Cloud Services Agreement
Template — South Africa
An attorney-drafted Cloud Services Agreement template designed specifically for South African businesses providing or consuming cloud-based services. This comprehensive, legally compliant document governs SaaS, PaaS, and IaaS service delivery — covering service level agreements, uptime guarantees, data handling, POPIA operator obligations, security requirements, disaster recovery, and liability limitations under the Electronic Communications and Transactions Act 25 of 2002, the Protection of Personal Information Act 4 of 2013, and the Consumer Protection Act 68 of 2008.
Drafted by qualified South African attorneys
Reviewed for compliance with current legislation · Last updated April 2026
Why Your Business Needs This Agreement
Data Trapped with a Provider After Termination
One of the most common disputes in South African cloud services arises when a customer terminates their agreement but cannot extract their data. Without contractually defined data export periods, format requirements, and post-termination access rights, the customer is entirely at the provider's mercy. Some providers charge exorbitant "data extraction fees" or delay the process indefinitely, effectively holding the customer's data hostage. Under POPIA, the customer's data must be returned or deleted on termination, but without specific contractual mechanisms, enforcing this right is slow and expensive.
No Meaningful Remedy for Chronic Downtime
Without a Cloud Services Agreement that defines measurable SLA targets and automatic service credit mechanisms, customers who experience chronic downtime have no practical remedy short of litigation. Generic "best efforts" availability commitments are meaningless — they give the provider an easy defence against any claim. A CSA with specific uptime percentages, defined measurement methodologies, and automatic service credits provides immediate, proportionate financial remedies without the cost and delay of legal proceedings.
POPIA Non-Compliance Exposing Both Parties to Penalties
Many cloud service relationships in South Africa operate without the written operator agreement that POPIA Section 21 requires. This exposes both the responsible party (customer) and the operator (provider) to enforcement action by the Information Regulator. The responsible party faces penalties for failing to ensure their operator is contractually bound, while the operator faces penalties for processing personal information without proper authorisation. Administrative fines under POPIA can reach R10 million, and affected data subjects can bring civil claims for damages suffered as a result of non-compliant processing.
Unclear Data Ownership Leading to Disputes
When a Cloud Services Agreement does not explicitly address data ownership, disputes frequently arise about who owns the data stored on the cloud platform — particularly derivative data, aggregated analytics, and metadata generated from the customer's usage. Some providers include broad licence terms in their standard agreements that grant them rights to use, analyse, and commercially exploit customer data. Without clear contractual provisions confirming that the customer retains full ownership of their data and that the provider's licence is limited to what is necessary to deliver the service, the customer may inadvertently grant away valuable data rights.
Provider Insolvency Leaving Customers Without Access
The insolvency of a cloud provider can be catastrophic for customers who depend on the provider's infrastructure for their business operations. If the provider enters business rescue under Chapter 6 of the Companies Act or liquidation under the Insolvency Act, the customer's access to their data and services may be terminated with little or no notice. Without contractual provisions that establish data ownership independent of the provider's solvency, require current backups in accessible formats, and provide for immediate data extraction upon insolvency events, the customer may lose access to their data entirely.
Cross-Border Data Transfer Violations
Many South African businesses use cloud providers with infrastructure hosted outside the country — in the EU, US, or Asia — without realising that POPIA Section 72 restricts cross-border transfers of personal information. Without a CSA that specifies hosting locations, identifies the legal basis for cross-border transfers, and implements appropriate contractual safeguards, the customer may be in continuous violation of POPIA every time personal information is uploaded to the cloud platform. The Information Regulator has indicated that enforcement of cross-border transfer provisions is a priority area.
What is a Cloud Services Agreement?
A Cloud Services Agreement is one of the most important commercial contracts in the South African technology sector. As businesses increasingly migrate their operations, data, and customer-facing applications to cloud infrastructure, the legal framework governing these relationships must keep pace. A Cloud Services Agreement (CSA) is a legally binding contract between a cloud service provider and a customer that defines the terms for delivering and consuming cloud-based services — whether Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), or Infrastructure-as-a-Service (IaaS). Unlike generic international templates, this agreement has been specifically drafted for the South African legal environment, addressing the unique requirements of the Electronic Communications and Transactions Act 25 of 2002 (ECTA), the Protection of Personal Information Act 4 of 2013 (POPIA), and the Consumer Protection Act 68 of 2008 (CPA).
