SaaS Agreement (India-Specific Terms)

A SaaS Agreement (-Specific Terms) in India sets out the mutual obligations the parties accept and the terms that govern their dealings.

The Information Technology Act 2000 (IT Act) is the foundational statute for electronic contracts and data liability in India. Section 43A of the IT Act (as applicable alongside the DPDP Act) imposes liability on companies possessing, dealing with, or handling sensitive personal data or information in a computer resource who negligently implement and maintain reasonable security practices, causing wrongful loss or gain. The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 prescribed under Section 43A define sensitive personal data to include passwords, financial information, health information, biometrics, and sexual orientation — information that SaaS platforms commonly process.

The Digital Personal Data Protection Act 2023, which received Presidential assent on 11 August 2023, introduces the roles of Data Fiduciary and Data Processor into Indian law for the first time in statutory form. A SaaS customer who directs the processing of personal data is the Data Fiduciary; the SaaS vendor processing on the customer's instructions is the Data Processor. Section 8 of the DPDP Act requires Data Processors to process personal data only according to the Data Fiduciary's instructions, maintain security safeguards, and report data breaches to the Data Protection Board of India (DPBI). Penalties under the DPDP Act reach ₹250 crore for security failures — far exceeding any comparable GDPR-era risk for Indian businesses.

GST at 18% applies to SaaS subscription payments under SAC Code 998313 (computer programming, consultancy, and related services) or 998314 (IT infrastructure services), making India-specific SaaS agreements distinct from international SaaS contracts. The customer (if GST-registered) can claim input tax credit (ITC) on the GST paid on SaaS subscriptions under Section 16 of the CGST Act 2017, making the effective cost of SaaS significantly lower for businesses with taxable output. Non-business customers and exempt-sector customers (hospitals, educational institutions) cannot claim ITC.

Tax Deducted at Source (TDS) under Section 194J of the Income Tax Act 1961 is a compliance requirement unique to Indian SaaS contracts. When an Indian customer pays a SaaS subscription to an Indian vendor, TDS at 2% (for technical services) must be deducted before remitting payment. The customer files Form 26Q quarterly and issues Form 16A to the vendor. For payments to foreign SaaS vendors, Section 195 TDS at applicable rates (or reduced DTAA rates) applies on the royalty or technical service fee component.

Dispute resolution in India-specific SaaS agreements commonly provides for arbitration under the Arbitration and Conciliation Act 1996, with a seat at a major Indian commercial centre (Mumbai, Delhi, Bengaluru, Hyderabad). The Act, as amended by the Arbitration and Conciliation (Amendment) Act 2021, permits virtual hearings and online submission of pleadings, making it particularly suitable for technology disputes between parties in different cities.

A SaaS Agreement with India-Specific Terms is required whenever an Indian business subscribes to cloud-delivered software, or when a SaaS vendor (Indian or foreign) contracts with Indian enterprise customers and needs to address the specific tax, data protection, and regulatory obligations that apply in India.

Indian businesses purchasing SaaS from domestic vendors must use an India-specific agreement to address TDS deduction obligations under Section 194J of the Income Tax Act 1961. Without an explicit TDS clause, disputes arise over whether the customer deducted TDS, at what rate, and whether the vendor's invoice correctly excludes GST from the TDS base. The agreement eliminates these operational disputes.

Organisations in regulated sectors — banking (regulated by the Reserve Bank of India), insurance (Insurance Regulatory and Development Authority of India, IRDAI), capital markets (Securities and Exchange Board of India, SEBI), and healthcare — require India-specific SaaS agreements that address sector-specific data localisation requirements. The RBI's payment data storage circular (2018) mandates storage of payment system data exclusively in India; SEBI's Cloud Adoption Framework (2023) requires classified data residency in India. Generic international SaaS agreements do not address these obligations.

Any SaaS deployment processing personal data of Indian residents after the DPDP Act 2023 rules are operationalised requires a contract that allocates the roles of Data Fiduciary and Data Processor, establishes security standards, addresses the 72-hour breach notification obligation to the Data Protection Board of India, and includes data deletion requirements on contract termination.

