Michigan SaaS Agreement Review
Michigan has no comprehensive consumer privacy law as of 2026, and the main statute affecting a SaaS purchase is the breach section of the Identity Theft Protection Act, MCL 445.72. For a Detroit or Grand Rapids business, that leaves the contract as the primary tool for limiting how a vendor uses data, setting security duties and guaranteeing deletion. Michigan is one of the states with relatively thin specific law here.
Consumer privacy law in Michigan
No comprehensive state privacy law yet
Data rights in Michigan
As of October 2026, Michigan has not enacted a comprehensive consumer privacy law. Federal rules and sector-specific laws still apply, but there is less of a statutory backstop, which means the SaaS contract itself is your main protection. Read the data-use, security, and deletion terms closely, because they carry more weight here.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What does Michigan's breach law require?
Notice must go to affected residents without unreasonable delay, unless the business determines the breach has not caused and is not likely to cause substantial loss, injury or identity theft. Credit bureaus must be told when 1,000 or more residents are notified. A business maintaining a database it does not own must notify the owner when it discovers a breach, subject to the same harm test.
Notices must describe the incident, the data involved and a phone number for help, and may be given by mail, live phone call or, in some cases, email.
Penalties and what to negotiate
Failing to notify can bring a civil fine of up to $250 per failure, capped at $750,000 for a single breach. Michigan also criminalizes sending fake breach notices. With no processor statute, put explicit terms in your SaaS agreement on permitted use, data location, deletion and incident reporting, and make the vendor pay notification costs it causes.
Michigan exemptions
HIPAA covered entities are treated as compliant with the breach statute, and financial institutions that follow the 2005 federal interagency guidance are deemed compliant. Public utilities that bill monthly may use an alternative notice method combining media notice, website posting and a written notice with the bill. Everyone else follows the general rules above.
Michigan sources checked 2026-10-09: Ashurst Perkins Coie, Michigan breach chart. Laws change; confirm the current rule before relying on it.
Michigan SaaS agreement FAQ
Does Michigan have a data privacy law that affects SaaS contracts?
As of October 2026, Michigan has not enacted a comprehensive consumer privacy law, so there is less statutory backstop. That makes the SaaS contract itself your main protection, the data-use, security, and deletion terms carry more weight, so read them closely.
Can a SaaS vendor use my Michigan business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Michigan law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Michigan?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Michigan law in about a minute.
Are Michigan insurers covered by the general breach statute?
No. Insurers regulated under Michigan's Insurance Code follow a separate data security law enacted in 2018 and effective in 2021, which includes its own cybersecurity program and notice duties. An insurer buying SaaS should map its vendor terms to that regime rather than MCL 445.72.
Can a Michigan breach notice be delayed for law enforcement?
Yes, if a law enforcement agency determines notice would impede a criminal investigation or jeopardize homeland or national security. Your SaaS contract should require the vendor to tell you about any such request immediately, since you remain responsible for notifying once the delay ends.
Reviewing a SaaS contract in Michigan?
Upload it and get the data, liability, and renewal terms checked against Michigan law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Michigan law when you run your agreement, and you should confirm anything critical with a qualified attorney.