SaaS Subscription Agreement (Nigeria)

A SaaS Subscription Agreement in Nigeria sets out the rights, duties and consideration binding the parties to it.

The Nigeria Data Protection Act 2023, signed into law on 14 June 2023, is the principal data protection statute in Nigeria and was enacted to harmonise Nigeria's data protection framework with the principles of the General Data Protection Regulation (GDPR) of the European Union and international standard practices. The NDPA 2023 established the Nigeria Data Protection Commission (NDPC) as the independent regulatory authority responsible for enforcement, licensing of Data Protection Compliance Organisations (DPCOs), and issuance of guidance. A SaaS provider who processes personal data of Nigerian subscribers on behalf of a customer (acting as a data processor) is subject to the NDPA 2023's Data Processing Agreement (DPA) requirements under Section 43 of the NDPA 2023.

The Federal Competition and Consumer Protection Commission (FCCPC), established under the Federal Competition and Consumer Protection Act (FCCPA) 2018, regulates unfair commercial practices in SaaS transactions, including misleading advertising, unfair subscription terms, and obstacles to cancellation. SaaS agreements in Nigeria must also comply with the Electronic Transactions Act 2011 (applicable in some states) and the National Information Technology Development Agency (NITDA) framework for technology service providers.

Nigerian courts have begun to engage with SaaS and cloud computing disputes, particularly in Lagos, where the Technology and Intellectual Property Division of the Lagos State High Court has developed jurisprudence on software licensing, data breach liability, and service level agreement enforcement.

The legal framework governing the SaaS Subscription Agreement (Nigeria) in Nigeria draws on several key statutes and regulatory bodies. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Parties executing a SaaS Subscription Agreement (Nigeria) in Nigeria should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies and Allied Matters Act (CAMA) 2020 sets the foundational requirements.

A SaaS Subscription Agreement in Nigeria is required whenever a technology vendor provides cloud-based software access to a Nigerian business or consumer.

A SaaS Subscription Agreement is needed when a Nigerian fintech company (such as Paystack, Flutterwave, or Kuda Bank) offers its payment processing or banking software as a service to merchant subscribers. The agreement governs access rights, API usage, data sharing between processor and subscriber, and liability for transaction errors under the Central Bank of Nigeria (CBN) Regulatory Framework for Electronic Payment Systems in Nigeria.

A SaaS Subscription Agreement is required when an enterprise resource planning (ERP) vendor — such as SAP Nigeria, Oracle Nigeria, or a local software company — provides cloud-hosted ERP software to a Nigerian manufacturing, retail, or service company. The agreement defines the service scope, uptime guarantees expressed as a Service Level Agreement (SLA), support response times, and data backup obligations.

A SaaS Subscription Agreement is needed when a healthtech startup provides a hospital management system or electronic health records (EHR) platform to Nigerian healthcare providers. The agreement must comply with the NDPA 2023 data processing requirements and the Nigerian Medical Council and Health Records Officers' professional guidelines on health data.

A SaaS Subscription Agreement is required when a foreign SaaS vendor (headquartered outside Nigeria) provides software to Nigerian corporate subscribers. Under the NDPA 2023, Section 43, cross-border data transfers to countries that do not have adequate data protection must be governed by standard contractual clauses or binding corporate rules approved by the Nigeria Data Protection Commission (NDPC).

A SaaS Subscription Agreement is needed when a government ministry, department, or agency (MDA) procures cloud software under the Public Procurement Act 2007 framework and the Federal Ministry of Communications, Innovation and Digital Economy's cloud computing policy.

Parties in Nigeria should prepare a SaaS Subscription Agreement (Nigeria) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid Nigeria SaaS Subscription Agreement must contain the following essential elements.

Parties: Full legal names, registered addresses, and CAMA 2020 RC numbers of the service provider and subscriber. For foreign providers, include the country of incorporation and any Nigerian subsidiary or representative entity registration details.

Subscription and License Grant: A clear description of the software, the scope of access (number of users, modules, data storage limits), and the nature of the license — a non-exclusive, non-transferable right to access and use the software via the internet. Specify whether source code access is included or whether the software is provided on a hosted (black box) basis.

Subscription Fees and Payment: The monthly or annual subscription fee in NGN (or foreign currency with a mechanism for exchange rate adjustments), due dates, payment method, late payment interest (typically the CBN Monetary Policy Rate plus a margin), and the vendor's right to suspend access for non-payment after a cure period.

Service Level Agreement (SLA): Uptime guarantee (typically 99.5% or 99.9% for enterprise SaaS), response times for critical vs. Non-critical incidents, planned maintenance windows, and service credit or refund mechanism for SLA breaches.

Data Processing and NDPA 2023 Compliance: Where the vendor processes personal data on the subscriber's behalf, a Data Processing Agreement (DPA) under Section 43 of the Nigeria Data Protection Act 2023 must be included or attached. The DPA must address processing purpose, data categories, retention periods, sub-processor obligations, security measures, and breach notification obligations.

Intellectual Property: Confirmation that the vendor retains all intellectual property rights in the software, and that the subscriber's data remains the subscriber's property. Include obligations on the vendor to return or delete subscriber data on termination.

Confidentiality: Reciprocal confidentiality obligations covering the vendor's technical information and the subscriber's business data.

Security: The vendor's obligations to maintain appropriate technical and organisational security measures under Section 39 of the NDPA 2023, including encryption, access controls, and annual security audits.

Termination: Grounds for termination by either party (material breach, insolvency, convenience with notice), notice periods, and post-termination data retrieval obligations — typically 30 days for the subscriber to download data before the vendor deletes it.

Limitation of Liability: Cap on the vendor's liability (typically subscription fees paid in the preceding 12 months) and exclusion of consequential losses. Subject to mandatory Nigerian consumer protection provisions under the FCCPA 2018.

Additional compliance elements for a SaaS Subscription Agreement (Nigeria) used in Nigeria include: Under Nigerian law, the Companies and Allied Matters Act 2020 (CAMA) regulates corporate entities through the Corporate Affairs Commission (CAC). The Labour Act (Cap L1 LFN 2004) and the National Industrial Court of Nigeria (NICN) govern employment disputes. The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Commission (NDPC) protect personal data. The Federal Inland Revenue Service (FIRS) administers tax obligations under the Companies Income Tax Act. The Federal High Court and state High Courts have jurisdiction over civil matters. Forms-legal.com provides this template as a starting point for Nigeria-compliant documentation.