A software subscription can be bought in a few clicks, but the contract behind it decides who owns the data, who is responsible when the service fails, and what happens at renewal or exit. Kenyan businesses now rely on hosted platforms for accounting, payroll and customer records, and vendor terms are often drafted for a global market rather than for Kenyan law. This article explains which clauses deserve attention before signature or renewal.
Quick answer
A software or SaaS agreement is a contract first. The Law of Contract Act (Cap 23) and the general law of contract supply the framework, and the Data Protection Act 2019 adds obligations where the platform processes personal data. The clauses that cause most difficulty are licence scope, data terms, service levels, liability caps and exit mechanics. Read the agreement as a whole, and check which document prevails on conflict.
What governs a software or SaaS contract in Kenya
Software licensing and hosted services are commercial contracts. The ordinary requirements apply: offer, acceptance, consideration, an intention to create legal relations, capacity and a lawful purpose. The Law of Contract Act (Cap 23) and the general law govern formation, interpretation and remedies, and the firm’s contract practice reviews agreements against those rules.
Where a contract is accepted online, the question is whether the terms were available before acceptance and whether the customer agreed to them. Keep a record of the version accepted. Disputes often turn on which document prevails, so the agreement should set an order of precedence between the order form, the terms of service and any data processing agreement.
Within that framework, the licence clause should describe the product, the permitted users and the permitted purposes. Ask who may use the service: named individuals, all employees, affiliates, contractors or advisers. User numbers matter, because growth can turn ordinary use into a breach.
Restrictions on copying, modification and reverse engineering should be read against what the customer actually needs, including integration and data extraction. Where the service includes third-party or open-source components, the contract should identify the terms that apply to them. A clause allowing the vendor to change functionality without notice deserves scrutiny where the customer depends on particular features, interfaces or reports.
Personal data: controller and processor roles
Where the platform processes personal data, the Data Protection Act 2019 applies whatever the commercial terms say. In most business subscriptions the customer is the data controller because it decides why and how the data is processed, and the vendor is the data processor acting on the customer’s instructions. That allocation should be written into a data processing agreement attached to the main contract.
A workable processing agreement covers the purpose and scope of processing, security measures, sub-processors, assistance with data subject requests, breach notification to the controller, cross-border transfers, audit rights, and return or deletion of data at the end. Some controllers and processors must register with the Office of the Data Protection Commissioner. A term allowing the vendor to use customer data for its own product development or marketing should be negotiated, not accepted as standard. The firm’s ICT and data privacy practice advises on these arrangements, and the related article on data controllers and data processors explains the roles.
Service levels, support and remedies
A service level clause should define availability, how it is measured, and what is excluded. Planned maintenance, third-party outages and customer-side failures are commonly excluded. Support terms should say which channels are available, during which hours, and with what response targets, distinguishing a target from a contractual commitment.
Where the contract offers service credits, check whether the credit is the customer’s only remedy for missed availability. For a platform that supports payroll or customer records, a small credit may not reflect the operational loss. Business continuity, disaster recovery and backup terms belong in the same review.
Liability, indemnities and insurance
Vendor terms usually cap liability, often at the fees paid in a defined period, and exclude indirect or consequential loss. The review should test whether the cap is adequate for the customer’s exposure and which risks are carved out. Confidentiality breaches, intellectual property infringement and data incidents are common carve-outs.
A liability cap does not necessarily limit regulatory exposure under the Data Protection Act 2019, and a contractual clause cannot override the law. Indemnities should be mutual where the risk is mutual. It is reasonable to ask whether the vendor carries insurance that matches the service it provides.
Exit, data portability and deletion
Exit terms are cheapest to negotiate before the subscription starts. They should cover notice, the data export format, transition assistance, deletion of customer data and confirmation of deletion. A customer that stores regulated or critical data should test an export during the term, not on the last day, and should keep an independent backup where the vendor hosts the only copy of its records.
Dispute resolution and governing law
Foreign governing law and a distant forum can make enforcement expensive for a Kenyan customer. Read the dispute clause with the value and strategic importance of the contract in mind, and where arbitration is chosen the drafting deserves the same attention as the price. The article on drafting an arbitration clause in Kenya sets out the choices, and the article on remedies for breach of contract explains what a claim can achieve.
Cost considerations and when to take advice
The visible cost is the subscription fee. The relevant cost includes implementation, integration, training, support upgrades and the cost of leaving. Legal review before signature is usually modest against the value of a multi-year platform contract. Once a dispute has arisen, cost depends on the value in issue, the evidence and whether the matter goes to arbitration or court, so a structured review early is normally the cheaper path.
Advice is worth taking where the platform supports core operations, where personal data is processed at scale, where the customer is regulated, where the contract is high value or multi-year, where the vendor insists on foreign law, or where termination or a dispute is threatened. The firm’s ICT, data protection and AI practice handles these reviews alongside the contract practice.
Checklist before signing or renewing
- Confirm which documents form the contract and which prevails on conflict.
- Record how the customer accepted the terms and which version applied.
- Check licence scope, permitted users, affiliates and third-party components.
- Read the data processing terms against the Data Protection Act 2019.
- Test the service levels and the remedy for missed availability.
- Assess the liability cap, carve-outs, indemnities and insurance against the customer’s exposure.
- Agree the export format, transition assistance and deletion confirmation before the term begins.
- Review governing law and the dispute route against the value and length of the contract.
Primary sources
- Law of Contract Act (Cap 23), Kenya Law, for the framework of contract in Kenya.
- Data Protection Act 2019, Kenya Law, for controller and processor obligations and data subject rights.
- Office of the Data Protection Commissioner, for guidance, breach reporting and the register of data handlers.
This article is general information, not legal advice.
