Pennsylvania SaaS Agreement Review
Pennsylvania has no comprehensive privacy act in force as of 2026, but two state rules change the economics of a software deal. Since 2016, canned software accessed remotely has been subject to sales tax, so a Pittsburgh or Philadelphia buyer usually pays tax on SaaS. And a 2024 amendment to the breach law added attorney general notice and credit monitoring duties, which should shape the incident and cost terms you negotiate.
Consumer privacy law in Pennsylvania
No comprehensive state privacy law yet
Data rights in Pennsylvania
As of October 2026, Pennsylvania has not enacted a comprehensive consumer privacy law. Federal rules and sector-specific laws still apply, but there is less of a statutory backstop, which means the SaaS contract itself is your main protection. Read the data-use, security, and deletion terms closely, because they carry more weight here.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What changed in Pennsylvania's breach law in 2024?
The Breach of Personal Information Notification Act, 73 P.S. 2301 and following, was amended by Act 33 of 2024, effective September 26, 2024. When a business must notify more than 500 Pennsylvania residents, it must also notify the Office of Attorney General at the same time. Where the breach exposes Social Security numbers, bank account numbers or driver's license or state ID numbers, the business must offer affected residents 12 months of credit monitoring and access to a credit report.
That is a real cost, and it applies even when the breach happened at your vendor. Your SaaS agreement should say who pays for notices and credit monitoring when the vendor causes the breach, and the liability cap should not be so low that it swallows that obligation.
How is SaaS taxed in Pennsylvania?
Act 84 of 2016 brought canned software accessed electronically within the sales and use tax. The state rate is 6%, with local add-ons that bring it to 7% in Allegheny County and 8% in Philadelphia. Custom software developed for one customer is treated differently, so check how a bundled implementation and subscription is invoiced. If a smaller or overseas vendor does not collect Pennsylvania tax, the buyer may owe use tax directly.
Pennsylvania sources checked 2026-10-09: Constangy, Pennsylvania breach law amendments take effect · Pa. Department of Revenue, canned software and digital goods. Laws change; confirm the current rule before relying on it.
Pennsylvania SaaS agreement FAQ
Does Pennsylvania have a data privacy law that affects SaaS contracts?
As of October 2026, Pennsylvania has not enacted a comprehensive consumer privacy law, so there is less statutory backstop. That makes the SaaS contract itself your main protection, the data-use, security, and deletion terms carry more weight, so read them closely.
Can a SaaS vendor use my Pennsylvania business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Pennsylvania law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Pennsylvania?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Pennsylvania law in about a minute.
Who pays for credit monitoring after a SaaS breach in Pennsylvania?
By statute, the business that owns the data must offer 12 months of credit monitoring when certain identifiers are exposed. Whether you can recover that cost from the vendor depends on the contract. Negotiate an indemnity or a separate, higher liability cap for breach costs, since a cap of a few months' fees rarely covers it.
Does Pennsylvania have a consumer privacy law like Virginia's?
Not as of this page's last check. House Bill 78 passed the House in October 2025 and advanced in the Senate in 2026, but no comprehensive privacy act is in force, so there is no state requirement for a data processing agreement. Ask for one anyway.
Reviewing a SaaS contract in Pennsylvania?
Upload it and get the data, liability, and renewal terms checked against Pennsylvania law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Pennsylvania law when you run your agreement, and you should confirm anything critical with a qualified attorney.