Liability Capped at One Month of Fees. Your Breach Exposure Is Not

How big is the gap between the cap and your exposure?

Take the annual fee, apply the cap, and write down the number. Then estimate what a serious incident would cost you: notifying affected individuals, forensic investigation, legal costs, regulatory exposure, customers who leave, and the time your team spends on it rather than on the business.

For a tool costing a few lakh a year and holding customer records, those two numbers are usually an order of magnitude apart. The cap is not there to compensate you. It is there to make the vendor's risk quantifiable, which is a legitimate commercial objective and a poor fit for your actual exposure.

A worked example with numbers

Suppose you pay ₹6 lakh a year, or ₹50,000 a month, for a customer support platform holding records of 80,000 customers. The vendor misconfigures a storage bucket and the records are exposed.

Your likely costs: a forensic review at around ₹8 lakh, outside counsel at around ₹6 lakh, a customer communication exercise and helpline at around ₹4 lakh, and staff time across three weeks. Add lost renewals from customers who leave, say ₹20 lakh of annual revenue. Under the Digital Personal Data Protection Act, 2023, once its obligations commence, the Data Protection Board can impose penalties of up to ₹250 crore for failure to take reasonable security safeguards, and those fall on you as data fiduciary, not on the vendor.

Against costs of ₹38 lakh before any penalty, a one-month cap gives you ₹50,000. A twelve-month cap gives you ₹6 lakh. And if lost revenue is excluded as consequential loss, the ₹20 lakh may not be recoverable at all, whatever the cap.

How cap structures compare

The table uses the same ₹6 lakh annual contract to show what different structures produce for a data incident.

The carve-outs are the negotiation

Vendors resist raising the general cap, often reasonably so, because uncapped liability across all claims is not a risk a smaller vendor can carry. The productive negotiation is not about the headline figure. It is about which categories sit outside it.

The categories customers usually push to carve out are breach of confidentiality, security incidents and data breaches caused by the vendor, the vendor's indemnity obligations, and fraud or wilful misconduct. A structure with a general cap at twelve months of fees plus a higher super-cap for data incidents is a common landing point and a far better outcome than arguing about whether the general cap is one month or three.

Timing matters too. Vendors are most flexible before the first signature and at a renewal where you have a credible alternative. Ask early, in writing, and put the carve-out request alongside the data processing addendum rather than raising it as a last-minute change. Procurement and legal teams on the vendor side often have pre-approved fallback positions, such as a super-cap at two or three times fees, which they will offer only if asked.

Does the exclusion clause do more damage than the cap?

Often, yes. Immediately around the cap sits a clause excluding indirect, incidental, special and consequential loss, and frequently loss of profits, revenue, data and goodwill by name. Read that list against what you would actually claim after an incident.

Lost revenue from customers who left, the cost of reconstructing data, and reputational damage are precisely the heads of loss that clause removes. A generous cap sitting above a comprehensive exclusion can be worth very little, which is why the two clauses have to be read together rather than in sequence.

Section 73 of the Indian Contract Act, 1872 already limits compensation to loss which naturally arose in the usual course of things from the breach, or which the parties knew when they made the contract to be likely to result, and excludes remote and indirect loss. A contractual exclusion that also names loss of data or loss of profits goes further than that default. For a data-hosting product, loss of data is not remote; it is the obvious consequence of the vendor's failure, and it should not be excluded.

How do indemnities interact with the cap?

An indemnity is a promise to make good a specific loss. Section 124 of the Indian Contract Act, 1872 defines a contract of indemnity as one by which a party promises to save the other from loss caused by the conduct of the promisor or of any other person. In SaaS contracts, vendors typically indemnify customers against third-party claims that the software infringes someone's intellectual property, and sometimes against claims arising from a data breach.

The trap is that an indemnity sitting inside the general cap is worth no more than the cap. If the vendor indemnifies you against an infringement claim but total liability is capped at one month's fees, the indemnity is worth ₹50,000 on a ₹6 lakh contract, however large the claim. Check the cap clause for words like 'including under any indemnity'. If they appear, the indemnity has been capped, and that is the first carve-out to request.

Where does Indian law sit?

Section 73 deals with compensation for loss caused by breach. Section 74 deals with a sum named in the contract as the amount payable on breach, and provides that the party complaining is entitled to reasonable compensation not exceeding that amount. The Supreme Court has held that proof of loss is generally required under Section 74, but that where loss is difficult or impossible to prove, a sum that is a genuine pre-estimate may be awarded without such proof, and never more than the named sum.

A liability cap is a slightly different thing: a ceiling on whatever is otherwise recoverable rather than a pre-estimate of loss. Parties can and do agree limits on liability, and courts generally give effect to them in commercial contracts between businesses. A cap is unlikely to protect a party against its own fraud, and a clause in a standard form imposed on a weaker party may be scrutinised more closely, but those are arguments to make after a loss. The practical response is to negotiate the terms at signature.

Courts also read limitation clauses according to their words. A cap described as applying to 'claims under this Agreement' may be argued not to cover other kinds of claims, and an exclusion of 'indirect loss' does not automatically exclude everything that is hard to quantify. Disputes over exactly these phrases are common, which is one more reason to settle the wording before signature rather than leave it to interpretation.

What to negotiate, in order

• Carve breach of confidentiality and vendor-caused security incidents out of the general cap, or put them under a higher super-cap.
• Carve the vendor's indemnity obligations and fraud or wilful misconduct out of the general cap.
• Narrow the exclusion clause so that loss of data, data restoration costs and breach notification costs are recoverable as direct loss.
• Ask for the cap to be expressed as a multiple of annual fees, or a fixed rupee figure, rather than a single month.
• Make the cap mutual if the vendor insists on one for you too, and check your own liability is not uncapped while theirs is limited.
• Ask what cyber and professional indemnity insurance the vendor carries, and for what amount, which is often more informative than the cap itself.

What if the terms are click-through and not negotiable?

For self-serve plans you often cannot change the contract. You can still manage the risk. Limit what goes into the tool: if the cap is one month and the terms exclude loss of data, do not put your only copy of customer records there. Keep your own regular export. Check whether a higher plan comes with an enterprise agreement or a data processing addendum, since the price difference is often small compared with the protection. And look at your own cyber insurance, because for low-cost tools your policy, not the vendor's contract, is the realistic source of recovery.

Sample wording you can propose

A balanced clause might read: 'Except for Excluded Claims, each party's aggregate liability shall not exceed the fees paid or payable in the twelve months before the event giving rise to the claim. For claims arising from a breach of Clause [Data Protection] or Clause [Security], Vendor's aggregate liability shall not exceed [three] times those fees. Excluded Claims means liability for fraud, wilful misconduct, breach of confidentiality, and indemnity obligations. Notwithstanding Clause [Exclusions], costs of data restoration, forensic investigation and notification to affected individuals or any regulator are direct losses.'

Expect the vendor to push back on the multiple and the excluded claims. A move from one month to twelve months, plus a super-cap for data incidents, is a realistic result for most mid-sized buyers.