must be appointed where an organisation’s core business involves processing personal data involving regular and systematic monitoring of data subjects or large amounts of sensitive personal data. Each EU country may enact national provisions imposing further requirements regarding the appointment of DPOs. This will be particularly relevant in Germany where this is already a legal requirement.

Notification

There is no requirement for a SaaS supplier or SaaS customer to notify local data protection authorities of any data processing activities but there is a requirement to keep records of data processing activities (subject to limited exceptions).

Breach Reporting

SaaS customers and SaaS suppliers must report breaches to the relevant local regulator without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Data subjects must be informed of breaches without undue delay where the breach is likely to result in a high risk to the data subject’s rights and freedoms unless:

  • the data has been rendered unintelligible to any third party (for example by encryption);
  • the data controller has taken steps to ensure the high risk is unlikely to materialise; or
  • it would involve disproportionate effort to inform data subjects individually, in which case a public announcement can be made.

Data processors (SaaS suppliers) are required to inform data controllers (SaaS customers) of any breach without undue delay.

Impact Assessments

SaaS customers will be required to carry out data protection impact assessments (“DPIAs”) if their proposed activities are likely to result in a high risk for the rights and freedoms of individuals, in particular, through the use of new technologies and in cases of profiling.

Data Subject Rights

The following rights shall be granted to data subjects:

  • data portability;
  • the right to be forgotten;
  • the right to prevent profiling;
  • the right to object to processing;
  • the right to rectification and erasure.
  • subject access requests (“SARs”).

SARs must be responded to by the data controller (SaaS customer) without undue delay and, at the latest, within one month of receipt of the request. The data controller only has the right to charge a reasonable fee to cover administrative costs where the requests are “manifestly unfounded or excessive”.

Compliance

Now the GDPR is in force, it is essential that SaaS customers and SaaS suppliers comply with its terms. For example by:

  • Including written data processing agreements in existing SaaS agreements and future SaaS agreements with relevant customers;
  • Ensuring that privacy policies comply with the GDPR rules;
  • Appointing a data protection officer (where appropriate);
  • Using a documentation system for recording data processing activities;
  • Being able to show how and when any consents have been obtained from data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 15 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – GDPR – New German Data Protection Law (BDSG)

The General Data Protection Regulation (GDPR) will replace the existing EU Data Protection Directive and aims to harmonise European data protection law from the 25th of May 2018. In Germany, the Government has already amended the existing German Data Protection Act (BDSG) and from the 25th of May 2018 the New German Data Protection Act (New BDSG) and the GDPR will apply together in Germany.

Compliance with the New BDSG

Both SaaS suppliers and SaaS customers who provide services to German clients or who collect or process personal data of German data subjects on behalf of international SaaS clients, will need to comply with the terms of the New BDSG in addition to the terms of the GDPR. The New BDSG sets out derogations from certain parts of the GDPR and additional obligations. Below is a summary of the main derogations and additional obligations that SaaS suppliers and SaaS customers should be aware of.

Data Protection Officer

In addition to the obligation to appoint a data protection officer in certain circumstances under the GDPR, the New BDSG imposes additional circumstances in which a data protection officer must be appointed:

  • By any business with 10 or more employees permanently processing personal data;
  • Where data controllers are required to carry out privacy impact assessments;
  • Where data controllers process personal data in a commercial context for the purpose of transfer (whether or not the data is anonymised).

Sensitive Data

Sensitive data is referred to in the GDPR as special categories of personal data (Sensitive Data). Sensitive Data is personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or genetic data, biometric data, data concerning health, or data concerning a natural person’s sex life or sexual orientation. The GDPR only allows processing of Sensitive Data where specific exceptions apply. The New BDSG extends the scope of the exceptions.

Employee Data

Employee data protection rules under the New BDSG generally correspond to the existing rules under the BDSG, with some changes. For example: Any collective agreements, (an agreement between a company and its works council) which allows the company to process employee data, must comply with the GDPR obligation to ensure that the employee’s human dignity, legitimate interests, and fundamental rights are properly safeguarded.