The regulatory landscape for cloud services in South Africa is markedly different from other jurisdictions. Under POPIA, when a cloud provider processes personal information on behalf of a customer, the provider assumes the role of an "operator" (equivalent to a GDPR "processor") and the customer is the "responsible party" (equivalent to a GDPR "controller"). Section 21 of POPIA requires that this relationship be governed by a written contract that establishes the operator's security obligations, processing limitations, and confidentiality undertakings. Section 72 of POPIA further restricts the cross-border transfer of personal information — a critical consideration when cloud infrastructure is hosted outside South Africa, as is frequently the case with global providers operating data centres in Europe, the United States, or Asia. Without a properly drafted CSA that addresses these POPIA requirements, both the provider and the customer face potential enforcement action by the Information Regulator, including administrative fines of up to R10 million under Section 109 of POPIA.
ECTA provides the foundational legal framework for electronic commerce and digital service delivery in South Africa. Section 11 of ECTA confirms that agreements are not invalid merely because they are in electronic form, while Sections 12 and 13 address the formation and validity of electronic contracts — ensuring that CSAs concluded through electronic acceptance mechanisms are legally binding. Section 43 of ECTA imposes specific disclosure obligations on electronic service providers, requiring them to make certain information available to customers before concluding a transaction, including the provider's full name and legal status, physical address, website address, and membership of any self-regulatory body. For cloud providers, compliance with these disclosure requirements is not optional — failure to comply can render the agreement voidable at the customer's election.
The practical importance of a well-drafted CSA cannot be overstated. Cloud service failures — whether from downtime, data breaches, or provider insolvency — can cripple a business that depends on cloud infrastructure for its daily operations. Without contractually defined service levels, uptime commitments, and remedies for service failures, the customer has limited legal recourse beyond the generic remedies available under the common law of contract. A comprehensive CSA addresses this by establishing measurable service level agreements (SLAs) with specific uptime percentages, response time commitments, and service credit mechanisms that provide automatic financial remedies when targets are missed. It also defines data ownership, backup obligations, disaster recovery procedures, and the critical data extraction rights that apply when the agreement terminates — ensuring the customer is never held hostage by a provider who controls their data.
This attorney-drafted template is compliant with ECTA, POPIA, the CPA, and the Cybercrimes Act 19 of 2020. It has been designed for South African cloud service providers and their customers, covering every critical area: service descriptions and scope, SLA metrics and service credits, data handling and POPIA operator agreements, security obligations and audit rights, disaster recovery and business continuity, intellectual property and data ownership, pricing and billing, term and termination, limitation of liability, and dispute resolution. Whether you are a SaaS company onboarding enterprise clients, a managed hosting provider formalising customer relationships, or a business subscribing to cloud infrastructure, this CSA provides the legal foundation your cloud engagement requires.
Who Needs This
Want early access to the Cloud Services Agreement template?
We'll email you the moment early access opens
POPIA Section 21 requires a written contract between the responsible party and operator before any cloud processing of personal information begins — non-compliance can result in administrative fines of up to R10 million under Section 109
ECTA Section 43 requires electronic service providers to disclose their full legal name, physical address, registration number, and contact details before concluding an electronic transaction — failure to comply can render the agreement voidable
The CPA applies to cloud service customers who are natural persons or juristic persons with turnover below R2 million, granting mandatory protections including a 5-business-day cooling-off period under Section 44 and the right to fair contract terms under Section 48
POPIA Section 72 restricts cross-border transfers of personal information — critical for cloud services hosted outside South Africa, requiring contractual safeguards where the Information Regulator has not declared the recipient country adequate
The Cybercrimes Act 19 of 2020 requires electronic communications service providers, including cloud providers, to report certain offences to the SAPS within 72 hours under Section 54
Key Clauses Included
This Cloud Services Agreement template covers 12 essential sections, each drafted by South African attorneys.
Service Description & Scope
This section clearly defines the cloud services being provided, including the service model (SaaS, PaaS, or IaaS), specific functionality, service tiers, environments (production, staging, development), geographic regions where data is hosted, and any exclusions or limitations on the services. It establishes the baseline against which service performance will be measured and ensures both parties have a shared understanding of what is — and is not — included in the engagement.
Service Level Agreement (SLA)
Defines measurable uptime guarantees (typically ranging from 99.5% to 99.99% monthly availability), response time commitments for support requests categorised by severity, planned maintenance windows with advance notification requirements, and the methodology for measuring availability — including what constitutes "downtime" and the exclusions that apply (such as scheduled maintenance, force majeure, and customer-caused issues). This section is the cornerstone of cloud service accountability.
Service Credits & Remedies
Establishes the financial remedies available to the customer when SLA targets are not met. This includes the service credit calculation formula (typically a percentage of the monthly fee based on the severity of the SLA breach), the claim procedure the customer must follow, maximum credit caps per billing period, and whether service credits are the customer's sole and exclusive remedy or whether additional remedies are available for chronic underperformance. Service credits provide meaningful accountability without requiring litigation.
Data Handling & POPIA Compliance
Defines the roles of responsible party and operator under POPIA Section 21, the specific personal information to be processed, the purposes and scope of processing, the security measures the operator must implement under Section 19, breach notification timelines (the template specifies notification within 72 hours of discovery), sub-processor management and approval mechanisms, cross-border transfer safeguards under Section 72, and the customer's audit rights over the provider's data handling practices.
Security Obligations
Specifies the technical and organisational security measures the provider must implement — including encryption standards (at rest and in transit), access controls and identity management, vulnerability management and patching schedules, penetration testing frequency, incident response procedures aligned with the Cybercrimes Act 19 of 2020, and the customer's right to conduct security audits or require third-party audit reports such as SOC 2 Type II or ISO 27001 certifications.
Disaster Recovery & Business Continuity
Covers backup frequency and retention periods, recovery time objectives (RTO) and recovery point objectives (RPO) for different service components, failover procedures to secondary infrastructure, geographic redundancy requirements, regular disaster recovery testing schedules, and the provider's obligation to maintain and share a documented business continuity plan. This section ensures the customer's data and services can be recovered within acceptable timeframes following a catastrophic event.
Intellectual Property & Data Ownership
Confirms unequivocally that the customer retains full ownership of all data uploaded to or generated through the cloud service, defines the provider's intellectual property rights in the underlying platform, technology, and infrastructure, addresses the treatment of derivative data, aggregated analytics, and metadata, and establishes the customer's rights to export their data in standard, machine-readable formats at any time during the term of the agreement.
Pricing, Billing & Payment
Sets out the subscription fees or usage-based pricing structure, billing cycles (monthly or annual), payment terms (typically 30 days from invoice), accepted payment methods, late payment consequences including interest and suspension rights, price escalation mechanisms (with CPA-required reasonable notice for consumers), and the treatment of taxes including VAT at 15% under the Value-Added Tax Act 89 of 1991.
Term, Renewal & Termination
Defines the initial term, automatic renewal provisions with advance notice of renewal, termination for convenience with the required notice period, termination for cause (material breach, insolvency, change of control), the critical data extraction period after termination (typically 30-90 days during which the customer can export their data), post-termination data deletion obligations, and transition assistance the provider must offer to facilitate migration to a replacement service.
Limitation of Liability
Establishes liability caps (typically the total fees paid or payable in the 12 months preceding the claim), exclusions for indirect, consequential, and lost profit damages, carve-outs for matters that should not be subject to the cap (including wilful misconduct, data breaches caused by gross negligence, IP infringement indemnities, and confidentiality breaches), and the interaction with the CPA's provisions that limit the ability to exclude certain consumer protections under Section 51.
Confidentiality & Information Security
Mutual confidentiality obligations protecting each party's proprietary information, trade secrets, and commercial affairs. Defines what constitutes confidential information, the permitted uses and disclosures, the standard of care required, the return or destruction of confidential information on termination, and the survival of confidentiality obligations beyond the term of the agreement — typically for a period of 3-5 years after termination.
Dispute Resolution & Governing Law
Specifies that the agreement is governed by the laws of the Republic of South Africa and establishes the dispute resolution process. The template provides for a structured escalation from informal negotiation between the parties' representatives, to formal mediation under the rules of the Arbitration Foundation of Southern Africa (AFSA), to binding arbitration as the final mechanism — with specific provisions for urgent interim relief through the High Court where necessary to protect data or prevent irreparable harm.
South African Law Compliance
Electronic Communications and Transactions Act 25 of 2002
ECTA is the primary legislation governing electronic commerce and digital service delivery in South Africa. Section 11 confirms that agreements are not invalid merely because they are in electronic form. Sections 12 and 13 address the formation and validity of electronic contracts, ensuring that CSAs concluded through electronic acceptance are binding. Section 43 imposes disclosure obligations on electronic service providers, requiring them to display their full legal name, physical address, registration number, and contact details before concluding an electronic transaction. Chapter XI provides limited liability protection for service providers who comply with the notice-and-takedown procedures for infringing content hosted on their infrastructure.
Protection of Personal Information Act 4 of 2013
POPIA is directly applicable to every cloud services engagement where personal information is processed. Section 19 requires both the responsible party and the operator to implement "appropriate, reasonable technical and organisational measures" to secure personal information. Section 21 mandates that processing by an operator must be governed by a written contract that establishes security obligations, processing limitations, confidentiality, and notification duties. Section 22 requires notification of security compromises to the Information Regulator and affected data subjects. Section 72 restricts cross-border transfers of personal information, permitting transfers only where the recipient country provides "adequate" protection or where specific safeguards are in place. The Information Regulator can impose administrative fines of up to R10 million under Section 109 for non-compliance.
Consumer Protection Act 68 of 2008
The CPA applies where the customer qualifies as a "consumer" — which includes natural persons and juristic persons with an annual turnover or asset value below the threshold determined by the Minister (currently R2 million). Where applicable, Section 14 requires that contract terms be fair, just, and reasonable, and Section 48 prohibits unfair, unreasonable, or unjust contract terms. Section 22 requires that terms be in plain language that an ordinary consumer can understand. Section 44 provides a 5-business-day cooling-off period for electronic transactions. Section 40(1) requires reasonable notice before automatic renewal of fixed-term agreements. These consumer protections override any conflicting contractual terms.
Cybercrimes Act 19 of 2020
The Cybercrimes Act creates criminal offences for unlawful access to computer systems (Section 2), unlawful interception of data (Section 3), cyber fraud (Section 8), and cyber forgery and uttering (Section 9). Section 54 imposes reporting obligations on electronic communications service providers — including cloud service providers — requiring them to report certain offences to the South African Police Service within 72 hours of becoming aware of them. Cloud service agreements must address the provider's obligations under the Cybercrimes Act, including incident reporting, evidence preservation, and cooperation with law enforcement investigations.
Value-Added Tax Act 89 of 1991
Cloud services supplied in South Africa are subject to VAT at 15%. Where the cloud provider is a non-resident supplying electronic services to South African customers, the provider may be required to register for VAT under the amended Section 1 definition of "electronic services" and the Electronic Services Regulations. The CSA must clearly specify whether pricing is inclusive or exclusive of VAT, the parties' VAT registration numbers, and the obligation to issue tax invoices compliant with Section 20 of the VAT Act.
South African businesses are lining up for My-Contracts — be first in when we launch
Cloud Services Agreement vs SaaS Terms of Service
Cloud providers often use both documents for different customer tiers. Understanding the distinction helps you choose the right contractual framework.
| Feature | Cloud Services Agreement (CSA) | SaaS Terms of Service (ToS) |
|---|---|---|
| Nature | Individually negotiated, enterprise-grade contract | Standardised clickwrap agreement accepted by clicking "I Agree" |
| Target customer | Enterprise and B2B clients with high data volumes, regulatory requirements, and complex needs | Self-service customers, SMEs, and individual users |
| SLA commitments | Bespoke uptime guarantees (99.9-99.99%) with negotiated service credits and measurement methodology | Standard SLA targets with generic service credits — typically non-negotiable |
| POPIA compliance | Detailed operator agreement under Section 21 with specific security measures, breach timelines, and audit rights | Generic data processing clause — may not meet POPIA Section 21 requirements |
| Data ownership | Explicit data ownership clause confirming customer retains all rights, with export formats specified | Often includes broad licence grants allowing the provider to use aggregated or anonymised data |
| Liability caps | Negotiated caps with specific carve-outs for data breaches, wilful misconduct, and IP infringement | Fixed caps or uncapped exclusions — often heavily favour the provider |
| Security audits | Customer has contractual right to audit or require third-party audit reports (SOC 2, ISO 27001) | No audit rights — customer must rely on provider's published security certifications |
| Termination | Negotiated data extraction periods (30-90 days), transition assistance, and certified data deletion | Standard 30-day window — provider may delete data immediately after termination |
| CPA applicability | Typically between large enterprises — CPA may not apply if both parties exceed R2 million turnover | CPA applies to consumer and small business customers — mandatory cooling-off period under Section 44 |
| Dispute resolution | Structured escalation through negotiation, mediation, and AFSA arbitration | Typically court litigation in the provider's chosen jurisdiction — may not be South Africa |
Create Your Cloud Services Agreement in Minutes
Our guided wizard walks you through every clause — no legal knowledge required. Attorney-drafted, South African law compliant.
