The indemnity clause in a SaaS agreement under India law

Standard Position

In Indian SaaS agreements, the indemnity clause typically requires the service provider to defend and compensate the customer against third-party claims arising from infringement of intellectual property rights, breaches of applicable law, or negligence by the provider. Most vendors offer a capped indemnity (often at 12 months' fees or a fixed amount) and exclude claims arising from customer misuse, modifications, or combination with non-provider systems. Customers, conversely, often indemnify providers against claims related to customer-supplied data, content, or instructions. The indemnity is commonly mutual and tiered by risk category.

Legal Basis

Indian contract law recognizes indemnity under Sections 124 to 130 of the Indian Contract Act, 1872. Section 124 defines indemnity as a contract by which one party (indemnifier) agrees to save the other party (indemnified) harmless from loss or damage caused by the indemnifier's own acts or default, or sometimes by the acts of third parties. Indemnity is enforceable provided it is not contrary to public policy (Section 23) or statute. Courts have held in cases such as New India Assurance Co. Ltd. v. Mankaramka Enterprises that indemnity clauses must be clear and specific; ambiguity is construed against the indemnifier. Additionally, the Information Technology Act, 2000, Section 72, imposes statutory liability for breach of confidentiality; indemnities must not be drafted to circumvent this. Goods and Services Tax (GST) can apply to indemnity payments; parties should clarify whether amounts are inclusive or exclusive of tax.

Drafting and Negotiation

Providers should clarify the scope: use "third-party intellectual property infringement claims" rather than the broader "any claim." Define excluded risks explicitly, such as claims arising from customer modifications, use outside permitted territory, combination with non-provider components, or compliance with customer specifications. Set a clear cap, ideally capped at annual fees paid or a specific amount (e.g., INR 50 lakh for mid-market deals). Include a notice and cooperation procedure: require the customer to notify the provider within a reasonable timeframe (e.g., 15 days) and allow the provider control of defence. Many deals also include a "sole remedy" carve-out: if the provider can obtain rights for the customer or modify the offering to avoid infringement at no material extra cost, the provider may do so instead of indemnifying.

Customers should push back on absolute liability. Seek indemnity from the provider for statutory breaches (e.g., data protection violations under the Digital Personal Data Protection Act, 2023) and negligence. Negotiate a lower threshold for notice (e.g., 10 days) and ensure the customer can participate in or approve settlement. Consider a tiered cap: higher for IP infringement, lower for other categories. Request that the provider waive the cap for breaches of confidentiality or data security.

Common Pitfalls

First, many clauses fail to distinguish between third-party claims and contractual breaches; indemnity typically covers third-party claims, not direct disputes between the parties. Second, vague scope ("indemnify against all losses") invites costly litigation over what is covered; be specific. Third, unreasonably low or no cap can render the clause uninsurable and unacceptable to vendors. Fourth, omitting notice provisions weakens the indemnifier's ability to defend and can bar the claim under estoppel principles in Indian law. Fifth, failing to address GST or other taxes can create disputes over the net amount paid. Finally, many clauses ignore the statutory framework: indemnity for illegal acts may be unenforceable under Section 23.

Sample language

Provider shall indemnify, defend, and hold harmless Customer against third-party claims that Customer's authorized use of the SaaS Services infringes any patent, copyright, or trade secret, provided Customer (a) promptly notifies Provider in writing of the claim, (b) grants Provider sole control of the defence and settlement, and (c) cooperates in the defence. Provider's obligations are conditioned on claims not arising from Customer's modification, misuse, or combination of the Services with non-Provider products. Provider's total liability under this indemnity shall not exceed the fees paid by Customer in the 12 months preceding the claim.

This is general drafting guidance, not legal advice, and not a substitute for advice on your specific facts and jurisdiction. Sample language is a starting point to adapt, not a finished clause.