Dealing with Derogations

Each of the 28 EU member states are permitted to derogate from some of the provisions of the GDPR. SaaS customers and SaaS suppliers who collect or process personal data from data subjects located in Germany need to be aware of such additional or differing rules in Germany and/or any other EU countries in which they collect or process personal data.

SaaS suppliers and SaaS customers should ensure that their privacy policies and data processing agreements reflect these differences and that data processing activities reflect the obligations set out in such policies and agreements. SaaS customers and SaaS suppliers must also ensure that they comply with other applicable laws which apply to the particular industry in which they operate, as such laws may impose mandatory additional responsibilities in relation to personal data.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreement – FAQs -What is a SLA and Essential Terms to include in a SLA

SLA is the abbreviation for a service level agreement.

Is a SLA a Software Licence

No. A service level agreement (SLA) sets out the SaaS services being provided in addition to the right to use the SaaS software.

What is a SLA

A SLA forms part of a SaaS agreement. The SLA can be contained in a separate schedule to the SaaS agreement, or included in the main terms and conditions of the SaaS agreement. SLAs set out:

How much Detail

It is advisable for a SaaS supplier to provide some degree of detail in the SLA to avoid spending unnecessary time negotiating the addition of further details requested by SaaS customers.

The degree of detail included in the SLA will depend upon:

  • How much a SaaS customer pays for the SaaS software and services;
  • Whether the SaaS software is business critical i.e. online banking;
  • What is standard in that particular business sector.

Terms to Include

SLAs should generally contain the following provisions, where appropriate:

  • Guaranteed availability of the services and software;
  • Timing of and prior notice of maintenance;
  • Description of the security provisions at the hosting centre and the technical infrastructure;
  • Problem response and resolution times;
  • Customer support description and support hours;
  • Provision of service availability reports;
  • Backup of customer data;
  • Security and disaster recovery provisions;
  • Right to terminate for breaches of the SLA.
  • Service credits for breaches of the SLA;

Advantages of having a SLA

If SaaS suppliers do not have their own SLA, customers will often try to impose their own SLA on the supplier which does not “fit” the SaaS services being provided. This can lead to protracted negotiations about the content of the SLA.

Summary

Due to the unique nature of SaaS and in particular the use of SLAs you should seek specialist legal advice on the content of a SLA whether you are a SaaS supplier or a SaaS customer to ensure that your rights are adequately protected.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – FAQs – What is SaaS and Essential Terms to include in a SaaS Agreement

SaaS is the abbreviation for “software as a service”. You may know this under another name, for example subscription agreement, SaaS contract, software on demand, software subscription agreement, cloud computing or ASP services (application service provider). These names all refer to the same thing – hosted software being made available via the Internet to users.

What is a SaaS Agreement

A SaaS agreement is simply the name used for the agreement between a SaaS supplier and a SaaS customer which sets out the terms under which the SaaS software may be accessed. This will usually include a service level agreement (SLA) and a data processing agreement (DPA).

Differences between a SaaS Agreement and a Standard Software Licence

A SaaS agreement differs from a standard software licence in that:

  • The SaaS customer will not receive a physical or installed copy of the software;
  • No ownership in the SaaS software will be transferred to the SaaS customer;
  • The SaaS customer‘s right to use SaaS software will end upon termination of the SaaS contract.

Essential Terms to Include in a SaaS Agreement

The following legal issues should be included in any SaaS agreement, whether you are a SaaS supplier or a SaaS customer.

Software Licence

Access to the SaaS software should be limited to the term of the SaaS agreement. Once the SaaS agreement expires or terminates the software licence should automatically terminate.

If the SaaS customer is a global entity, you should specify:

  • Which companies or entities may access the SaaS software;
  • In which territories the software may be used; and
  • The number of authorised users;
  • Identify the specific purposes for which the SaaS software may be accessed; and
  • Name any third parties who will be permitted access to the SaaS software i.e. outsourcing providers or clients of the SaaS customer.

Intellectual Property Rights – IPR

The SaaS supplier should retain ownership of all IPR in the SaaS software and services it provides. The SaaS customer should retain ownership of all IPR in its systems, content and data. You should specifically state that the source code remains owned by the SaaS supplier. The SaaS customer should grant the SaaS supplier the right to use its IPRs for the term of the SaaS agreement i.e. to display the SaaS customer’s logos and copyrighted information.

