SaaS Agreements in Kenya: Key Legal Considerations for Software Providers and Customers

A Kenyan business subscribes to a cloud-based software platform to manage its operations, relying on the provider's assurances of secure hosting, uninterrupted access and responsive technical support. For several months, the system works as expected. Then an unexpected outage prevents employees from accessing essential business records, bringing critical operations to a standstill.

When the customer contacts the service provider, disagreements arise over how quickly the problem should be resolved, whether the interruption constitutes a contractual breach and what remedies are available. Further examination of the agreement reveals that important matters were never clearly addressed. The contract does not define the promised level of service availability, the applicable technical support hours or the procedures through which the customer can retrieve its data if the relationship ends.

This scenario illustrates a common contractual risk in the growing Software as a Service (SaaS) industry. Although cloud-based software has made sophisticated digital solutions more accessible to Kenyan businesses, the legal arrangements governing these services do not always adequately reflect the technical, commercial and operational realities involved.

From accounting and human resource management platforms to enterprise resource planning systems, customer relationship management tools and specialised industry applications, SaaS solutions are increasingly supporting essential business processes across Kenya's economy. The growing adoption of these technologies creates legal considerations for both software providers and their customers, particularly in relation to service reliability, data protection, intellectual property and contractual liability.

For Kenyan software developers and technology companies, properly structured SaaS agreements are therefore not simply administrative documents. They are essential instruments for defining the service being offered, managing commercial expectations, allocating responsibilities and protecting the interests of the parties.

This article examines the principal legal considerations involved in structuring SaaS agreements in Kenya and explains how software providers and customers can develop contractual arrangements that reflect the practical realities of cloud-based service delivery.

Understand what the customer is buying

The legal structure of a SaaS arrangement differs significantly from that of a traditional software purchase. Rather than acquiring a copy of software for installation and operation on its own infrastructure, the customer ordinarily obtains the right to access and use an application hosted and maintained by the service provider.

The commercial model may involve monthly or annual subscription fees, usage-based charges or a combination of both. Regardless of the pricing arrangement, the customer generally acquires contractual access rights rather than ownership of the underlying software.

This distinction has important implications for how the relationship should be documented.

A SaaS agreement, sometimes accompanied by terms of service, establishes the principal commercial and legal relationship between the parties. It ordinarily addresses matters such as subscription fees, access rights, permitted use, contractual duration, liability and termination. A Service Level Agreement (SLA) provides more detailed commitments concerning system availability, technical support and service performance. Where the provider processes personal data on behalf of the customer, a Data Processing Agreement (DPA) may also be necessary to establish the relevant responsibilities and safeguards.

These documents should operate as a coherent contractual framework. Where separate agreements or schedules are used, the parties should establish how they interact and which provisions take precedence in the event of inconsistency.

Particular attention should be given to the scope of the service being purchased. The agreement should accurately describe the software product, the functionality included in the subscription, the categories of authorised users and any applicable usage limitations.

This is especially important for Kenyan technology companies offering enterprise solutions that require significant implementation work. A customer purchasing an ERP system, for example, may expect the provider to undertake data migration, configure business workflows, customise modules and integrate the platform with existing applications.

However, these services are not necessarily included in an ordinary SaaS subscription.

Unless the parties expressly distinguish between standard subscription services and separately chargeable implementation work, disagreements may arise over the provider's obligations and the customer's expectations.

A well-structured agreement should therefore reflect not only what the software is capable of doing, but also precisely what the provider has undertaken to deliver.

Define access rights and acceptable use

Once the scope of the service has been established, the parties must determine who is permitted to use the software and the conditions governing that use.

A typical SaaS arrangement grants the customer a limited contractual right to access the application for specified purposes during the subscription period. The extent of that right will depend on the nature of the product and the intended customer.

For example, a Kenyan company subscribing to a human resource management platform may require access for employees across several departments or affiliated companies. A professional services firm may need to permit access by consultants or contractors, while a technology reseller may require authority to provide the software to its own customers.

Each arrangement presents different contractual considerations. A license drafted for internal business use may be unsuitable for a reseller relationship, just as restrictions intended for an individual subscriber may be inappropriate for an enterprise customer.

The agreement should accordingly identify the permitted users, authorised purposes and any restrictions necessary to protect the provider's platform, infrastructure and intellectual property.

Such restrictions may address unauthorised resale, unlawful use, interference with system security, attempts to circumvent agreed usage limits and activities that threaten the availability or integrity of the service.

