A company migrates its entire operation to a system accessed via the internet. Billing, inventory, payroll, customer relationship management—everything becomes dependent on software that the company doesn't install, host, or control. It works well for years, until the day the supplier raises the price more than expected, changes the usage policy, experiences prolonged downtime, or simply terminates the service.
The question that remains is: what are the rules that govern this type of contract?
SaaS contracts, short for Software as a Service , organize exactly this dependency relationship. It's not about buying a program, but about contracting continuous access to a system hosted by a third party. The difference seems subtle, but it redefines the object, the risk, and the way the relationship is terminated. This is precisely where most drafts fail.
For those who advise companies or public administration, mastering the architecture of these relationships is no longer a differentiator but a requirement. Software as a service now underpins everything from industrial management to the operation of a public agency.
SaaS is not a software license, and that changes the contract.
For a long time, the law treated computer programs as a good to be licensed, in a model similar to what is still regulated by the Software Law (Law 9.609/1998). The logic was the transfer of a copy, with a single or periodic payment for the right to use it.
SaaS breaks this mold because it doesn't involve delivering a copy; it provides a continuous service accessed remotely.
In its rulings on Direct Actions of Unconstitutionality (ADI) 5659/MG and 1945/MT on February 24, 2021, the Brazilian Supreme Federal Court established that the licensing and assignment of software usage rights constitute an obligation to perform, subject to the Service Tax (ISS) and not the Sales Tax (ICMS ). If licensing is already a service, SaaS, which is a service by definition, is even further removed from the concept of a purchase.
Include video: https://youtu.be/Hr2svH43woY?si=gS_GTO8P_Jp9074w
The practical consequence appears in the subject matter clause. Describing a software-as-a-service contract as a simple license opens a flank on three fronts: tax treatment, readjustment regime, and termination method.
Ongoing service follows its own termination logic, with prior notice and a transition period, and not the abrupt termination of an expired license. Whoever drafts the contract needs to correctly name what they are contracting.
Personal data: controller, operator, and the missing agreement in most contracts.
All SaaS processes data, and a large portion of it is personal data. The General Data Protection Law (Law 13.709/2018) imposes the first distinction that the contract must reflect: in the typical arrangement, the contracting party is the controller, which decides the purpose of the processing, and the provider is the operator, which processes the data on its behalf.
This qualification entails concrete obligations, considering that the operator must follow the controller's instructions, adopt appropriate security measures (art. 46), and report incidents (art. 48). The instrument that materializes all of this is the data processing agreement, and it is precisely this that is missing in most SaaS contracts made on the fly.
A well-structured agreement addresses points that the main contract often ignores, such as the purpose and limits of data processing, authorization and responsibility for sub-operators, international data transfer when servers are located abroad, and data deletion at the end of the relationship.
It is true that omission has a price, because the controller is liable to the data subject even when the technical failure is the operator's fault, and recourse against the supplier depends on what was written. Those who treat data protection in B2B technology contracts as a decorative addendum discover too late that it was a risk allocation clause.
Reversibility, portability, and the exit that no one negotiates upon entry.
The most overlooked question when adopting SaaS is how to exit it.
Technological dependency, or so-called lock-in , arises precisely from the absence of a reversibility clause. Without it, the contracting party who decides to switch providers discovers that their own data is locked in an unusable format.
The ownership rule helps organize the problem. The software remains the vendor's property, but the data entered by the client belongs to the client. The draft needs to transform this premise into an obligation: return of the data in a structured and readable format, a deadline and support for migration, and secure deletion after delivery.
It's also important to define the ownership of any customizations developed during the contract. The lesson is simple to state and difficult to put into practice. The exit strategy is negotiated at the beginning, when the contracting party still has power. After signing, reversibility becomes a favor, not a right.
When the contracting party is a public authority: SGD/MGI Ordinance 5.950/2023
The contracting of SaaS by the public administration adds a layer of public law to the contractual layer. Under Law 14.133/2021 , software as a service is treated as a continuous service, with its own requirements for planning, oversight, and accountability.
The regulations have been specifically designed. Decree SGD/MGI No. 5.950/2023, which establishes the model for contracting software and cloud computing services for SISP agencies, expressly covers SaaS and, since April 30, 2024, is mandatory, unless a technical justification is approved by the Digital Government Secretariat. The core of the regulation is data governance: security, privacy, sovereignty, and hosting and data center requirements.
According to the lawyer, this has two interpretations. Those working in the public sector need to adjust the terms of reference and the contract to the SGD model and Law 14.133, under penalty of rejection by the Court of Auditors. Those advising the supplier company need to understand that selling SaaS to the State is not the same as selling SaaS to a private company, because the data, sovereignty, and audit clauses cease to be negotiable and become a condition for the validity of the agreement.
The postgraduate program in Digital Government, Artificial Intelligence and Innovation in the Public Sector at IDP
SaaS contracts require simultaneous management of contract law, data protection, technology regulation, and public procurement—areas that are rarely studied together and, in practice, often arrive at the firm in the same case.
The IDP's Postgraduate Program in Digital Government, Artificial Intelligence, and Innovation in the Public Sector was structured for this scenario. The program covers the fundamentals of law, data, and regulation in the digital society, including the LGPD (Brazilian General Data Protection Law), GDPR (General Data Protection Regulation), and Marco Civil (Brazilian Civil Rights Framework for the Internet), advances to the new legal frontiers of innovation, such as digital intellectual property, technology taxation, and competition between platforms, and addresses the public procurement of technology in light of Law 14.133/2021.
The faculty includes those who decide on and execute this agenda. Among the professors are Luis Felipe Monteiro, former National Secretary of Digital Government and CEO of the fintech company Caetano, named by the World Economic Forum as one of the most influential people in the world in digital government in 2020; Thaciana Cerqueira, General Coordinator for the Promotion of Artificial Intelligence at the Secretariat of Digital Government; and Wesley Vaz, Secretary of External Control of Governance, Innovation and Digital Transformation at the TCU (Brazilian Federal Court of Accounts).
The classes are 100% online and live, held every two weeks. For those who advise technology companies or public administration, the competitive advantage lies in arriving at the case already mastering the intersection that underpins SaaS contracts and which the market still treats in a fragmented way.
The procurement of technology by the public sector is being redesigned right now. Those who position themselves in this field while it is taking shape will have an advantage over those who only seek it out after the demand arises.