Applicable Law, Jurisdiction & Language

A SaaS supplier should specify which law applies to the SaaS agreement and which courts will deal with any disputes arising from it. In international SaaS agreements make sure that you specify in which language the dispute will be dealt with, and if the SaaS agreement is in more than one language, which language prevails if there is a discrepancy between the two versions.

Return of Data

At the end of the SaaS agreement the SaaS customer’s data should be returned and to compy with the GDPR and other data protection laws all personal data must be returned and deleted. The format in which the data is to be returned and any payment for this service should be agreed in advance. Additionally, the parties can agree that the SaaS supplier will provide assistance in transferring SaaS customer data to a new supplier – in return for payment for this data migration service.

Data Processing Agreement (DPA)

The SaaS supplier is the data processor and the SaaS customer is the data controller. Under data protection law different rules apply to the data controller and the data processor. In compliance with the General Data Protection Regulation (GDPR) The SaaS supplier is obliged to process data in accordance with the SaaS customer’s written instructions and should protect itself against claims from third parties that such processing was illegal. Likewise, the SaaS customer will also need to protect itself against claims from third parties caused by the SaaS supplier not processing data in accordance with its instructions or the terms of the data processing agreement.

Both the SaaS supplier and the SaaS customer’s data protections obligations must be set out in a written data processing agreement (DPA) which forms a schedule to the SaaS agreement. In addition where any international transfers of EU, UK or Swiss personal data are made, Standard Contractual Clauses must be used and the SaaS customer and SaaS supplier must carry out Schrems II Data Transfer Assessments. The SaaS supplier must also provide a list of the sub-processors that it uses to provide the SaaS services and a security policy.

Service Level Agreement (SLA)

This sets out the hosting, support and maintenance services being provided to the SaaS customer by the SaaS supplier. The SLA should specify where the data centre is located, who is operating it, what security, backup and disaster recovery procedures are in place. Support hours and support services for dealing with hosting problems and software problems should be identified and documented and the procedure for dealing with upgrades and maintenance to the software should be specified. The particular details will depend on the amount being paid for the hosting, support and maintenance and the purpose for which the SaaS software is being used.

Summary

Due to the unique nature of SaaS agreements you will need to seek specialist legal advice on the content of a SaaS agreement whether you are a SaaS supplier or a SaaS customer to ensure that your rights are adequately protected and that you are fully complying with all applicable laws.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements, GDPR and cloud computing with over 15 years experience in the IT sector. If you require assistance with any SaaS or cloud computing contracts, GDPR or any other IT legal issues please contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – What SaaS Suppliers need to know about the GDPR

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing data protection laws in all 28 EU member states. The GDPR will place direct obligations on SaaS suppliers (data processors) in relation to data processing activities. In addition SaaS customers (data controllers), their clients (data subjects) and local data protection authorities will be able to enforce breaches of the new rules directly against SaaS suppliers.

SaaS suppliers need to amend the provisions of their existing SaaS agreements in order to comply with the upcoming changes in data protection law.

Written Data Processing Agreement

SaaS suppliers will need to include the following minimum terms in a written data processing agreement with all SaaS customers:

  • The duration, nature and purpose of the data processing;
  • The types of data being processed;
  • The obligations and rights of the customer.

The written data processing agreement must state that:

  • Personal data will only be processed in accordance with documented instructions from the SaaS customer;
  • The SaaS supplier will assist the SaaS customer in complying with its own obligations as a data controller;
  • The SaaS supplier is obliged to inform the SaaS customer if it believes an instruction to give personal data to the SaaS customer breaches the GDPR or any other EU or Member State law.

Record Keeping

Unless one of the exceptions applies, the main one being that the SaaS supplier has less than 250 employees, SaaS suppliers must keep records of all categories of processing activities that they carry out.

The following details must be recorded:

  • Information about the SaaS customer and any other data processors;
  • Names of relevant data protection officers (DPOs);
  • The categories of data processing carried out;
  • Any transfers to third countries; and
  • The general technical, organisational and security measures used by the SaaS supplier.

