District of Columbia SaaS Agreement Review
The District of Columbia has no comprehensive consumer privacy law, so the contract governs most of what a SaaS vendor can do with your data. The District's breach statute, D.C. Code 28-3851 and following, was overhauled in 2020 and is stricter than most states in one respect: the Attorney General must be notified when as few as 50 District residents are affected. For associations, nonprofits and federal contractors based in Washington, that bar is easy to reach.
Consumer privacy law in District of Columbia
No comprehensive state privacy law yet
Data rights in District of Columbia
As of October 2026, District of Columbia has not enacted a comprehensive consumer privacy law. Federal rules and sector-specific laws still apply, but there is less of a statutory backstop, which means the SaaS contract itself is your main protection. Read the data-use, security, and deletion terms closely, because they carry more weight here.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What did the 2020 DC breach amendments change?
The Security Breach Protection Amendment Act, effective June 17, 2020, broadened personal information to include medical, genetic and biometric data and email login credentials. It added an Attorney General notice when 50 or more residents are affected, due no later than individual notice, describing the cause, the number of residents and the remediation steps.
If Social Security or taxpayer ID numbers are involved, identity theft protection must be offered free for at least 18 months.
Security duties that reach your vendor
The amended law also requires businesses to maintain reasonable security safeguards and, when they share personal information with a service provider, to require by written agreement that the provider maintains reasonable safeguards too. That is a direct contract term DC expects you to have. Vendors holding your data must notify you in the most expedient time possible after discovering a breach, and residents can sue for actual damages and attorney's fees.
When can a DC business skip breach notice?
Only after a reasonable investigation, and in consultation with the Attorney General and federal law enforcement, concludes that harm is unlikely. That consultation requirement is unusual. Acquisition of data rendered unusable, such as properly encrypted files, is not a breach. Substitute notice is available when direct notice would cost more than $50,000 or reach more than 100,000 people.
District of Columbia sources checked 2026-10-09: Ashurst Perkins Coie, District of Columbia breach chart. Laws change; confirm the current rule before relying on it.
District of Columbia SaaS agreement FAQ
Does District of Columbia have a data privacy law that affects SaaS contracts?
As of October 2026, District of Columbia has not enacted a comprehensive consumer privacy law, so there is less statutory backstop. That makes the SaaS contract itself your main protection, the data-use, security, and deletion terms carry more weight, so read them closely.
Can a SaaS vendor use my District of Columbia business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of District of Columbia law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in District of Columbia?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against District of Columbia law in about a minute.
Does a DC breach notice go to the AG even if HIPAA already applies?
Yes. Entities that comply with HIPAA or the Gramm-Leach-Bliley Act are treated as compliant for individual notice, but the District still requires written notice to the Attorney General in all cases. A health tech or financial SaaS vendor serving DC clients should know that and provide the facts the client needs to file.
Can District residents sue over a SaaS data breach?
Yes. The District's breach law lets residents recover actual damages, costs and reasonable attorney's fees, though not dignitary damages such as pain and suffering. That exposure is a good reason to negotiate an indemnity from the vendor for third party claims caused by its security failures, outside the ordinary liability cap.
Reviewing a SaaS contract in District of Columbia?
Upload it and get the data, liability, and renewal terms checked against District of Columbia law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current District of Columbia law when you run your agreement, and you should confirm anything critical with a qualified attorney.