SaaS Contract Lawyer in Spain

A SaaS contract without exit clauses ties you to the provider just when you need to leave.

We draft, review and negotiate SaaS contracts for companies that sell software as a service and for those that buy it: service levels, data processing agreements, data ownership and switching provider under the EU Data Act.

Request a free initial assessment. We will review your contract or your terms of service and tell you which clauses are missing and which ones expose you.

No commitment · We reply the same day

YEARS OF EXPERIENCE

+ 0

CLIENTS ADVISED

+ 0

PROJECTS COMPLETED

+ 0

PRACTICE AREAS

+ 0

WHAT SETS US APART

SaaS Contracts That Also Work on the Day You Leave

Since 12 September 2025, the EU Data Act has required contracts for cloud services, SaaS included, to set out in writing how the customer can switch provider.
That is why we review the SLA, the GDPR data processing agreement, data ownership and the exit together, so that they fit with each other and with how the service actually runs.
If you sell or buy software as a service, your contract has to work on the day everything goes well and on the day you need to switch provider.

We reply the same day

SAAS CONTRACT SERVICES

What Does Your SaaS Contract Need?

Legal advice on software-as-a-service contracts for SaaS providers and for the companies that buy from them.

Terms of service and SaaS master agreement

We draft the general terms and master agreement for your service: subject matter, licence to use, price and renewal, limitation of liability, confidentiality, intellectual property and termination. Where your customers sign on standard terms, we align the clauses with Spanish rules on standard contract terms.

Service level agreements (SLAs)

We define the committed availability, how it is measured, response and resolution times for incidents, maintenance windows and service credits for breaches. An SLA without a measurement method or a consequence gives you nothing to claim on.

Data processing and data transfers

We prepare the data processing agreement required by Article 28 of the GDPR, covering the provider’s sub-processors, security measures and the return or deletion of data at the end. We also review international transfers where the service is hosted outside the European Economic Area.

Switching provider and portability (Data Act)

We build into the contract the switching clauses required by Article 25 of Regulation (EU) 2023/2854: a maximum notice period of two months, a transition period of up to thirty calendar days and a list of exportable data. We also review switching charges, which can only be reduced charges until 12 January 2027 and disappear after that date.

Review of your provider's SaaS contract

We review the contract your SaaS provider offers you before you sign: automatic renewals, unilateral changes to price or features, liability caps, use of your data for other purposes and exit terms. We tell you what to negotiate and how.

SECTORS AND COMPANIES

Do You Sell or Buy Software as a Service?

We advise companies with these profiles on SaaS contracts.

B2B SaaS providers

Terms and master agreements

Fintech and financial entities

DORA Article 30 clauses

Digital health

Health data in the cloud

eCommerce and marketplaces

Platforms and payment gateways

AI providers

Contracts with deployers

PROCESS AND TIMELINES

How We Work

From first draft to signature, in 4 steps

1 –

Contract assessment

We review your current contract or terms and tell you what is missing, what exposes you and what the law already requires. Free of charge and with no commitment.

2 –

Risk map

We identify the critical points: unmeasured availability, liability caps that cover nothing, data with no way out, uncontrolled sub-processors and renewals that lock you in.

3 –

Drafting and negotiation

We draft or rewrite the contract, the SLA and the data processing agreement, and support you in the negotiation with the other party.

4 –

Follow-up

We update the contract when the law changes, such as the end of switching charges in January 2027, and advise you if there is a breach.

REVIEWS AND RATINGS

What Our Clients Say

Reviews from real clients and companies about our technology contract services.

Marta combines impeccable professionalism with a remarkable ability to explain complex legal concepts in simple terms...

Impeccable personal attention, availability and human touch. Broad knowledge and experience in the sector. Outstanding at solving problems. 100% recommended...

I have no words to express my sincere gratitude. Marta is a very dedicated and empathetic professional. She also works fast...

Thank you so much, Marta, for your invaluable advice. Without your knowledge of NFT technology in the art market, a new and promising field but one exposed to a lot of fraud, I would have got myself into serious trouble. Marta …

REGULATORY FRAMEWORK

SaaS Contracts in Spain and the EU

Spain has no specific statute on SaaS contracts. They are governed by what the parties agree, with the Civil Code and the Commercial Code as the basis, the Intellectual Property Act for the software licence and the rules on standard contract terms where the contract is signed on standard terms.

On top of that basis, several EU rules require specific content. The GDPR requires a data processing agreement where the provider processes personal data on the customer’s behalf (Article 28). Regulation (EU) 2023/2854, the Data Act, applicable since 12 September 2025, includes SaaS among data processing services and requires switching to be set out in writing, with no switching charges from 12 January 2027. And where the customer is a financial entity, Article 30 of the DORA Regulation sets the minimum clauses of its ICT services contracts, with the service levels inside the contract.

Where the service includes artificial intelligence, the contract also has to settle who is the provider and who is the deployer under the AI Act. We explain this in our articles on the EN 18286 AI Act harmonised standard and on algorithmic transparency clauses with your software vendor. Technology contracts as a whole are covered on our technology contracts lawyer page.

FAQ

Frequently Asked Questions on SaaS Contracts

What should a SaaS contract include?

At a minimum, the subject matter and scope of the service, the licence to use, price and renewal, service levels, the data processing agreement if there is personal data, security, confidentiality, limitation of liability and exit. Since the Data Act, exit has a minimum legal content: notice and transition periods, exportable data and switching charges.

What does the Data Act change in SaaS contracts?

Article 25 of Regulation (EU) 2023/2854 requires switching to be set out in writing. The customer can request it with a notice period of no more than two months, and the move must take place within a transition period of up to thirty calendar days, with a full list of exportable data and digital assets. It has applied since 12 September 2025.

Can my SaaS provider charge me for switching to another provider?

Until 12 January 2027 it may charge reduced switching charges, which cannot exceed the costs the switch itself causes, under Article 29 of the Data Act. From that date it cannot charge anything for the switching process. Before signing, the provider must inform you of those charges and of any early termination penalties.

Do I need a data processing agreement with my SaaS provider?

Yes, if the provider processes personal data of your customers, users or employees on your behalf, which is usually the case with SaaS. Article 28 of the GDPR requires it. The agreement must set out the subject matter, duration, nature and purpose of the processing, security measures, sub-processors and what happens to the data at the end.

What is an SLA and what should it measure?

It is the service level agreement. It sets the committed availability, how and with which tool it is measured, incident response and resolution times, excluded maintenance windows and the compensation if it is not met. Without an agreed measurement and consequence, an SLA gives you nothing to claim on.

Which clauses does DORA require if my customer is a financial entity?

Article 30 of Regulation (EU) 2022/2554 (DORA) requires the rights and obligations of the financial entity and the ICT third-party service provider to be set out in writing, with the service level agreements inside the contract. It also sets a minimum content, starting with a clear and complete description of the services and whether subcontracting of those supporting critical or important functions is allowed.

REVIEW YOUR CONTRACT

Request a free initial assessment and receive a review of your SaaS contract, the clauses that are missing and those that expose you, and a drafting proposal.