If requested by a supervisory authority, SaaS suppliers must provide such records.

Subcontracting

SaaS suppliers will need to obtain prior written consent to the subcontracting of any data processing activities: for example the using a third party hosting centre such as AWS or Microsoft Azure. Although SaaS suppliers can include a general consent to subcontracting in the provisions of their SaaS agreeents, SaaS suppliers will still be obliged to inform SaaS customers before adding or replacing any sub-processors in order to give customers time to object to a change.

Breach Notification

SaaS suppliers will be required to notify SaaS customers of any breach of their obligations, without undue delay, after becoming aware of the breach.

Data Protection Officers

SaaS suppliers will be obliged to appoint a data protection officer (DPO) in some specific circumstances: for example where the SaaS supplier is processing special data (sensitive data) or if required to do so under a Member State law.

The contact details of any DPO appointed must be published and communicated to the applicable supervisory authority.

Deletion or Return of Data

SaaS suppliers must allow SaaS customers to choose between deletion or return of all personal data on termination or expiry of the SaaS agreement (unless applicable mandatory law requires storage). SaaS customers will be entitled to check compliance with this requirement.

Transfers outside the EEA

Although SaaS suppliers are required to follow a SaaS customer’s instructions with regard to data processing, SaaS suppliers may only transfer personal data outside of the EEA if the SaaS supplier or SaaS customer has provided appropriate safeguards: for example by using of EU model clauses or Binding Corporate Rules (BCRs).

Fines and Compensation

  • Data subjects will be able to take action against SaaS suppliers directly and claim damages for the SaaS supplier’s breach of any obligations under the GDPR; or
  • SaaS suppliers will be potentially liable to both the SaaS customer and data subjects for the same breach.

In addition data protection authorities will be able to fine SaaS suppliers up to 4% of annual global turnover for some breaches.

Preparing for Change

SaaS suppliers need to review the terms of their existing SaaS agreements and their internal procedures to ensure that they comply with the new rules on the use of subcontractors, data security requirements, appointment of DPOs and having in place appropriate organisational and technical measures.

SaaS suppliers should ensure that existing and future agreements with their sub-processors impose the same data processing obligations on all subcontractors, as the SaaS supplier will be liable to the SaaS customer and data subjects for any breaches of the new rules caused by any subcontractors.

SaaS suppliers should ensure that their insurance cover and indemnities and limitations on liability contained in existing SaaS agreements relating to use of personal data are sufficient to cover the higher levels of fines and direct claims for damages by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Reseller Agreements – Price Fixing

SaaS suppliers and SaaS resellers should be aware that price fixing is illegal under UK and EU competition law. Often SaaS resellers are not aware that the terms of their SaaS reseller agreement include price fixing clauses. For example: If the SaaS reseller agreement includes clause on resale price maintenance (RPM). This will usually be deemed to be price fixing by the Competition and Markets Authority (CMA) who investigates breaches of competition law in the UK.

What is Price Fixing

Price fixing occurs when competitors agree (i.e. SaaS suppliers or SaaS resellers) what price they will charge SaaS customers for their SaaS services.

Price fixing occurs between a SaaS supplier and a SaaS reseller where a SaaS supplier tries to control the price at which SaaS services can be resold to SaaS customers for example by using RPMs.

What is RPM

An RPM is when a SaaS supplier controls the resale price of the SaaS services to customers, by agreeing with the SaaS reseller that the SaaS services will be resold at, or above, a particular price. RPM can be achieved directly by including this restriction in the terms of the SaaS reseller agreement.

RPM can also be achieved indirectly:

  • By including terms in the SaaS reseller agreement that restrict discounts on prices; or
  • Where financial incentives are offered to the SaaS reseller, to resell at a particular price.

RPM involves parties at different levels of the supply chain i.e. the SaaS supplier and the SaaS reseller.

Why RPM is Price Fixing

RPM is usually deemed to be “price fixing” and illegal because it prevents SaaS resellers from offering lower prices and setting their own independent prices at which they can resell SaaS services to SaaS customers.