However, restrictions should be proportionate and consistent with the product's intended functionality. A broadly drafted prohibition against accessing or interacting with the software through third-party systems, for instance, could unintentionally prevent legitimate integrations that form part of the customer's normal operations.

The contractual framework must also provide certainty concerning subscription duration and renewal.

Customers should understand when their subscription begins, whether a free trial automatically converts into a paid service, how renewal operates and what procedures apply when they wish to cancel. Where the provider reserves the right to revise pricing or change contractual terms, the applicable notice and acceptance arrangements should be clearly established.

For SaaS products offered through online registration, the provider should maintain reliable records of the terms presented to customers and the manner in which those terms were accepted.

These arrangements are particularly important where the service is sold to customers through a largely automated process, without individual negotiation or execution of a traditional written contract.

Make service levels measurable

Service reliability is often one of the most commercially significant aspects of a SaaS relationship. Customers may depend on the platform for essential activities such as processing transactions, maintaining financial records, managing employees or delivering services to their own clients.

Consequently, a promise of reliable access should be supported by contractual commitments that can be objectively assessed.

An SLA provides the mechanism through which the provider and customer can establish measurable expectations concerning availability, technical support and incident management.

For example, a provider may undertake to maintain 99.9% or 99.99% system availability over a defined measurement period. However, the percentage alone is insufficient unless the agreement explains what constitutes availability, how it will be measured and which interruptions are excluded from the calculation.

The benchmark most often cited as the ideal is “five nines”, or 99.999% availability. In practical terms, this permits only about five minutes of unplanned downtime in an entire year, which is roughly 26 seconds a month. While this figure appears attractive, customers should treat it with caution. Few providers can credibly sustain it, and where it is offered, it is often qualified by broad exclusions (such as scheduled maintenance, third-party outages and force majeure), by a long measurement period that smooths out shorter disruptions, or by remedies limited to modest service credits.

A headline commitment of five nines may therefore deliver far less protection than a lower figure that is clearly defined and properly enforced. For most business users, 99.9% (“three nines”), which allows about 8.76 hours of downtime annually (roughly 43 minutes a month), is a reasonable and realistic standard, with 99.95% or 99.99% appropriate for systems that are critical to operations. Whichever figure is chosen, the customer should confirm that it is backed by a clear definition of availability, transparent monitoring and reporting, and meaningful remedies, such as escalating service credits and a right to terminate for repeated or prolonged failure.

Scheduled maintenance, failures attributable to the customer's own systems and disruptions affecting external infrastructure may require different treatment. The agreement should also identify the monitoring methodology and the source of information used to determine whether the promised availability level has been achieved.

Importantly, a particular uptime percentage is generally a negotiated commercial commitment rather than a universal statutory minimum applicable to all SaaS services in Kenya.

The appropriate commitment should reflect the architecture of the platform, the provider's technical capabilities and the operational importance of the service to the customer.

A software platform supporting non-critical administrative functions may warrant a different service commitment from one facilitating time-sensitive financial transactions or other essential business operations.

Technical support obligations require similar precision.

SaaS agreements frequently promise rapid responses to customer incidents without clearly distinguishing between acknowledging a problem and resolving it. Yet these are separate obligations with potentially different timeframes.

A provider may reasonably commit to acknowledging a critical incident within two hours while requiring additional time to investigate and restore the affected service. If the agreement does not distinguish response times from resolution targets, the customer may interpret the commitment as a guarantee that the problem will be fixed within the stated period.

To avoid such uncertainty, the SLA should establish incident severity categories, support channels, operating hours, escalation procedures and the responsibilities of each party during incident resolution.

The agreement should also address the consequences of repeated or prolonged service failures.

Service credits may provide a commercially workable remedy for certain interruptions by reducing future subscription charges. However, persistent outages or serious failures may justify stronger contractual remedies, including termination rights or other agreed relief.

The parties should establish how service credits are claimed, whether they constitute an exclusive remedy for particular failures and how they interact with other contractual rights.

Ultimately, effective service level provisions should provide a realistic and transparent account of what the provider can deliver and what the customer can expect when the service does not perform as promised.

Allocate liability against the actual exposure

The allocation of legal and financial risk is another important aspect of SaaS contracting.

Because subscription-based software services may support business activities of considerable value, the financial consequences of a service failure can extend far beyond the fees paid for access to the platform.

A customer paying a relatively modest monthly subscription may nevertheless depend on the software for critical financial, operational or commercial processes. An extended interruption, security incident or loss of important records could therefore result in losses significantly exceeding the subscription charges.

