B2B SaaS liability caps in Cyprus: drafting a usable clause

Map the contract and governing law before discussing the number

Gather the signed master agreement, order form, service description, SLA, data-processing agreement, security schedule and any procurement terms. Record their order of precedence. A cap in the master agreement is of little use if another document says its remedies are cumulative and uncapped, or if a click-through update silently replaces negotiated wording. Identify which Cyprus entity contracts, which affiliates may use the service and whether a group parent has given a separate guarantee. The cap should match the legal parties and the obligations they have accepted.

Confirm that both sides act as businesses. Consumer rules and standard-form controls can change the analysis; this guide concerns negotiated business-to-business supply. Check governing law and dispute forum rather than assuming a Cyprus address makes every issue subject to Cyprus law. If another country's law governs, do not transpose Cyprus Contract Law conclusions automatically. Even under Cyprus law, cross-border data and sector-specific obligations may still follow a different legal route. Put the governing-law decision in the deal file and have local advisers check the full document set where stakes are material.

Write a short risk schedule before proposing a cap: fees at risk, data volumes, recovery time, regulatory dependencies, availability commitments, customer concentration and available insurance. A low-priced non-critical analytics tool and a platform carrying regulated transaction instructions present different exposures. The contract should allocate those actual risks. Do not solve an underpriced high-risk service by promising an unlimited recovery that the provider could never fund. Equally, a cap at one month of fees may make an essential restoration promise commercially meaningless for the customer.

Financial firms need a separate mandatory-contract review under DORA's ICT supplier rules.

Basis and guidance: Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74; Regulation (EU) 2016/679, Articles 28 and 82

Separate ordinary damages from an agreed liability cap

Section 73 of Cyprus Contract Law Cap.149 addresses compensation for loss that arises naturally in the usual course from breach, or that the parties knew at contract formation was likely to result. It excludes remote and indirect loss in the statutory damages analysis and requires attention to available means of mitigation. Those rules help assess a claim, but they are not a ready-made definition of every loss category used in a SaaS contract. A negotiated cap is a separate allocation of exposure; it should not be described as the amount Cyprus law automatically awards.

A clause naming a fixed amount payable on breach raises a different issue under section 74. The statute provides for reasonable compensation up to the named sum or penalty, even where actual loss is not proved. A service credit, fixed delay payment or liquidated-damages schedule therefore needs its own legal review. Do not casually call a percentage credit the customer's exclusive remedy while also promising restoration, indemnification and termination rights elsewhere. State whether credits reduce a damages claim, coexist with it, or replace a defined claim, and check whether that treatment is defensible for the failure concerned.

Test the clause with a timeline. Suppose a Cyprus SaaS host is unavailable for two days and the customer incurs documented recovery costs, lost sales and a contractual penalty owed to its own client. Ask first which supplier obligation was breached, then which losses satisfy the statutory and contractual tests, then how exclusions and the cap apply. Do not assume that labelling every customer loss 'consequential' removes it. The nature of the loss and what both parties knew when contracting matter. A useful negotiation record explains foreseeable dependencies without promising compensation for unlimited downstream chains.

Basis and guidance: Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74

Define the cap's base, period and claim grouping

A common formula is fees paid or payable in the twelve months before the event giving rise to a claim. It sounds simple until a customer has several orders, an annual prepaid invoice, credits, a free trial or a newly launched service with no prior fees. Define whether the base includes taxes, pass-through charges, professional services and affiliate orders. Specify a minimum floor if early-stage exposure would otherwise be zero. A cap tied to a precise fee base is easier to price and insure than a vague reference to 'contract value'.

Say whether the amount is an aggregate cap for all claims, an annual cap, or a separate cap for each event. Define related incidents: a sequence of outages from one configuration defect should not produce arbitrary multiple caps, but unrelated security and availability failures should not disappear into a single earlier claim without deliberate agreement. Clarify whether claims for contract, negligence, indemnity and misrepresentation arising from the service count together. Where the law does not permit a category to be capped, wording should yield to that rule rather than creating a misleading promise that all claims are limited.

Match the cap to insurance evidence without implying that the policy itself guarantees payment. Cyber cover may exclude certain regulatory fines, contractual assumptions of liability or particular incidents; professional indemnity may have a different deductible and territorial scope. The customer should understand the gap between a negotiated cap and collectible assets. The supplier should also test whether a 24-month-fees cap across thousands of customers creates an exposure that its balance sheet cannot bear. Record why the agreed figure fits the service instead of copying the percentage from a competitor's terms.