Recent Fines

The CMA recently fined a fridge supplier £2.3 million for imposing a minimum advertised price on goods sold by a reseller because this restricted the price that goods could be advertised online by resellers. The supplier threatened to charge resellers “higher cost prices for its products” or to stop supplying products altogether if its resellers advertised fridges below the minimum price. This amounted to price fixing.

In a similar case involving a bathroom fitting company, the CMA imposed a fine of £786,000 for the use of RPMs. The supplier had threatened to penalise online resellers for not pricing its products at, or above, its recommended prices.

It should be noted that fines can be imposed on SaaS suppliers as well as SaaS resellers for breaches of competition law.

How to Avoid Price Fixing

In order to avoid direct or indirect price fixing and the risk of being fined by the CMA,

SaaS Suppliers should, in the terms of the SaaS reseller agreement:

  • Not dictate the price at which SaaS services can be resold, either online or through other sales channels;
  • Not include provisions that set a minimum advertised price for any sales of SaaS services;
  • Not use threats, financial incentives or take any other action, such as withholding supply or offering less favourable terms, to make SaaS resellers stick to recommended resale prices.

SaaS Reseller should in the terms of the SaaS reseller agreement:

  • Ensure that they are entitled to set the price of the SaaS services they resell to SaaS customers, regardless of whether sales are made online or through other sales channels;
  • Ensure that SaaS suppliers cannot dictate the prices at which a SaaS reseller can advertise their products online.

Consequences of Price Fixing

If a SaaS reseller has agreed with a SaaS supplier to resell SaaS services at fixed or minimum prices, both be could be found to be breaking competition law. In addition to both being fined up to 10% of worldwide turnover the SaaS supplier and SaaS reseller could also be:

  • Sued for damages;
  • Sent to prison for up to 5 years;
  • Disqualified from being a company director for up to 15 years.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience dealing with SaaS, cloud computing matters and IT law issues. If you require assistance with any SaaS agreements, cloud computing matters or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Terms and Conditions – Data Processing Agreement

UK SaaS suppliers currently have limited obligations to SaaS customers when processing personal data as part of their SaaS services. Under the General Data Protection Regulation (GDPR) many new data processing obligations are imposed on SaaS suppliers. In particular, the obligation for SaaS suppliers to enter into a written data processing agreement with SaaS customers and subcontractors.

GDPR applies to UK SaaS Suppliers despite Brexit

Regardless of when and how Brexit takes place, the GDPR will apply to SaaS suppliers located within the UK if:

  • They offer goods or services to SaaS customers located within the EU (i.e. in any of the remaining 27 EU Member States); or
  • They monitor the behaviour of EU data subjects;

Even though UK SaaS suppliers will no longer be located within the EU themselves after a Brexit.

GDPR applies to non-EU SaaS Suppliers

The GDPR automatically applies to all SaaS suppliers located outside of the EU i.e. in the USA, if:

  • They offer goods or services to SaaS customers located within the EU; or
  • They monitor the behaviour of EU data subjects;

Even though the SaaS supplier is not located within the EU.

Written Data Processing Agreement

Under the GDPR SaaS suppliers and SaaS customers must include detailed data processing obligations in a written data processing agreement. This can form part of the SaaS Agreement or be a separate schedule or agreement.

SaaS Suppliers should be aware that they need to enter into written data processing agreements not just with all SaaS customers, but also with all entities or persons who process personal data on their behalf, such as:

  • All subcontractors i.e. data centres, penetration testing providers;
  • All subsidiaries i.e. providing customer support, software maintenance and support.

Fines for Breach

Data subjects can claim damages directly from SaaS suppliers who breach:

  • Any obligations under the GDPR; or
  • Any lawful instructions of a SaaS customer.

In addition data protection authorities can fine SaaS suppliers or SaaS customers up to 4% of annual global turnover or 20m Euros (whichever is higher) for breaches of the GDPR.

