What is a cloud services agreement?
Is a cloud services agreement legally binding in South Africa — signed or clickwrap?
“An agreement is not without legal force and effect merely because it was concluded partly or in whole by means of data messages.”
“It is apparent that the Act distinguishes between instances where the law requires a signature and those in which the parties to a transaction impose this obligation upon themselves.”
“The fact, nature and effect of the provision or notice contemplated in subsection (1) must be drawn to the attention of the consumer— (a) in a conspicuous manner and form that is likely to attract the attention of an ordinarily alert consumer, having regard to the circumstances”
“On 4 February 2019, the threshold set by the Minister was R2 million. It is common cause that DDL had an asset value or annual turnover of R2 million or more and is thus, in terms of the CPA, a large juristic person to which the CPA does not apply.”
“A responsible party must, in terms of a written contract between the responsible party and the operator, ensure that the operator which processes personal information for the responsible party establishes and maintains the security measures referred to in section 19.”
When you need a Cloud Services Agreement
- When you launch a SaaS or cloud product and want every self-service customer to accept the same terms with a click at sign-up — the clickwrap form.
- When an enterprise, bank, insurer or public-sector customer wants to negotiate, runs a procurement or security review, or asks for its own terms on data location, audit and service levels — the signed form.
- When a customer outgrows self-service — a larger contract, more users, or a request to change your standard terms — and you need to move it onto a signed agreement without changing your whole legal position.
- When your business is the customer and a provider’s agreement will run a critical system or hold your clients’ personal information, so the terms on data location, security, service levels and exit must be checked before you sign or click.
- When the service will process personal information for your customers, so POPIA section 21 requires a written operator contract — a Data Protection Addendum — which should be in place before processing starts.
- When customer data will be hosted, backed up or supported from outside South Africa, so the transfer must meet one of the grounds in POPIA section 72.
What a Cloud Services Agreement should contain
How it is concluded, and the order of precedence
Say how the agreement is made binding. For the signed version, use a signature block that names the e-signature method. For the clickwrap, use an acceptance step the customer cannot skip, and keep a record of who accepted which version and when. Then list every document that forms part of the agreement — order form or cover page, general terms, Data Protection Addendum, SLA, security schedule — and rank them. Price, users and term usually sit in the order form. Negotiated changes to the legal terms belong in a clearly marked special-terms section, where they can be seen. The DPA wins on anything about personal information.
Subscription right, permitted use and fees
Grant a limited, non-exclusive, non-transferable right to use the service for the term, tied to the plan, users or usage paid for. It is a subscription, not a sale and not a perpetual licence, and it ends when the subscription ends. Set the fees, billing cycle and payment terms, and say how prices may rise on renewal — a cap or a CPI link is common. Record whether the agreement renews automatically and how much notice stops it. For customers within the CPA, renewal and price-increase terms must be fair and clearly disclosed up front.
Customer data, intellectual property and the Data Protection Addendum
Confirm that the provider owns the platform and the customer owns its data, with the provider holding only the rights it needs to run the service. Where the provider processes personal information for the customer it is a POPIA operator. Section 20 allows it to process only with the customer’s knowledge or authorisation and requires it to keep the information confidential; section 21 requires a written contract on security. Put those operator terms — instructions, security, breach notice, sub-processors, return and deletion — in a Data Protection Addendum, and say whether the provider may use anonymised or aggregated data.
Data location and transfers outside South Africa
Name the regions where customer data is stored, backed up and supported, and require the customer’s consent before that changes. POPIA section 72 allows personal information to go to a third party in a foreign country only on listed grounds — most often that the recipient is bound by a law, binding corporate rules or a binding agreement giving an adequate level of protection, including limits on onward transfers. Hosting in a South African region narrows the question but does not close it, because support access, backups and sub-processors can still move data offshore. Sending special personal information or children’s information to a country without adequate protection needs the Information Regulator’s prior authorisation (section 57(1)(d)).
Security schedule, sub-processors and audit rights
Attach a security schedule describing the provider’s technical and organisational measures — access control, encryption, testing and incident response — and promise they will not be materially reduced during the term. POPIA section 19 requires appropriate, reasonable measures that are regularly verified and updated, and section 21(2) requires the operator to notify the customer immediately where there are reasonable grounds to believe personal information was accessed or acquired by an unauthorised person. List the sub-processors, give notice before adding one, and give the customer a right to object. Give audit rights: usually independent reports such as ISO 27001 or SOC 2 first, with a direct audit where those are not enough.