Define your service model and scope
Document the specific cloud services to be provided (SaaS, PaaS, or IaaS), the service tiers and features included, the hosting locations and data centre jurisdictions, and any services or responsibilities that are explicitly excluded. This forms the foundation of the entire agreement and determines which legal requirements apply — particularly regarding cross-border data transfers under POPIA Section 72.
Establish SLA metrics and service credits
Agree on the uptime percentage commitment, the measurement methodology, the exclusions that apply (scheduled maintenance, force majeure, customer-caused issues), and the service credit structure for SLA breaches. Define the support tiers, response times by severity level, and the escalation process for critical issues. These metrics must be specific, measurable, and achievable given your infrastructure capabilities.
Complete the data handling and POPIA provisions
Map the personal information that will be processed through the cloud service, identify the responsible party and operator roles under POPIA, document the processing purposes and instructions, specify the security measures to be implemented under Section 19, and address cross-border transfer mechanisms under Section 72. If sub-processors will be used, list them and establish the approval mechanism for adding new sub-processors.
Negotiate commercial and liability terms
Agree on the pricing structure, payment terms, price escalation provisions, liability caps, and exclusions for indirect damages. Ensure the limitation of liability provisions include appropriate carve-outs for data breaches, confidentiality violations, and IP infringement. If the customer is a consumer under the CPA, verify that the terms comply with Sections 14, 48, and 51 regarding fair terms and mandatory consumer protections.
Execute and implement the agreement
Have both parties sign the agreement, ensuring that signatories have the authority to bind their respective organisations — attach board resolutions or delegations of authority where appropriate. Implement the agreed security measures and SLA monitoring mechanisms. Set up the service credit claim process, the data breach notification workflow, and the scheduled reviews of SLA performance. Store the executed agreement securely and distribute copies to all relevant stakeholders within both organisations.
Frequently Asked Questions
A Cloud Services Agreement (CSA) is a legally binding contract between a cloud service provider and a customer that governs the provision and use of cloud-based services such as SaaS, PaaS, or IaaS. In South Africa, you need a CSA because multiple laws directly regulate cloud service delivery. POPIA Section 21 requires a written contract between the responsible party (customer) and the operator (cloud provider) whenever personal information is processed. ECTA imposes disclosure obligations on electronic service providers under Section 43. The CPA requires fair terms and plain language where the customer is a consumer. Without a properly drafted CSA, you face regulatory penalties under POPIA of up to R10 million, potential voidability of the agreement under ECTA, and unenforceable limitation of liability clauses that leave you exposed to uncapped damages. A CSA also provides the commercial framework for SLAs, service credits, data ownership, and termination rights that generic online terms simply cannot address.
What You Get With This Template
Drafted specifically for South African law — compliant with ECTA, POPIA, the CPA, and the Cybercrimes Act 19 of 2020
Comprehensive SLA framework with measurable uptime targets, defined measurement methodology, and automatic service credit mechanisms
Full POPIA operator agreement provisions including Section 19 security measures, Section 21 processing terms, Section 22 breach notification, and Section 72 cross-border transfer safeguards
Data ownership clauses that unequivocally confirm the customer retains ownership of all data, with export rights in standard formats and post-termination extraction periods
Disaster recovery provisions with specific RTO and RPO targets, backup schedules, and DR testing requirements
Balanced limitation of liability with appropriate carve-outs for data breaches, wilful misconduct, confidentiality violations, and IP infringement
Customisable template with clearly marked decision points for service tiers, pricing models, SLA percentages, and termination notice periods
Dispute resolution clause providing for structured escalation from negotiation to mediation to arbitration under AFSA rules, avoiding costly High Court litigation