SaaS Agreement (Australia)

A SaaS Agreement in Australia is a legally binding written instrument.

Australian SaaS agreements must comply with a distinct set of legal requirements that differ materially from US or UK templates. The key statutes are the Australian Consumer Law (ACL) — Schedule 2 to the Competition and Consumer Act 2010 (Cth), enforced by the Australian Competition and Consumer Commission (ACCC) — the Privacy Act 1988 (Cth), the Spam Act 2003 (Cth), and the A New Tax System (Goods and Services Tax) Act 1999 (Cth).

The ACL's unfair contract terms (UCT) regime under Sections 23 to 28 is one of the most significant considerations for SaaS providers. Since 9 November 2023, under the Treasury Laws Amendment (More Competition, Better Prices) Act 2022 (Cth), unfair terms in standard form contracts with consumers and small businesses are void and their use attracts civil penalties of up to $50 million for corporations (or three times the benefit, or 30% of adjusted turnover, whichever is greatest). A SaaS agreement is a standard form contract if one party has not had a genuine opportunity to negotiate the terms. Under Section 23(3A) of the ACL, a small business is defined as having fewer than 100 employees or annual turnover below $10 million. Terms commonly challenged under the UCT regime include broad unilateral variation rights, automatic renewal clauses with short cancellation windows, and asymmetric termination rights.

Privacy obligations arise under the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs) for APP entities — broadly, organisations with annual turnover above $3 million and certain categories of entity regardless of turnover. APP 11 requires reasonable security safeguards for personal information. APP 8 imposes obligations before disclosing personal information to overseas recipients, including cloud infrastructure providers. APP 1 requires a current, publicly available privacy policy. Under Section 13G of the Privacy Act 1988 (Cth), serious or repeated interference with the privacy of individuals can attract civil penalties of up to $50 million. The Office of the Australian Information Commissioner (OAIC) enforces the Privacy Act and can investigate complaints, conduct audits, and seek civil penalty orders for serious or repeated contraventions. The Spam Act 2003 (Cth) requires SaaS providers to obtain consent before sending commercial electronic messages and to provide functional unsubscribe mechanisms. The Australian Communications and Media Authority (ACMA) enforces the Spam Act 2003 and can impose infringement notices and civil penalties for non-compliance. The forms-legal.com SaaS Agreement (Australia) template addresses all material ACL, Privacy Act, and Spam Act obligations within a commercially practical framework.

Any Australian business offering cloud-based software on a subscription basis needs a compliant SaaS agreement before onboarding its first subscriber. The agreement governs every customer relationship for the life of the platform and failure to have one in place exposes the provider to uncapped liability, privacy law penalties, and unenforceable payment terms.

The agreement is immediately needed when the SaaS platform collects, stores, or processes personal information about end users or customers. In that case, the provider becomes an APP entity with obligations under the Privacy Act 1988 (Cth), and the agreement must address customer data ownership, APP 11 security obligations, APP 8 cross-border disclosure controls, and what happens to data on termination. Where the provider uses offshore cloud infrastructure — such as Amazon Web Services, Microsoft Azure, or Google Cloud — APP 8 requires taking reasonable steps to ensure the overseas recipient handles the information in accordance with the APPs.

A SaaS agreement is critical when the provider sends marketing emails or in-app promotional messages to subscribers. The Spam Act 2003 (Cth) prohibits unsolicited commercial electronic messages with an Australian link unless the recipient has given express or inferred consent. Penalties for serious contraventions can reach approximately $2 million per day for corporations. The agreement should confirm that the provider's communications comply with the Spam Act 2003, that consent has been obtained where required, and that a functional unsubscribe mechanism is maintained.

Where the customer base includes consumers or small businesses (fewer than 100 employees or annual turnover below $10 million under s 23(3A) of the ACL), the UCT regime applies. The provider must audit its standard terms — particularly limitation of liability clauses, auto-renewal provisions, unilateral price increase rights, and data deletion policies — to confirm they do not create a significant imbalance in the parties' rights that is not reasonably necessary to protect the provider's legitimate interests.

SaaS providers operating in regulated sectors — including financial services licensees regulated by the Australian Securities and Investments Commission (ASIC) under the Corporations Act 2001 (Cth), healthcare providers regulated by the Australian Health Practitioner Regulation Agency (AHPRA), and credit providers regulated by the Australian Prudential Regulation Authority (APRA) — may face additional sector-specific obligations affecting the SaaS agreement's data handling, outsourcing, and notification provisions. Legal advice from an Australian technology lawyer is recommended for providers in these sectors.

A legally sound Australian SaaS Agreement must address the following elements to comply with the ACL, Privacy Act 1988 (Cth), Spam Act 2003 (Cth), and commercial best practice.

Parties and service description: Full legal names and Australian Business Numbers (ABNs) of both parties; a precise description of the software service including version, platform, and any included support or professional services; the number of authorised users; and any geographic or usage restrictions.

Subscription fees and billing: The subscription fee in AUD, expressed inclusive or exclusive of GST as required under the A New Tax System (Goods and Services Tax) Act 1999 (Cth); the billing cycle (monthly or annual); the auto-renewal terms and notice required to cancel; the provider's right to increase fees on renewal; and consequences of late payment.

Uptime SLA and service credits: The uptime commitment expressed as a percentage (e.g., 99.5% measured monthly); how downtime is measured and what events are excluded (scheduled maintenance, events beyond the provider's control); the service credit calculation for SLA breaches; and the process for claiming credits.

Intellectual property: Confirmation that the provider owns all IP in the software and grants the customer a limited, non-exclusive licence to use it during the subscription term; that the customer owns its data; and that neither party acquires any rights in the other's background IP. Under Section 35(6) of the Copyright Act 1968 (Cth), software created by an employee in the course of employment is owned by the employer, a factor relevant to providers' IP chain of title.

Customer data and privacy: A clear statement that the customer retains ownership of its data; the provider's obligation to process data only as instructed and in accordance with the APPs; APP 11 security safeguards including encryption, access controls, and incident response; APP 8 cross-border disclosure controls for data stored or processed offshore under Section 16C of the Privacy Act 1988 (Cth); the data return and deletion process on termination; and breach notification obligations consistent with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth), enforced by the OAIC. Under Section 26WF of the Privacy Act 1988 (Cth), APP entities must notify the OAIC and affected individuals of eligible data breaches likely to result in serious harm.

ACL compliance: An acknowledgment that the ACL consumer guarantees under Sections 60 to 62 (due care and skill, fitness for purpose) cannot be excluded; confirmation that the agreement does not contain unfair terms prohibited by Sections 23 to 28; and a limitation of liability clause that complies with Section 64A of the ACL for consumer contracts.

Spam Act compliance: A representation that all marketing and promotional communications sent by the provider to subscribers comply with the Spam Act 2003 (Cth), including consent, sender identification, and unsubscribe requirements enforced by the Australian Communications and Media Authority (ACMA).

Governing law: The laws of the relevant Australian state or territory; the jurisdiction of that state's Supreme Court or the Federal Court of Australia for disputes; and an optional mediation step before litigation. The forms-legal.com SaaS Agreement (Australia) template covers all these elements in a format ready for immediate use by Australian technology businesses, including those regulated by the Australian Securities and Investments Commission (ASIC) under the Corporations Act 2001 (Cth).