Liability Capped at One Month of Fees. Your Breach Exposure Is Not

Doing the arithmetic

Take the annual fee, apply the cap, and write down the number. Then estimate what a serious incident would cost you: notifying affected individuals, remediation, regulatory exposure, legal costs, customers who leave, and the time your team spends on it rather than on the business.

For a tool costing a few lakh a year and holding customer records, those two numbers are usually an order of magnitude apart. The cap is not there to compensate you. It is there to make the vendor risk quantifiable, which is a legitimate commercial objective and a poor fit for your actual exposure.

The carve-outs are the negotiation

Vendors resist raising the general cap, and often reasonably so, because uncapped liability across all claims is not a risk a smaller vendor can carry. The productive negotiation is not about the headline figure. It is about which categories sit outside it.

The categories customers usually push to carve out are breach of confidentiality, security incidents caused by the vendor, the vendor indemnity obligations, and wilful misconduct. A structure with a general cap at twelve months of fees plus a higher super-cap, commonly a multiple of fees, for data incidents is a common landing zone and a far better outcome than arguing about whether the general cap is one month or three.

The exclusion clause does more damage than the cap

Immediately around the cap sits a clause excluding indirect, incidental, special and consequential loss, and frequently loss of profits, revenue, data and goodwill by name. Read that list against what you would actually claim after an incident.

Lost revenue from customers who left, the cost of reconstructing data, and reputational damage are precisely the heads of loss that clause removes. A generous cap sitting above a comprehensive exclusion can be worth very little, which is why the two clauses have to be read together rather than in sequence.

Where Indian law sits

Sections 73 and 74 of the Indian Contract Act govern compensation for breach. Section 73 addresses loss naturally arising from the breach, and Section 74 provides that where a sum is named in the contract, the party complaining is entitled to reasonable compensation not exceeding that amount.

Parties can and do agree limits on liability, and those provisions are ordinarily given effect. The interaction between a contractual cap and the statutory framework in a specific dispute is fact-sensitive, so the practical response is to negotiate the terms rather than to rely on a court reading them down later.

What to negotiate, in order

• Carve breach of confidentiality and vendor-caused security incidents out of the cap, or under a higher super-cap.
• Carve the vendor indemnity obligations out of the general cap.
• Narrow the exclusion clause so that direct losses you would actually incur are recoverable.
• Ask for the cap to be expressed as a multiple of fees rather than a single month.
• Ask what cyber and professional indemnity insurance the vendor carries, which is often more informative than the cap itself.