Service levels, service credits and support
An SLA sets a measurable availability target, how it is measured, and what counts as excluded downtime, such as planned maintenance or faults on the customer’s side. The usual remedy for a missed target is a service credit — a rebate against the next invoice — with a right to terminate if targets are missed repeatedly. Support terms set hours, severity levels and response times. In a clickwrap these are usually published policies. In the signed version they are negotiated and attached to the agreement itself, not left at a web link the provider can update.
Liability cap, exclusions and carve-outs
Most agreements exclude indirect and consequential loss and cap each party’s total liability, often at the fees paid over the previous 12 months. Negotiated deals commonly add a separate, higher cap for data-protection and confidentiality breaches, and leave some liability outside the cap, such as fraud and wilful misconduct. Exemption and limitation clauses are valid in principle, but courts read them restrictively and resolve doubt against the party relying on them, so the wording must be clear. Against a CPA consumer, the cap must be drawn to the customer’s attention under section 49, and no term may exclude liability for gross negligence (section 51(1)(c)(i)).
Term, termination, exit and transition assistance
Set the initial term, renewal and termination rights: for material breach after a cure period, for insolvency, and — if negotiated — for convenience on notice. On exit, give the customer a defined window to export its data in a usable, machine-readable format, then require deletion and written confirmation. Thirty to 90 days is common; for a business-critical system, negotiate at least 60. For a signed enterprise deal, add transition assistance — help moving to a new provider — at rates agreed up front. POPIA section 14(4) requires personal information to be destroyed, deleted or de-identified as soon as reasonably practicable once it may no longer be kept.
Signed cloud services agreement vs clickwrap cloud services agreement
| Feature | Signed (negotiated) agreement | Clickwrap agreement |
|---|---|---|
| How it is concluded | Signed in ink or by e-signature; ECTA s 13(3) accepts any reliable method that identifies the signer, because the parties — not a statute — require the signature | Customer clicks "I agree"; ECTA ss 22 and 24 give the click legal effect if the terms were noticeable and accessible (s 11(3)) |
| Typical customer | Enterprise, regulated, public-sector or high-value customers | Many small and mid-market customers signing up online |
| Negotiation | Marked up by both sides; deal-specific changes recorded as special terms | None — the same standard terms for every customer |
| Commercial terms | Order form or cover page per customer: price, users, term, escalation | Published plans and prices accepted at sign-up |
| Security, data location and audit | Negotiated schedules: named regions, security measures, sub-processor notice and objection, audit rights | Published security and sub-processor documents, usually with notice of changes |
| Service levels | SLA attached to the signed agreement, with service credits and an exit for repeated failure | Published SLA or support policy, if one is offered |
| Changing the terms | Only by a signed amendment | Provider can usually update on notice; a fair clause gives advance notice and lets the customer leave if it objects |
| CPA exposure | Lower — most customers are juristic persons at or above the R2 million threshold | Higher — natural persons and small businesses below the threshold are likely, so the s 49 notice duty and s 51 limits apply |
Common South African pitfalls
- Clickwrap terms the customer could not properly see: ECTA section 11(3) incorporates linked terms only if a reasonable person would notice the reference and the terms can be read, stored and retrieved, and section 20(d) does not bind a customer to terms it could not review before signing up. A buried footer link, or a "continue" button that never mentions the terms, weakens the whole agreement.
- Signing without saying how: in Global & Local Investments Advisors v Fouché the Supreme Court of Appeal held that where a mandate required the client’s signature and said nothing about an electronic signature, a signature in the ordinary handwritten sense was needed, and an email ending in the client’s typed name — in fact sent by fraudsters — did not qualify. In Spring Forest the same court held that typed names at the foot of emails satisfied a clause requiring cancellation in signed writing. The signed version should say it may be signed electronically, name the method, and state whether an exchange of emails can amend it.
- Treating every customer as a large business: the CPA’s size test removes only a juristic person whose asset value or annual turnover equals or exceeds the R2 million threshold, so a sole proprietor or a small company is usually covered. Record each customer’s status, and remember that it is tested at the time of each transaction, not once at sign-up.
- Liability limits hidden in the fine print: against a CPA consumer, section 49 requires caps, risk terms and indemnities to be drawn to the customer’s attention conspicuously and in plain language before contracting, and section 51(1)(c)(i) voids any exclusion of liability for gross negligence. At common law too, the Supreme Court of Appeal held in Mercurius Motors v Lopez that an exemption clause undermining the essence of the contract must be clearly and pertinently brought to the customer’s attention — a provider excluding all liability for losing customer data in small print risks the same result.