For SaaS providers, accepting unlimited responsibility for every potential consequence of a service failure may create substantial commercial exposure. Customers, on the other hand, have a legitimate interest in ensuring that the agreement provides meaningful protection against foreseeable risks.

Liability provisions should seek to address these competing interests through an allocation of risk appropriate to the service and the circumstances of the parties.

One approach involves establishing a contractual liability cap linked to subscription fees paid during a specified period, such as the preceding twelve months. Other arrangements may use a fixed monetary ceiling or different limits for particular categories of claims.

No single approach is appropriate for every SaaS business.

The suitability of a liability cap depends on factors such as the value of the contract, the nature of the service, the potential consequences of failure and the parties' respective ability to prevent or manage the relevant risks.

Particular consideration should be given to claims involving confidentiality, personal-data protection, intellectual-property infringement and other matters that may warrant separate treatment.

Indemnity provisions and insurance arrangements should also be considered within the broader contractual risk allocation.

Under Kenyan law, the effectiveness of limitation and exclusion clauses depends on the applicable legal framework, the wording of the agreement and the circumstances in which the provisions are invoked. Parties should therefore avoid assuming that a broadly drafted disclaimer will necessarily exclude every form of liability.

Force majeure provisions similarly require careful consideration.

Although a major cyberattack or infrastructure disruption may interfere with service delivery, the occurrence of such an event does not automatically excuse contractual non-performance. The relevant question will depend on the contractual definition of force majeure, the circumstances causing the interruption and the steps the provider was required to take to prevent, respond to or mitigate the incident.

For SaaS businesses, these provisions should reflect the technical dependencies and operational risks that can reasonably affect delivery of the service.

Deal with customer data in practical terms

Data is central to most SaaS arrangements. Customers may use cloud platforms to store employee records, financial information, client details, business transactions, operational documents and other commercially sensitive material.

This makes the treatment of customer data both a contractual and regulatory concern.

The agreement should clearly establish the parties' respective rights concerning information uploaded to, generated through or otherwise processed by the platform. It should distinguish between the customer's business data, personal data, the provider's proprietary software and any information generated through analytics or other platform functionality.

A general declaration that the customer owns its data may be useful, but it does not, by itself, resolve every issue concerning access, processing rights, confidentiality or statutory data-protection obligations.

The parties must also consider how information moves through the service.

A SaaS provider may operate servers in one country, maintain backups in another and rely on technical support personnel or subcontractors located elsewhere. These arrangements can have legal implications, particularly where personal data is transferred across national borders.

For businesses operating in Kenya, the Data Protection Act, 2019, and the Data Protection (General) Regulations, 2021, establish important obligations concerning personal-data processing.

The application of these requirements depends on the nature of the processing and the roles performed by the respective parties.

In many SaaS arrangements, the customer determines the purposes and essential means of processing personal data, while the provider processes that information on the customer's behalf. In such circumstances, the customer may act as a data controller and the SaaS provider as a data processor.

However, these classifications arise from the actual processing activities rather than the labels adopted in the agreement. A provider may also act as a controller in relation to certain processing activities undertaken for its own purposes.

Where the provider acts as a processor, the contractual arrangements should address matters such as documented processing instructions, confidentiality, security safeguards, engagement of subprocessors and assistance with applicable data-subject rights.

The parties should also examine the safeguards required for any transfers of personal data outside Kenya.

These considerations become particularly significant when SaaS providers seek to use customer information for purposes beyond delivering the contracted service.

For instance, a provider may wish to analyse customer information to improve its product or use submitted content to train or enhance AI functionality. Such activities should not automatically be treated as authorised merely because the customer uses the platform.

The provider must assess the legal basis, contractual permissions and applicable restrictions governing each proposed use.

Data security commitments should likewise be sufficiently specific to enable meaningful assessment.

Depending on the nature of the platform, these may include access controls, encryption, vulnerability management, backup procedures, incident response arrangements and controls governing administrator or subcontractor access.

References to recognised standards and assurance frameworks may support these commitments, but their meaning should be properly understood. ISO/IEC 27001 concerns information-security management systems, while SOC 2 relates to independent assurance reporting on relevant organisational controls. The General Data Protection Regulation (GDPR), by contrast, is legislation that applies where its jurisdictional and substantive requirements are satisfied.

These concepts should not be treated as interchangeable certifications of security or legal compliance.

