Tech Contracts for Indian SaaS and IT Services Companies: MSA, SOW, SLA and DPA Explained

Technology deals are documented in layers. The master services agreement sets the relationship, statements of work define each project, the service level agreement defines performance, and the data processing agreement governs personal data. Indian technology companies on the sell side often inherit US-style templates from investors or customers; on the buy side they sign vendor paper without a DPA at all. This guide explains what each document is for, what to put in it, and the Indian points that imported templates miss. Position as of October 2026.

The Master Services Agreement (MSA)

The MSA is the umbrella: parties, term, how SOWs are issued, payment mechanics, IP, confidentiality, liability, termination and law. Sign it once; issue SOWs under it.

Indian points:

• IP ownership and licence. State clearly whether deliverables are assigned to the customer or licensed. Under Indian copyright law an assignment must be in writing; an "all work product belongs to customer" sentence without an assignment clause is weaker than it looks. Pre-existing IP and tools should be carved out and licensed.
• Limitation of liability. Cap at a multiple of fees with carve-outs for confidentiality, IP infringement and data protection obligations. Under section 74 of the Indian Contract Act, 1872 a named sum is recoverable only as reasonable compensation up to that amount, which cuts both ways.
• Non-compete and non-solicit. A post-term non-compete against an Indian company is generally void under section 27 of the Contract Act; the Supreme Court in Percept D'Mark v. Zaheer Khan (2006) stated that a restrictive covenant extending beyond the contract term "is void and not enforceable". Keep to confidentiality and narrow non-solicit.
• Withholding tax on cross-border payments. For payments to a non-resident software supplier, the Supreme Court in Engineering Analysis Centre of Excellence Pvt. Ltd. v. CIT (2 March 2021) held that payments by Indian end-users and distributors for the use of shrink-wrapped or downloaded software were not "royalty" under the applicable tax treaties and did not attract withholding under section 195. For domestic services, withholding under the Income-tax Act (commonly section 194J for professional or technical services) applies at the prevailing rates and thresholds; build a gross-up or net-of-tax clause and confirm current rates with your tax adviser.
• Export of services and GST. Services supplied to a recipient outside India, with payment in convertible foreign exchange, may qualify as a zero-rated export of services under the IGST Act, 2017; the conditions are specific (location of recipient, place of supply, currency, non-establishment of distinct person), so the MSA should state the customer's location and billing entity accurately.

The Statement of Work (SOW)

The SOW is where scope creep is born. Each SOW should state: deliverables, acceptance criteria and the acceptance window, milestones, fees and invoicing triggers, assumptions, dependencies on the customer, change-control procedure, and named contacts. If the SOW and MSA conflict, say which wins; usually the MSA on legal terms and the SOW on commercial terms.

The Service Level Agreement (SLA)

An SLA converts "good service" into numbers: availability (99.9% monthly), response and resolution times by severity, measurement method, exclusions (planned maintenance, customer-caused issues, force majeure), and the remedy. Two drafting points:

• Service credits as sole remedy. State whether credits are the exclusive remedy for SLA misses, and cap them (10-15% of monthly fees is common). Without a cap, credits can exceed the fee.
• Termination trigger. A chronic-failure clause (three misses in six months) gives the customer an exit without proving damages.

Track SLA performance as dated obligations; a credit nobody claims or applies is a leak on one side and an unrecorded liability on the other.

The Data Processing Agreement (DPA)

If the vendor handles personal data of the customer's users, employees or clients, a DPA is required, not optional.

• Statutory basis. Section 8(2) of the DPDP Act, 2023 allows a Data Fiduciary to engage a Data Processor "only under a valid contract". Section 8(5) keeps the fiduciary responsible for safeguards on the processor's processing, and section 8(7)(b) requires the fiduciary to cause the processor to erase data when the purpose ends or consent is withdrawn.
• Rules. Rule 6 of the DPDP Rules, 2025 lists minimum safeguards (encryption or masking, access control, logs and monitoring, backups, one-year log retention) and requires "appropriate provision in the contract" with the processor. Rule 7 requires the fiduciary to report a breach to the Data Protection Board without delay and in detail within 72 hours, so the DPA must oblige the processor to notify the fiduciary fast enough to meet that.
• Timing. These obligations commence on 13 May 2027 under rule 1(4) of the Rules. A DPA signed now should already meet them.
• Cross-border. Rule 15 permits transfer outside India subject to requirements the Central Government may specify by order; for regulated customers (banks, NBFCs), RBI's 2025 outsourcing Directions separately require storage of data only in India where applicable. The DPA should state where data is hosted.

DPA checklist: purpose and instructions; categories of data; security measures aligned to rule 6; sub-processor approval; breach notification within a fixed number of hours; assistance with data principal rights; erasure and return at end; audit rights; hosting location.

Execution and management

All four documents can be signed electronically under sections 5 and 10A of the IT Act, 2000. An MSA or SOW may be a chargeable instrument under the relevant state stamp law; stamp before or at execution (section 17, Indian Stamp Act, 1899). Store the MSA, every SOW, SLA reports and the DPA against the same customer record so renewal, credits and data obligations are tracked together.

Where Legatio fits. Legatio provides templates for the four documents, routes SOWs for approval under their MSA, executes them electronically and tracks SLA and DPA obligations as dated events. The clauses above are yours to set.

Position stated as of October 2026. General information; tax positions depend on treaty and facts and should be confirmed with an adviser.