Foreign SaaS vendors entering Indian enterprise contracts need India-specific agreements to address withholding tax obligations under Section 195 of the Income Tax Act — specifically whether the subscription fee constitutes 'royalty' under Section 9(1)(vi) or 'fees for technical services' under Section 9(1)(vii), and at what treaty rate TDS applies under the applicable Double Taxation Avoidance Agreement (DTAA) between India and the vendor's country.

Startups and technology companies processing sensitive personal data of employees, customers, or users — including health platforms processing medical records, fintech platforms processing financial information, and HR platforms processing biometric data — need India-specific data processing agreements embedded within or attached to their SaaS contracts to comply with the IT (SPDI) Rules 2011 and the emerging DPDP Act framework.

An India-specific SaaS Agreement governed by the Indian Contract Act 1872 and the IT Act 2000 must contain several provisions beyond a standard international SaaS contract to address the unique regulatory obligations applicable in India.

Service description and access rights define the specific software modules, features, and platforms being subscribed to, the number of authorised users or user licences, the subscription tier, and the access method (web browser, API, mobile application). The agreement must specify whether the SaaS includes data storage and, if so, where data is stored — critical for regulatory compliance by banking, insurance, and SEBI-regulated entity customers.

GST and invoicing clauses specify the applicable GST rate (18% for most SaaS under SAC 998313), whether the quoted subscription fee is inclusive or exclusive of GST, the vendor's GSTIN (GST Identification Number), the invoicing frequency, and the format of GST-compliant tax invoices. GST invoices must include the vendor's GSTIN, HSN/SAC code, GST amount, and the place of supply — essential for the customer to claim input tax credit under Section 16 of the CGST Act 2017.

TDS clause establishes the parties' respective obligations regarding Tax Deducted at Source. The clause must specify: the applicable TDS section (Section 194J for domestic payments; Section 195 for foreign vendor payments); the TDS rate (2% for technical services under 194J); that the customer will deduct TDS on the subscription fee excluding GST; the customer's obligation to deposit TDS by the 7th of the following month; the customer's obligation to file Form 26Q quarterly; and the vendor's obligation to issue Form 16A to the customer within 15 days of the quarterly filing due date. For foreign vendors, the clause should specify the applicable DTAA rate and the requirement for a Tax Residency Certificate.

Data protection and DPDP Act clause allocates the roles of Data Fiduciary (customer) and Data Processor (vendor) under the Digital Personal Data Protection Act 2023. The clause must: require the vendor to process personal data only on the customer's documented instructions; mandate implementation of security safeguards as prescribed under Section 8 of the DPDP Act; specify the 72-hour breach notification obligation to the Data Protection Board of India; require the vendor to assist the customer in responding to Data Principal rights requests (access, correction, erasure under Sections 11–13); and obligate the vendor to delete or return all personal data on contract termination.

Data residency and localisation clause addresses sector-specific obligations for regulated-sector customers. The clause should specify whether the vendor's infrastructure is located in India (region/availability zone name) or abroad, and include the vendor's obligation to comply with any data localisation requirements notified under the DPDP Act or by the RBI, IRDAI, or SEBI that apply to the customer's sector during the contract term.

Service Level Agreement (SLA) and credits define uptime commitments (typically 99.9% monthly), measurement methodology (IST timezone), incident severity classification, response and resolution time targets, and the service credit formula for SLA breaches — typically expressed as a percentage of monthly fees, escalating with the severity of the breach. Section 74 of the Indian Contract Act 1872 makes pre-agreed service credit clauses enforceable as liquidated damages.

Arbitration and governing law clause specifies Indian law as the governing law, designates the seat of arbitration (typically Mumbai, Delhi, or Bengaluru) under the Arbitration and Conciliation Act 1996, specifies the number of arbitrators (sole arbitrator for smaller disputes, three-member tribunal for higher-value disputes), and specifies the arbitration institution (DIAC, MCIA, or ad hoc under the Act). The MSME Facilitation Council has jurisdiction over SaaS payment disputes where the vendor is an MSME registered under the MSMED Act 2006. The forms-legal.com SaaS Agreement (India-Specific Terms) template covers the mandatory elements under Indian Contract Act, 1872.