Preparing for Change

To ensure compliance with the new obligations placed on SaaS suppliers (data processors) under the GDPR, SaaS suppliers should taking the following steps:

  • Review existing data protection policies and procedures for compliance with the GDPR;
  • Adapt existing privacy, security and data breach policies to comply with the new rules before the 25th of May 2018;
  • Create a written data processing agreement which reflects the above polices and which is compliant with the GDPR;
  • Review existing SaaS agreements to check limitations on liabilities and indemnities for data protection breaches;
  • Identify any subcontractors and subsidiaries who process personal data;
  • Audit compliance of subcontractors and subsidiaries with new policies and procedures; and
  • Add written data processing agreements to all existing agreements with SaaS customers, subcontractors and subsidiaries.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience in dealing with SaaS, cloud computing and IT law issues. If you require assistance with any SaaS agreements, cloud computing concerns or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New obligations for SaaS Customers

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change UK data protection law. The GDPR will place further more onerous obligations on SaaS customers (data controllers) in relation to all data processing. SaaS customers need to amend the terms of their existing SaaS agreements and privacy policies and implement the changes into internal policies and procedures in order to comply with the upcoming changes in UK data protection law.

Data Subject Rights

Data subjects will have more extensive rights to access, rectify and object to the storage and processing of their personal data. New rights to delete, restrict processing, rights in relation to profiling and the right to data portability will be introduced. SaaS customers will also be required to provide a lot more information to data subjects about processing activities than in the past i.e. in their privacy policies.

Fines

Data subjects will be able to take direct action against SaaS customers and claim damages resulting from breaches by SaaS customers of their obligations under the GDPR.

In addition data protection authorities will be able to fine SaaS customers up to 4% of annual global turnover for some breaches.

Preparing for the Changes

SaaS customers should review the terms of their existing SaaS agreements and privacy policies to ensure that they comply with the new rules before the GDPR comes into force.

SaaS customers should ensure that existing and future agreements with any subcontractors (data processors) impose the same data processing obligations on further subcontractors (sub-processors), as the SaaS customer could be liable to the data subject for any breaches of the new rules caused by any subcontractors.

SaaS customers should ensure their insurance cover and the terms of their SaaS agreement with all SaaS suppliers include indemnities and limitations on liability relating to personal data that are sufficient to cover the higher level of fines and claims made directly by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – New Obligations for SaaS Suppliers

From the 25th of May 2018 the EU General Data Protection Regulation (GDPR) will come into force and change existing UK data protection laws. The GDPR will place direct obligations on SaaS suppliers (data processors) in relation to data processing activities. In addition SaaS customers (data controllers) and their clients (data subjects) will be able to enforce breaches of the new rules directly against SaaS suppliers. SaaS suppliers need to amend the terms of their existing SaaS agreements in order to comply with the upcoming changes in data protection law.

Written Data Processing Terms

SaaS suppliers will need to include the following minimum terms in a written data processing agreement with all SaaS customers:

  • The duration, nature and purpose of the data processing;
  • The types of data being processed;
  • The obligations and rights of the SaaS customer.

The written data processing terms must state that:

  • Personal data will only processed in accordance with documented instructions from the SaaS customer;
  • The SaaS supplier will assist the SaaS customer in complying with its own obligations as a data controller;
  • The SaaS supplier is obliged to inform the SaaS customer if it believes an instruction to give personal data to the SaaS customer breaches the GDPR or any other EU or Member State law.

Record Keeping

Unless one of the exceptions applies, the main one being that the SaaS supplier has less than 250 employees, SaaS suppliers must keep records of all categories of processing activities that they carry out.

The following details must be recorded:

  • Information about the SaaS customer and any other data processors;
  • Names of relevant data protection officers (DPOs);
  • The categories of data processing carried out;
  • Any transfers to third countries; and
  • The general technical and organisational security measures used by the SaaS supplier.

If requested by a supervisory authority, SaaS suppliers must provide such records.

Subcontracting

SaaS suppliers will need to obtain prior written consent to the subcontracting of any data processing activities. Although SaaS suppliers can include a general consent to subcontracting in their SaaS agreement, SaaS suppliers will still be obliged to inform SaaS customers before adding or replacing any sub-processors in order to give SaaS customers time to object to a change.

Breach Notification

SaaS suppliers will be required to notify SaaS customers of any breach of their obligations, without undue delay, after becoming aware of the breach.