The agreement should also establish procedures for handling personal-data breaches and other security incidents. In particular, the parties should identify appropriate reporting contacts, specify how information will be shared and require timely cooperation in investigating incidents and preserving relevant evidence.

Contractual notification periods must be designed with applicable statutory obligations in mind. Under Kenya's data-protection framework, notification duties and timelines may differ according to the nature of the incident and whether a party is acting as a controller or processor.

A properly structured SaaS agreement should enable both parties to fulfil their respective legal obligations rather than creating contractual procedures that make compliance more difficult.

Plan for termination and data return

The ability to exit a SaaS arrangement is often overlooked during contract negotiations, particularly where both parties expect a long-term commercial relationship.

However, the consequences of termination can be substantial where a customer has accumulated significant quantities of operational data or integrated the platform into essential business processes.

A Kenyan company using a cloud-based accounting or ERP platform, for example, may need to transfer several years of transaction records, customer information and financial reports to another system if the subscription ends.

Without appropriate contractual arrangements, that process can become difficult, expensive or commercially disruptive.

SaaS agreements should therefore address data retrieval and migration before the customer begins using the service.

The parties should establish the formats in which customer information will be made available, the period during which it can be retrieved following termination and the extent of assistance the provider will offer during migration.

Where additional fees apply to data extraction or migration support, these should be disclosed and agreed in advance.

The practical usability of exported information is particularly important. A contractual promise to provide customer data may have limited value where the information is supplied in a format that cannot reasonably be imported into another system or used for the customer's ordinary business purposes.

Providers and enterprise customers should therefore consider testing data-export functionality during implementation or as part of periodic operational reviews.

Termination provisions should also address the deletion and retention of information.

The provider may be required to delete live customer data after an agreed period, while certain backup copies may remain temporarily subject to established backup-retention cycles. In other circumstances, particular records may need to be retained to comply with applicable legal obligations.

The agreement should accurately explain these arrangements and ensure that any information retained after termination remains subject to appropriate restrictions.

Similar care is required when drafting suspension rights.

A provider may have legitimate reasons to suspend access, including prolonged non-payment, serious misuse of the platform or an urgent security threat. Nevertheless, suspension can have significant consequences where the customer depends on the software for essential operations.

The agreement should therefore distinguish between circumstances requiring immediate intervention and those where prior notice or an opportunity to remedy the issue would be appropriate.

For example, an active security incident threatening the integrity of the platform may justify urgent protective measures, whereas routine billing disputes may warrant notice and a reasonable opportunity for resolution.

Where practicable, the parties should also consider how essential records may be retrieved during suspension.

Clear exit and suspension procedures reduce the likelihood of disputes and help ensure that the conclusion or interruption of the contractual relationship does not unnecessarily compromise the customer's legitimate business interests.

Check the company's intellectual-property position

For Kenyan software developers and SaaS companies, the ability to commercialise a software product depends significantly on the intellectual-property rights held in that product.

Before granting customers licenses to access and use an application, the provider should establish that it possesses the rights necessary to offer the service and fulfil its contractual commitments.

This requires particular attention where the software has been developed through contributions from employees, independent contractors, consultants or external software development companies.

A startup may, for example, engage freelance developers to build different components of its application while assuming that payment for the development work automatically gives the company unrestricted ownership of the resulting code.

Such assumptions can create significant legal uncertainty.

Kenya's Copyright Act, 2001, provides the principal statutory framework governing copyright protection in software and other qualifying works. Questions concerning first ownership, commissioned works, employment-related creations and the transfer of rights should be assessed in light of the applicable statutory provisions and the agreements between the parties.

The provider's development and consultancy contracts should therefore clearly address ownership of newly created software, rights in pre-existing components, permitted reuse of code and any intellectual-property assignments or licenses required to support the business.

Parties should also consider the applicable formal requirements governing copyright assignments and exclusive licenses.

Terminology borrowed from foreign contractual templates should be approached cautiously. A provision describing commissioned software as a "work for hire", for example, does not eliminate the need to examine how ownership is determined under Kenyan law.

Intellectual-property due diligence should extend to third-party and open-source software components.

Many SaaS products incorporate open-source frameworks, libraries and other dependencies. These technologies can provide substantial commercial and development benefits, but their use remains subject to the terms of the applicable licenses.

A company should understand whether those licenses impose obligations concerning attribution, redistribution, access to source code or other conditions relevant to its chosen commercial model.

This is particularly important where the provider intends to promise exclusive rights to customers or distribute software components as part of the service.