Basis and guidance: Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74

Define excluded losses without erasing the main service promise

SaaS agreements often exclude lost profit, revenue, goodwill, business interruption and indirect or consequential loss. These terms can overlap or capture the very harm the customer is buying protection against. A wholesale exclusion of revenue loss in an e-commerce checkout service may leave the availability warranty hollow. For each excluded category, ask whether it is truly unpriceable or a known operational dependency. Use a concrete incident example in negotiation notes. The clause should name the excluded loss and any negotiated exception rather than rely on an undefined label that both sides interpret differently.

Distinguish a loss exclusion from a cap. The former can remove a category altogether; the latter limits recoverable exposure after a claim is otherwise established. Combining an extremely broad exclusion with a small cap and an exclusive service credit may leave no meaningful remedy. The supplier may still need room to exclude speculative third-party profits beyond the intended service. Draft to allocate that risk expressly, and check the result against section 73's ordinary and contemplated-loss framework. A label used in a template is not a substitute for a reasoned Cyprus-law interpretation.

Avoid stating that a party waives every remedy for deliberate wrongdoing, personal injury or a mandatory legal obligation without examining applicable law. Rather than publish an unverified universal 'uncappable claims' list, identify the actual legal regime, conduct and claim and obtain Cyprus advice on any proposed carve-out. Also check whether an exclusion in the customer terms conflicts with an express security, backup or disaster-recovery commitment. If the contract promises daily backups but excludes all loss of data, a reviewer should resolve that contradiction before signature.

Basis and guidance: Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74; Regulation (EU) 2016/679, Articles 28 and 82

Keep GDPR claims and the customer-provider allocation distinct

If the SaaS provider processes personal data for a customer, GDPR Article 28 requires a processor agreement covering documented instructions, security, sub-processors, assistance and return or deletion of data, among other matters. Article 82 gives a person who has suffered material or non-material damage from a GDPR infringement a right to compensation under its conditions. A bilateral commercial cap between supplier and customer should not be presented as extinguishing a data subject's statutory rights or the regulator's powers. It allocates risk between the contracting businesses, subject to the applicable law and the precise claim.

Separate three flows: compensation a person seeks under the GDPR; liability one party owes the other under the service contract; and contribution or recovery between parties after an external claim. Draft any data-breach indemnity around defined triggers, control of defence, notification and settlement consent. An automatic promise to reimburse every fine, complaint and reputation loss may be commercially impossible and may conflict with applicable rules. Conversely, limiting all data-related recovery to one month's fees may make assistance and security duties illusory. Review the processor agreement and liability clause together.

Map responsibility for the actual processing. A customer may set purposes and upload data; a provider controls infrastructure and sub-processors; both can affect incident response. GDPR Article 82 has its own allocation and recourse structure among responsible controllers and processors. The contract can set procedures for cooperation and evidence, but should not claim to predetermine a person's statutory entitlement. Preserve logs, security commitments, instructions and incident communications so the commercial allocation can be applied to real facts rather than an abstract 'data breach' label.

Where the parties jointly set purposes rather than using a processor, first review joint-controller classification.

Basis and guidance: Regulation (EU) 2016/679, Articles 28 and 82; Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74

Coordinate IP indemnities, service credits and termination rights

A supplier's IP indemnity may cover a third-party allegation that the supplied software infringes rights. Decide whether it is inside the general cap, receives a higher cap or is treated differently for defined remedies such as replacing the feature, procuring a licence or refunding unused fees. The scope should identify the supplied service and exclusions for customer modifications, unauthorised combinations and continued use after a workable remedy is offered. The customer needs a defence process and a right to know when an essential function will change. The supplier needs control over unfounded or inflated claims.

Security, confidentiality and payment obligations deserve their own treatment. An agreement that gives the customer an uncapped indemnity for any use of the platform but caps the provider's security failure at one invoice may be hard to justify. A mutual cap can be sensible, yet the risks are not always symmetrical. Distinguish a customer's unpaid charges from the supplier's damages exposure: excluding payment of an invoice from a cap may be necessary to avoid turning a liability clause into free service. State this directly instead of hoping a generic carve-out is read that way.