Data Protection Officers

SaaS suppliers will be obliged to appoint a data protection officer (DPO) in some specific circumstances: for example where the SaaS supplier is processing special data (sensitive data) or if required to do so under a Member State law.

The contact details of any DPO appointed must be published and communicated to the applicable supervisory authority.

Deletion or Return of Data

SaaS suppliers must allow SaaS customers to choose between deletion or return of all personal data on termination or expiry of the SaaS agreement (unless applicable mandatory law requires storage). SaaS customers will be entitled to check compliance with this requirement.

Transfers outside the EEA

Although SaaS suppliers are required to follow a SaaS customer’s instructions with regard to data processing, SaaS suppliers may only transfer personal data outside of the EEA if the SaaS supplier or SaaS customer has provided appropriate safeguards. For example by the use of EU model clauses or Binding Corporate Rules (BCRs).

Fines and Compensation

Data subjects will be able to take action against SaaS suppliers directly and claim damages for the SaaS supplier’s breach of:

  • Any obligations under the GDPR; or
  • Any lawful instructions from the SaaS customer.

SaaS suppliers will be potentially liable to both the SaaS customer and data subjects for the same breach.

In addition data protection authorities will be able to fine SaaS suppliers up to 4% of annual global turnover for some breaches.

Preparing for Changes

SaaS suppliers need to review the terms of their existing SaaS agreements and their internal procedures to ensure that they comply with the new rules on the use of subcontractors, data security requirements, appointment of DPOs and having in place appropriate organisational and technical measures.

SaaS suppliers should ensure that existing and future agreements with their sub-processors impose the same data processing obligations on all subcontractors, as the SaaS supplier will be liable to the SaaS customer and data subjects for any breaches of the new rules caused by any subcontractors.

SaaS suppliers should ensure that their insurance cover and SaaS agreement indemnities and limitations on liability relating to use or personal data are sufficient to cover the higher levels of fines and direct claims for damages by data subjects.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – Data Protection – Cyber Insurance

Currently most SaaS suppliers and SaaS customers do not take out specific cyber insurance and rely upon the provisions of a general insurance policy to cover liabilities in the event of a claim for a cyber incident or a data breach. This is partly due to the fact that few insurers offer adequate cyber insurance policies and SaaS customers and SaaS suppliers often fail to consider the need for a specialist policy of insurance to ensure that they are covered in the event of a claim being denied under a general insurance policy.

General Insurance

Many insurers may not have anticipated providing cover against cyber risks under their general insurance policies and it is likely that disputes will arise as to whether or not a cyber claim is covered when a SaaS supplier or SaaS customer makes a claim. Taking out cyber insurance could reduce this risk.

Professional Indemnity Insurance

Commonly PI insurance covers directors insurance, property risk and some limited cyber cover. However as cyber risks are becoming more common for SaaS suppliers and SaaS customers there is an increasing need to specifically protect against cyber risks i.e. hacking, DNS attacks, phishing etc.

Future Need for Cyber Insurance

Cyber insurance is often seen as too expensive by SaaS suppliers and SaaS customers and they actively chose not to purchase such additional insurance cover.

From the 25th of May 2018, when the new Data Protection Regulation (GDPR) comes into effect there will be a substantial increase in the risk of a cyber claim for a data breach. It is important to be aware that the GDPR applies to all SaaS customers and SaaS suppliers in the EU and any non-EU located SaaS customers and SaaS suppliers offering goods or services in the EU or who monitor the behaviour of EU data subjects. Accordingly the GDPR will apply to UK SaaS customers and SaaS suppliers regardless of if, and when, there is a “Brexit”.

GDPR Fines

The GDPR imposes more onerous obligations on both data processors and data controllers. In particular, the fines which can be applied by any EU data protection authority for breach of the GDPR will increase substantially. Fines of up to €20 million or 4% of global annual turnover for the preceding financial year can be imposed.

Summary

SaaS suppliers and SaaS customers need to consider now the need to increase existing insurance cover to encompass the above changes to data protection law, and when doing so, it could be prudent to consider taking out specialist cyber insurance.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: