An uncapped data-breach indemnity deserves a clause-by-clause review before an Indian SaaS provider signs a customer contract. Start by identifying what loss the promise covers, whose conduct triggers it, which claims are inside the cap, who controls defence and settlement, and how the clause interacts with privacy duties and insurance. A contract cap can allocate some commercial risk between the parties; it does not by itself erase duties imposed by law or bind a regulator, data principal, or other non-party.

Check the date of the law as carefully as the clause. As of 24 October 2026, the central government’s phased commencement notification for the Digital Personal Data Protection Act, 2023 means the Act’s principal processing duties in sections 3–17 and penalty provisions in sections 28–34 are not yet in force. The Act text on India Code includes the commencement footnote; the official MeitY commencement notification sets the staged dates. Do not describe those future duties or penalties as current exposure on this date. Other applicable laws, sector requirements and contractual duties require separate, current analysis.

This article is a negotiation and review framework, not a recommendation that a startup accept or reject a particular number. The right allocation depends on the service, data, controls, insurance, bargaining position and plausible loss scenarios.

First define the indemnity trigger and the covered loss

An indemnity is only as understandable as its trigger. A clause might cover a breach of data-protection obligations, security incident, confidentiality breach, violation of law, customer claim, or all “losses arising from” an incident. Those phrases can lead to very different results. Identify whose act or omission triggers payment and whether fault, breach, causation, negligence, wilfulness, or a third-party claim is required.

Section 124 of the Indian Contract Act, 1872 defines a contract of indemnity in terms of a promise to save another from loss caused by the promisor or another person. Section 125 addresses specified recoveries by an indemnity-holder when sued, including qualifying damages, costs and sums paid under a prudent or authorised compromise. The actual clause may be broader or more detailed, so read it rather than assuming the statute fills every commercial point.

Make the covered loss categories explicit. They may include third-party claims, reasonable defence costs, settlement amounts, direct response costs, data restoration, forensic investigation, notification, or regulatory amounts. The parties should decide which categories are covered, subject to law, and avoid a definition that silently sweeps in all indirect, consequential, reputational or speculative losses. A customer’s internal business loss and a third-party claim are not interchangeable.

Ask whether the customer can recover under both the indemnity and ordinary breach remedies for the same loss. Check whether service credits, refunds, insurance proceeds or other recoveries reduce the amount. Clarify how multiple parties, multiple incidents and repeated claims are treated. These mechanics should not be left to a fight over whether two provisions duplicate recovery.

Build the cap architecture around the real risk

Do not read the number in the liability cap alone. First identify the base amount: fees paid, fees payable, fees paid in a lookback period, a fixed amount, or insurance proceeds. Then check the cap period, aggregation rule, currency, treatment of taxes, and whether the amount applies per claim or across all claims under related documents.

Many contracts use a general cap plus a higher “super-cap” for defined risks and uncapped carve-outs. The label does not make the result balanced. Map each claim to the provision that controls it. A broad exception for “all data and confidentiality matters” may swallow the general cap, while a narrow exception may leave only specified deliberate misconduct outside it. Review carve-outs with the business, security and insurance teams.

Issue	Questions to answer	Evidence or negotiation task
Trigger	What breach or event activates the promise?	Link it to identified duties and causal facts
Claim type	Third-party claim, direct customer loss, or both?	Separate defence and reimbursement processes
Covered costs	Which response, restoration or legal costs count?	Define reasonableness, documentation and mitigation
Cap base	Which fees and which period set the amount?	Model plausible loss scenarios and contract value
Super-cap	Which risks receive a higher separate limit?	State covered claims and a distinct amount clearly
Carve-outs	What is outside any cap?	Check scope, fault standard, and interaction with indemnity
Excluded loss	Are consequential, lost profit or reputational losses excluded?	Test against the intended customer remedies
Overlap	Can indemnity, service credit, refund and damages stack?	Prevent duplicate recovery for the same loss
Insurance	Does the policy actually cover the promised exposure?	Obtain broker/insurer confirmation on exclusions and limits
Termination	Which duties survive and for how long?	Coordinate survival with claim notice and records retention

A liability cap is a negotiated contract term, not a universal statutory safe harbour. Enforceability and interpretation depend on the wording, law, facts and applicable public policy. Indian Contract Act sections 73–75 address compensation after breach and rescission; they do not provide a one-size-fits-all formula for the number that parties should choose. Have counsel review the cap, exclusion, indemnity and remedy provisions as a system.

Keep defence and incident procedures workable

If the indemnity covers a customer or third-party claim, specify who receives notice, what delay matters, who controls defence, how counsel is selected, what cooperation is required, and who can settle. A party should not be able to settle in a way that admits the other’s liability, creates ongoing obligations, or requires a public statement without a defined approval process. At the same time, the procedure should not make urgent containment impossible.

Separate incident response from indemnity claims. The operational clause should identify incident contacts, reporting trigger, required facts, secure communications, investigation cooperation, evidence preservation, customer decision rights and updates. The parties need a process for a suspected incident before anyone knows whether it is a breach or who caused it. Avoid language that conditions all cooperation on an indemnity determination.

For a SaaS provider, tie the obligation to what it can control and evidence. A customer may need prompt facts to meet its own obligations, while the provider may need to protect other customers and preserve privileged investigations. The agreement should cover access to logs, forensic findings and remediation status without promising disclosure of unrelated tenant data, security-sensitive information, or legally protected communications.

Check what insurance actually responds to

A certificate of insurance is not proof that a specific indemnity is covered. Review the policy wording, insured entities, covered services, territorial scope, limits, retention, claims-made period, notification requirements, exclusions and sublimits. Ask a qualified broker or insurer about the actual clause, including contractual liability, privacy events, regulatory amounts, incident response vendors, breach of contract, and any customer indemnity. Do not assume that a cyber policy pays every amount a contract might require.

Compare the proposed cap with the insurance limit, but do not use the limit as an automatic cap recommendation. Coverage may be shared across claims, reduced by costs, unavailable for a particular event, or subject to conditions. If there is a mismatch, record whether the parties will narrow the indemnity, negotiate a special cap, buy additional coverage, or accept a defined residual risk through authorised approval.

DPDP commencement: distinguish current from future obligations

The DPDP Act uses staged commencement. Section 1(2) authorises different dates for different provisions. The MeitY notification dated 13 November 2025 provides that sections 3–17, which include core processing duties, and sections 28–34, which include penalties, take effect eighteen months after publication. As of 24 October 2026, that period has not elapsed. The same notification starts several institutional provisions earlier and gives separate one-year dates for specified provisions. The final Digital Personal Data Protection Rules, 2025 also contain staged commencement dates.

This timing point does not mean a company can ignore personal-data risk today. Other laws, rules, sectoral directions, contracts and security obligations may apply; their scope must be checked independently. Nor should a contract suggest that an indemnity transfers a company’s statutory responsibility to a customer. A private allocation can govern recourse between contracting parties, but it does not bind a regulator or change when legislation starts to apply.

Because a SaaS agreement can remain in force when deferred provisions commence, include change management. Assign an owner to track commencement, rules, regulator materials and service changes. Draft cooperation and amendment mechanisms that can be used when the applicable regime changes, without falsely stating that future requirements already apply.

Worked example: a health-tech SaaS provider

Fictional example. A Bengaluru health-tech SaaS company receives a customer template requiring it to indemnify the customer for “all losses arising from any data incident,” with no limit. The customer wants immediate payment of internal response costs and regulatory fines. The provider has a cyber policy but has not asked whether its policy covers contractual penalties or the customer’s internal losses. Its product stores limited patient-related data and relies on a cloud subprocessor.

The provider should first define the incident and identify its contractual role and duties. Counsel should separate third-party claims from direct customer losses, specify notice and defence control, review the cap and carve-outs, and assess whether each cost category is supportable under the agreement and law. Security and privacy owners should map the data flow and incident process. The broker should review the actual clause against the policy. As of 24 October 2026, the parties should not describe DPDP sections 3–17 and 28–34 as already operative; they should track their notified commencement and separately assess laws and duties currently in force. If the customer will not accept a workable cap or defined process, the authorised business owner should decide whether the deal’s risk and revenue justify the remaining exposure.

Contract review checklist

For a broader review sequence, use the vendor contract checklist and NDA clause checklist. The in-house contract review playbook helps route issues and preserve approvals. Gotham’s India contract review workflow provides product context; contact Gotham for workflow information.

Questions about data-breach indemnities

Is a data-breach indemnity automatically unlimited under Indian law?

No. The amount and scope depend on the contract and applicable law. Review the trigger, covered loss, cap, carve-outs and other remedies. There is no universal contractual cap amount that is right for every deal.

Can the SaaS provider cap its indemnity to fees paid?

That is a negotiation option, not an automatic legal entitlement or required formula. The parties should assess service criticality, data, likely losses, controls, insurance and bargaining position, then document any agreed cap and exceptions clearly.

Does an indemnity transfer statutory fines to the customer?

A contract can allocate certain financial consequences between parties, subject to applicable law, but it does not bind a regulator or change statutory responsibility. Whether a particular payment is lawful or recoverable requires current legal advice.

Are DPDP penalties already in force on 24 October 2026?

The official 13 November 2025 commencement notification phases provisions. Sections 3–17 and 28–34 are scheduled for commencement eighteen months after publication, so they are not yet in force on 24 October 2026. Other legal duties may still apply and should be checked separately.

Does cyber insurance cover an uncapped indemnity?

Do not assume so. Coverage depends on the policy, insured, claim, exclusion, limit, sublimit, notice and other conditions. Ask the broker or insurer to assess the actual clause and scenario.

Should a vendor accept a customer’s template without change?

Not without understanding the exposure and obtaining the approvals required by its governance. A focused redline can define triggers, recoverable costs, procedure, limits and incident cooperation. A qualified lawyer should review material or uncapped terms.

This article provides general information, not legal, privacy, cybersecurity, insurance, or contract advice. Statutory commencement and applicability can change; obtain current qualified advice before accepting liability language.
How Gotham researches and reviews field guides