Software terms decide who owns your data, and who pays when it goes wrong.

Check who owns your data and whether the vendor can use it to train AI models; how the contract handles personal data under the DPDP Act; the auto-renewal date and cancellation window; whether the liability cap bears any relation to what a data breach could cost you; price increases and changes to terms by notice; uptime commitments with a real remedy; data export and deletion on exit; and GST treatment.

Only as far as the agreement allows, which is why the wording matters. Many terms grant a licence to use customer data, or “de-identified” or “aggregated” data, to improve services, and that can include training AI models. If the data includes personal data, the DPDP Act also limits its use to the stated purpose. The report quotes the clause and suggests narrower wording, such as an opt-in.

The DPDP Rules were notified on 13 November 2025 and phase in, with the consent manager provisions from 13 November 2026 and full compliance due by 13 May 2027. A shorter timeline has been proposed, so verify the current deadline. Contracts signed now often run past that date, so it is sensible to agree data roles, breach notification, deletion and cross-border transfer terms at the outset.

Caps tied to fees paid over a recent period are common in SaaS terms. The real question is whether the cap matches your exposure, especially for a data breach, loss of data or a confidentiality failure. Many buyers negotiate a higher cap, or a separate cap, for data protection and confidentiality breaches. The report compares what the cap covers with what could realistically go wrong.

If the agreement allows changes by notice or by updating a web page, the vendor will rely on it. In consumer contracts, unilateral variation can be challenged as an unfair term under the Consumer Protection Act, but business subscriptions are generally treated as commercial contracts. Ask for the price to be fixed for the term, changes to apply only on renewal, and a right to leave if a change harms you.

Note the renewal date and the cancellation window as soon as you sign, because many disputes start with a missed notice. Business subscriptions are governed mainly by the contract itself, so the wording decides. Ask for a reminder before renewal, a reasonable cancellation window, and renewal at the same price. The report pulls out the renewal date, the notice requirement and any price change on renewal.

The contract should state whether fees are inclusive or exclusive of GST and who bears it, since silence causes disputes. Whether CGST and SGST or IGST applies depends on the place of supply, and different rules apply where an overseas vendor supplies an Indian business. The report flags silence on GST and any tax references to the old Income-tax Act; confirm the treatment with your chartered accountant.

Generally yes. Under Section 10A of the Information Technology Act, a contract is not invalid only because it was formed electronically. That means online terms, linked policies and later updates referred to in the order form can all form part of your agreement. Read the linked documents before you accept; the report reviews them too if you upload or paste them with the order form.

The agreement should give you a period to export your data in a usable format, then require the vendor to delete it and confirm deletion, subject to any legal retention duties. Where personal data is involved, the DPDP Act expects it to be erased once the purpose is served. Watch for short export windows, export fees, or deletion immediately on termination. The report flags exit terms so you can negotiate them first.