SaaS Terms of Service for Indian Customers: A Section-by-Section Guide, DPDP-Ready
A SaaS company selling to Indian customers needs terms that form a valid clickwrap contract, separate the data consent, allocate the DPDP processor role, and survive a dispute. A section-by-section guide for self-serve terms and enterprise agreements, ready for the May 2027 DPDP commencement.
Indian SaaS companies usually launch with terms copied from a US product, then discover at the first enterprise deal or the first dispute that the terms do not form a valid contract under Indian law, bundle a data consent the DPDP Act will not accept, and promise arbitration in a state the customer has never heard of. This guide walks through the sections of a SaaS terms document for India, for both self-serve clickwrap and signed enterprise agreements. Position as of October 2026.
Two documents, one set of positions
- Self-serve terms accepted by clickwrap at sign-up. They must form a contract (affirmative acceptance, terms presented, version recorded) under section 10 of the Indian Contract Act, 1872 and section 10A of the IT Act, 2000.
- Enterprise agreement signed by both parties (Aadhaar eSign or DSC), with an order form, a DPA and an SLA attached.
Keep the commercial and legal positions identical across both so that moving a customer from self-serve to enterprise is an upgrade, not a renegotiation.
Section by section
1. Acceptance and formation. For clickwrap: "By clicking 'I agree' you accept these terms (version X, effective date Y)." Checkbox unticked by default; terms visible or linked; version and timestamp recorded. For enterprise: signature block with place of execution.
2. Account, users and acceptable use. Who may create accounts, user responsibilities, prohibited uses, suspension rights for misuse.
3. Subscription, fees and taxes. Plan, term, renewal (state the auto-renewal mechanics and notice window clearly), fees exclusive of GST, invoicing, late payment. For enterprise, add TDS treatment (section 194J) and the MSE payment cap if the customer is paying an MSE supplier.
4. Data: the three separations.
- Customer data (the customer's content): the customer owns it; the company processes it to provide the service. Under the DPDP Act, 2023, for the customer's users' personal data the customer is typically the Data Fiduciary and the SaaS company the Data Processor, engaged "only under a valid contract" (section 8(2)) with security provisions (rule 6, DPDP Rules, 2025) and breach notification enabling the customer's 72-hour report (rule 7). Put this in a DPA referenced by the terms.
- Account data (the customer's own account holders): the company is the Data Fiduciary; notice under section 5 and consent or legitimate use under sections 6 and 7 apply.
- Consent separation: the acceptance of terms and any consent to processing beyond legitimate uses must be distinct actions; section 6(1) requires consent to be "specific" and given "with a clear affirmative action".
These provisions commence on 13 May 2027; build for them now.
5. Security and hosting. Measures (aligned to rule 6), hosting region (state whether Indian hosting is available; regulated customers may need it under RBI's 2025 outsourcing Directions), sub-processors, incident response (the company is within CERT-In's 2022 Directions: six-hour reporting, 180-day logs).
6. Intellectual property. The company owns the service; the customer owns its data; feedback licence; no reverse engineering.
7. Service levels. Availability target, measurement, exclusions, service credits as sole remedy with a cap, chronic-failure termination.
8. Warranties and disclaimers. Limited warranty of conformity to documentation; disclaimer of implied warranties to the extent permitted.
9. Liability. Cap at fees paid in the preceding 12 months; exclusion of indirect loss; carve-outs for confidentiality, data obligations and IP infringement indemnity. Section 74 of the Contract Act limits any pre-agreed sum to reasonable compensation.
10. Indemnities. Company indemnifies for third-party IP claims; customer indemnifies for misuse and its content.
11. Term, suspension, termination, data return. Termination for breach with cure; for convenience at term end; suspension for non-payment with notice; data export window after termination and erasure thereafter (section 8(7)(b) of the DPDP Act requires the fiduciary to cause the processor to erase).
12. Governing law and disputes. Indian law; arbitration seated in the company's city under the Arbitration and Conciliation Act, 1996 (section 28 of the Contract Act saves arbitration clauses); for consumer users, note that consumer forums retain jurisdiction under the Consumer Protection Act, 2019.
13. Changes to terms. Notice period for changes; continued use after notice as acceptance for self-serve; signed amendment for enterprise.
The clauses to remove from imported templates
- Post-term non-compete on the customer or its staff (void under section 27 of the Contract Act).
- A single checkbox covering terms, privacy policy and marketing consent.
- Governing law of Delaware with Indian customers who cannot practically enforce there.
- "Perpetual, irrevocable licence to customer data" language that no Indian enterprise will sign.
Execution and evidence
For clickwrap, record the terms version, timestamp, account identifier and IP per acceptance; for enterprise, sign with Aadhaar eSign or DSC and keep the audit trail. Both are proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023. Stamp the enterprise agreement where the state schedule charges agreements.
Where Legatio fits. Legatio runs the enterprise side: order forms generated from CRM, the agreement, DPA and SLA executed together with audit trails, renewal windows tracked. Self-serve clickwrap is a product flow; the positions above should match it.
Position stated as of October 2026. General information, not legal advice.