I recently opened up a contact form for readers if they had any questions about technology vendor management and I received this great question from a reader. It does step into the legal realm of contract management and since I’m not an attorney, please understand that my below response isn’t legal advice, it’s based on years of working with technology vendors and technology contracts.
Unlimited liability for breach of confidentiality: Is it practical to expect SaaS suppliers to accept that risk in this era of very public security breaches?
It’s not unreasonable or impractical to include this type of language in your SaaS (Software as a Service) / Cloud contract. From my experience, including unlimited liability for breach of confidentiality in your vendor’s contract hinges on one thing: your data. What type of data do you want to remain confidential? Is there financial, corporate information, protected health information (PHI), or personally identifiable information (PII) being stored within the SaaS / Cloud product? Where will the confidential data reside? Offshore, onshore, nearshore, offsite, onsite? If it’s a true cloud provider, your data will be sliced and diced on servers across the globe. Do you have the option of a private or hybrid cloud with this vendor? Will there be any vendor resources performing patch / breakfix / maintenance work to the product that will see this confidential data? If so, where are they located and what data would they see as they performed this work?
In addition to the initial research regarding the type of confidential data to be stored, it’s important to perform a complete risk assessment of the project and the vendor’s products in the beginning of the purchasing engagement (preferably in the sourcing phase, not the contracting phase). My most recent post digs more into vendor vetting and it includes a great video from Monte Ratzlaff, Security Manager, at the UC Davis Health System, who elaborates on the issue of vendor risk.
From a contractual standpoint, vendors typically take issue with unlimited liability of any kind. That’s not to say that you can’t add the unlimited liability for breach of confidentiality language in your contract for the first draft and see what the vendor comes back with as far as redlines. Vendor pushback on unlimited liability is to be expected and I would recommend finding a back fence position if they don’t accept it. This back fence position could be anything from including a monetary cap in the contract (i.e. the vendor will pay $1 million related to the breach and then you’re responsible for any fees over the cap) to other remedies that would effectively make your company whole in the case of a breach. If you’re in an industry such as finance or healthcare, a public breach of confidential information could have severe ramifications for your business and if the monetary cap is too low, your company will be picking up the tab for any additional fines past the amount of the initial cap.
Overall, I would say that it’s perfectly reasonable to include unlimited liability for breach of confidentiality in your company’s SaaS / Cloud contracts depending upon the type of confidential data to be stored and your line of business. However, keep in mind that many vendors may take issue with it, and if this is the case, be prepared with a back fence position that will protect your company.