The company's branding also deserves attention.

A SaaS product may become commercially recognised through its name, logo and other distinguishing features. Conducting appropriate trade mark searches and considering registration through the Kenya Industrial Property Institute (KIPI) can help the business assess the availability and protection of its brand.

A sound intellectual-property position supports not only customer contracting but also investment readiness, business valuation, partnerships and long-term commercial growth.

Keep commercial terms workable

Even a technically sophisticated SaaS agreement may create difficulties if its commercial provisions are unclear or inconsistent with the provider's actual billing and service-delivery processes.

Subscription fees, payment intervals, usage-based charges, implementation costs and applicable taxes should be stated in a manner that customers can readily understand.

For SaaS providers operating in Kenya, particular attention should be given to the treatment of applicable taxes and the manner in which charges are presented, invoiced and collected. Where relevant, the business should obtain appropriate tax advice concerning its commercial model, including transactions involving customers or service providers outside Kenya.

The agreement should also explain how pricing changes are implemented, whether customers are entitled to notice before renewal and what consequences follow from late payment or cancellation.

Where the provider offers different subscription tiers, the contractual documentation should accurately describe the features and services included in each package.

For example, a customer purchasing a standard subscription should be able to distinguish the technical support available under that package from the additional services offered under a premium support arrangement.

Differences in support hours, communication channels, response targets or dedicated account management should be clearly documented rather than left to marketing descriptions.

The same principle applies to implementation and customisation services. Where these are offered separately, the provider should establish the applicable scope, deliverables, pricing, acceptance procedures and responsibilities of each party.

Importantly, contractual terms must remain aligned with the actual service being provided.

As SaaS products evolve, new features may be introduced, third-party integrations added or hosting and processing arrangements changed. These developments may affect the original allocation of responsibilities and the assumptions underlying the contract.

Providers should therefore review their contractual documentation periodically to ensure that it continues to describe the product accurately and reflects the legal and operational implications of material changes.

For Kenyan technology companies, this approach is particularly important as businesses expand from serving a small local customer base to supplying enterprise clients or operating across multiple jurisdictions.

A contractual structure that is adequate for a basic subscription service may require substantial refinement when the platform begins processing sensitive information, supporting business-critical operations or serving customers subject to more demanding regulatory requirements.

Ultimately, a well-drafted SaaS agreement should reflect the relationship the parties are actually entering into. It should identify the service being supplied, establish realistic performance obligations, allocate risks appropriately and provide workable procedures for dealing with the problems that may arise during the contractual relationship.

For software providers, these arrangements contribute to commercial certainty, customer confidence and sustainable business growth. For customers, they provide a clearer understanding of the service being purchased, the protections available and the consequences of interruptions, failures or termination.

As Kenya's software industry continues to expand, SaaS contracting should increasingly be recognised as an essential component of responsible technology commercialisation.

A good SaaS agreement does more than protect the parties when something goes wrong. It establishes the expectations, responsibilities and safeguards that allow the commercial relationship to function effectively from the outset.

Our technology-law practice advises Kenyan software developers, SaaS providers, technology startups and enterprise customers on software licensing, SaaS agreements, service level commitments, data protection, intellectual-property ownership and technology-related contractual risk.

Contact our firm to discuss the legal arrangements appropriate for your software product, SaaS business or proposed technology procurement.

Legal sources

The following Kenyan legal and regulatory resources provide an important foundation for understanding the issues addressed in this article:

Copyright Act, 2001: Governs copyright protection, ownership, assignment and licensing of qualifying works, including computer programs.

Data Protection Act, 2019: Establishes the principal statutory framework governing personal-data processing in Kenya, including the obligations of data controllers and processors.

Data Protection (General) Regulations, 2021: Provide further requirements concerning lawful processing, contractual arrangements, security and transfers of personal data.

Constitution of Kenya, 2010: Particularly Article 31, which protects the right to privacy.

Kenya Information and Communications Act (Cap. 411A): Provides part of the wider statutory framework for electronic communications and relevant electronic transactions in Kenya.

Law of Contract Act (Cap. 23): Forms part of the legal framework relevant to contractual relationships and enforceability in Kenya.

Trade Marks Act (Cap. 506): Governs the registration and protection of trade marks in Kenya.

Kenya Industrial Property Institute (KIPI): Provides information and services relating to trade mark registration and other forms of industrial-property protection.

Office of the Data Protection Commissioner (ODPC): Publishes regulatory guidance and resources relevant to the protection and processing of personal data.