Service credits are an operational remedy, not a complete incident plan. Specify how they are calculated, claimed and applied; whether planned maintenance is excluded; and what happens after repeated failure. Termination should address refund of unused prepaid fees, continued access during transition and export of data. A contract that allows immediate termination but gives no practical retrieval window may create losses far greater than the fee cap. Check the workflow against the service's actual architecture and any mandatory switching duties that apply to the provider.

For the separate cloud exit rules, see Data Act switching terms.

An IP defence also depends on a clean rights chain; review employee-created IP ownership.

Basis and guidance: Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74; Regulation (EU) 2023/2854, Chapter VI on switching between data processing services

Test special sectors and mandatory exit rights before signing

A regulated financial customer may need DORA Article 30 terms covering audit, access, security, continuity, incident assistance and termination. A boilerplate liability clause should not make those obligations impossible to perform. The financial entity also needs its own supplier-risk assessment and exit strategy; a contract cap cannot replace them. Identify which legal entity and service are in scope. Do not mark every SaaS sale to a bank as identical: critical or important functions trigger enhanced provisions, and a financial group may require a different service schedule from an ordinary commercial buyer.

For an in-scope data processing service, the EU Data Act regulates obstacles to switching, contract terms and switching charges on a timetable. A provider cannot simply use a liability or termination term to defeat a mandatory retrieval or switching obligation. Determine whether the service falls within the relevant definitions and which date-specific duties apply. The Data Act does not turn every software subscription into an identical cloud contract. Document classification rather than promising universal portability or claiming that an ordinary business-to-business cap overrides the regulation.

Also identify public-sector procurement conditions, sector security rules and the customer's own regulated obligations. A standard SaaS form may be inadequate where the buyer must demonstrate audit access or data localisation. Put special schedules in a clear precedence order, price the additional duties and test them with delivery teams. Legal, sales, security, finance and engineering should agree on the same service description. The worst liability dispute often begins with a product promise in a proposal that the formal contract never reconciled.

See the specific DORA ICT supplier contract checklist before negotiating with a financial entity.

Basis and guidance: Regulation (EU) 2022/2554, Article 30 on ICT third-party contractual arrangements; Regulation (EU) 2023/2854, Chapter VI on switching between data processing services; Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74

Run a clause test and keep a defensible negotiation file

Build a one-page matrix for each material risk: supplier obligation, plausible breach, customer impact, evidence available, remedy, loss exclusion, cap and insurance response. Use two or three realistic examples, such as a short outage, a long data-restoration failure and an IP claim. Calculate the actual amount recoverable under the proposed wording, including service credits and any deductibles. If the result surprises either side, revise the clause before signature. This exercise exposes contradictions faster than debating whether a twelve-month cap is 'market standard'.

Check the full claim procedure. An unrealistically short notice window may wipe out a claim before a security investigation is complete; an indefinite window leaves evidence and reserves uncertain. Define the relationship between contractual claim notice and mandatory incident reporting without conflating them. Provide a sensible path for third-party claims, preservation of evidence, defence control, settlement and mitigation. Confirm who may issue binding notices for each party and which mailbox is monitored. A beautifully drafted cap will not help if the contract cannot establish which incident or order it covers.

Finally, version the signed documents and record the negotiated assumptions: expected volume, critical dependencies, data categories, recovery objectives and the reason for any higher sub-cap or carve-out. Revisit the allocation when a pilot becomes production, a new module changes the risk, an affiliate joins or an annual renewal materially changes fees. Do not silently apply a low-risk pilot cap to a business-critical service. For a live dispute, preserve the contract and incident evidence and obtain Cyprus advice on sections 73 and 74, the exclusions and any statutory claims before stating that the cap definitely disposes of liability.

Basis and guidance: Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74; Regulation (EU) 2016/679, Articles 28 and 82; Regulation (EU) 2023/2854, Chapter VI on switching between data processing services

Primary sources and scope

Sources checked: October 8, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus Contract Law Cap.149, consolidated text, sections 73 and 74
• Regulation (EU) 2016/679, Articles 28 and 82
• Regulation (EU) 2023/2854, Chapter VI on switching between data processing services
• Regulation (EU) 2022/2554, Article 30 on ICT third-party contractual arrangements