Washington SaaS Agreement Review
Washington never passed a general privacy act, but its My Health My Data Act reaches further than most comprehensive laws for one kind of data, and it has no revenue or consumer threshold. Any app, wellness platform or retailer whose software infers health information from Washingtonians is in scope. Add a 30-day breach deadline and sales tax on digital automated services, and a Seattle or Spokane buyer has three distinct state issues to check.
Consumer privacy law in Washington
No comprehensive state privacy law yet
Data rights in Washington
As of October 2026, Washington has not enacted a comprehensive consumer privacy law. Federal rules and sector-specific laws still apply, but there is less of a statutory backstop, which means the SaaS contract itself is your main protection. Read the data-use, security, and deletion terms closely, because they carry more weight here.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
How does the My Health My Data Act affect SaaS vendors?
RCW 19.373 covers "consumer health data," which includes information inferred from non-health data such as purchases or location. Collection and sharing each need separate consent unless necessary to provide the requested service, consent cannot be buried in general terms, and selling health data needs a signed authorization. Under RCW 19.373.060, a processor may handle that data only under a binding contract with instructions and limits; a vendor that goes beyond them is treated as a regulated entity.
Violations are enforced through the Consumer Protection Act, which also lets injured consumers sue. Most duties began March 31, 2024, and June 30, 2024 for small businesses, so vendor contracts signed since then should already reflect them.
What are Washington's breach and tax rules?
RCW 19.255.010 requires notice to affected consumers within 30 days of discovery, and to the attorney general within 30 days when more than 500 Washington residents are notified. For tax, Washington applies retail sales tax to remotely accessed software and digital automated services, so most subscriptions carry state and local tax.
Separately, RCW 19.375 restricts enrolling biometric identifiers for commercial purposes without notice and consent, which matters for identity verification, time-clock and access-control tools. Ask any vendor that handles face or fingerprint data how it meets that rule and who obtains the consent.
Washington sources checked 2026-10-09: RCW 19.373 (My Health My Data Act) · RCW 19.255.010 (breach notice). Laws change; confirm the current rule before relying on it.
Washington SaaS agreement FAQ
Does Washington have a data privacy law that affects SaaS contracts?
As of October 2026, Washington has not enacted a comprehensive consumer privacy law, so there is less statutory backstop. That makes the SaaS contract itself your main protection, the data-use, security, and deletion terms carry more weight, so read them closely.
Can a SaaS vendor use my Washington business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Washington law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Washington?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Washington law in about a minute.
Does the My Health My Data Act apply to a small Washington business?
Yes. Unlike most privacy laws, it has no revenue or volume threshold. Small businesses got a later start date, June 30, 2024, but must follow the same consent, deletion and processor contract rules for consumer health data. If your SaaS tools collect or infer health information, check their terms.
What is the breach notification deadline in Washington?
Thirty days from discovery, for both affected consumers and, when more than 500 Washington residents are notified, the attorney general. Law enforcement requests can extend it. Your vendor should be required to report incidents to you within a few days so you can meet that deadline.
Reviewing a SaaS contract in Washington?
Upload it and get the data, liability, and renewal terms checked against Washington law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Washington law when you run your agreement, and you should confirm anything critical with a qualified attorney.