- Assuming South African hosting settles data sovereignty: choosing a local region narrows the POPIA section 72 question but does not close it. Support staff, backups, disaster-recovery copies and sub-processors can still move data offshore. Pin the regions in the contract, not only in the provider’s console, and require notice before anything changes.
- No exit plan: an agreement that ends access without an export window, a usable export format, transition help and a deletion commitment leaves the customer locked in and its data in limbo. Agree the exit before you sign, while you still have leverage.
Frequently asked questions
Is a cloud services agreement legally binding in South Africa?
Yes, whether it is signed or accepted with a click. Section 22(1) of the Electronic Communications and Transactions Act 25 of 2002 says an agreement does not lose legal force merely because it was concluded by data messages, and section 24 gives the same protection to an expression of intent such as clicking "I agree". The ordinary requirements of contract still apply, and a clickwrap’s terms must be put in front of the customer before it accepts.
Should I use a signed cloud services agreement or a clickwrap?
Use the clickwrap for many self-service customers who accept the same standard terms at sign-up. Use the signed, negotiated version for enterprise, regulated or high-value customers who want to negotiate price, data location, security, audit rights or service levels. Many providers run both, with the same commercial structure, and move a customer onto the signed version when the deal justifies it.
Can a cloud services agreement be signed electronically?
Yes. Because the parties, not a statute, require the signature, section 13(3) of ECTA applies: any method that identifies the signer and shows their approval, and is as reliable as is appropriate in the circumstances, will do. The accredited advanced electronic signature in section 13(1) is not needed — the Supreme Court of Appeal confirmed this distinction in Spring Forest Trading v Wilberry. The agreement should still say that it may be signed electronically and name the platform.
Is a cloud services agreement the same as a master service agreement (MSA)?
No. A master service agreement is a framework for project work — development, consulting or professional services — with each project issued under its own statement of work. A cloud services agreement gives a customer subscription access to a hosted service. Many providers call the signed enterprise version a master subscription agreement, but its subject is access to a service, not delivery of projects.
Does the Consumer Protection Act apply to my cloud customers?
It can. The CPA does not apply where the customer is a juristic person whose asset value or annual turnover, at the time of the transaction, equals or exceeds the threshold set by the Minister — R2 million (section 5(2)(b) read with section 6). It does protect natural persons and smaller companies. For them, sections 48 to 52 on unfair terms apply, including the section 49 notice duty and the section 51 bar on excluding liability for gross negligence.
Can I limit my liability in a cloud services agreement?
Yes. A liability cap and an exclusion of indirect loss are valid in principle, but courts read them restrictively and resolve doubt against the party relying on them, so the wording must be clear. Where the customer is a CPA consumer, the cap must be drawn to its attention conspicuously and in plain language before it contracts (section 49), and no clause may exclude liability for loss caused by gross negligence (section 51(1)(c)(i)).
Can our data be stored outside South Africa?
Yes, if POPIA section 72 is satisfied — most often because the recipient is bound by a law, binding corporate rules or a binding agreement giving an adequate level of protection, including limits on onward transfers. A South African region reduces transfers, but support access, backups and sub-processors can still send data offshore, so the agreement should name the regions and require notice before they change. Special personal information and children’s information need the Information Regulator’s prior authorisation before going to a country without adequate protection.
What happens to our data when the agreement ends?
The agreement should give the customer a defined period to export its data in a usable format, then require the provider to delete it and confirm that in writing. For a business-critical system, negotiate at least 60 days and transition assistance at agreed rates. POPIA section 14(4) requires personal information to be destroyed, deleted or de-identified as soon as reasonably practicable once it may no longer be kept.
Sources & authority
- Electronic Communications and Transactions Act 25 of 2002 (ECTA), ss 11, 13, 20, 22 and 24
- Consumer Protection Act 68 of 2008 (CPA), ss 5(2)(b), 6, 48, 49, 51 and 52
- Protection of Personal Information Act 4 of 2013 (POPIA), ss 1, 14, 19–21, 57 and 72
- Dr Darren Levin Inc v Promenade Centre (Pty) Ltd [2026] ZASCA 70
- Spring Forest Trading 599 CC v Wilberry (Pty) Ltd [2014] ZASCA 178
- Global & Local Investments Advisors (Pty) Ltd v Fouché [2020] ZASCA 8
- Mercurius Motors v Lopez [2008] ZASCA 22
- Afrox Healthcare Bpk v Strydom [2002] ZASCA 73
- Tourvest Holdings (Pty) Ltd v Murti [2026] ZASCA 8
This guide is general information, not legal advice. It reflects the law as at October 2026.