In 2025, 80% of organisations experienced at least one cloud-related security breach. The average cost of a data breach in the United States surged to USD 10.22 million. Microsoft cancelled data centre leases equivalent to two entire facilities due to delivery delays. Salesforce inadvertently granted users broad access to other customers’ data. And throughout it all, most cloud contracts limited the provider’s liability to twelve months of fees — a fraction of the actual losses suffered. This article examines what happens when cloud services fail, and what remedies — contractual, statutory, and equitable — are actually available to the aggrieved party.

⬥ ⬥ ⬥

I. The Anatomy of a Cloud Contract Breach

Not every cloud service failure constitutes a breach of contract. Understanding the categories of breach — and the thresholds that trigger different remedies — is essential for any practitioner advising cloud customers or providers.

SLA Breaches: The Most Common Failure

Service Level Agreement breaches are the most frequent category of cloud contract failure. When a provider guarantees 99.9% uptime but delivers only 99.5%, the 0.4% shortfall represents approximately 35 hours of unplanned downtime per year. For an e-commerce platform processing thousands of transactions per hour, this can translate into millions in lost revenue — yet the standard contractual remedy is typically limited to service credits worth a fraction of the monthly fee.

The July 2019 Google Cloud outage illustrates this perfectly. A prolonged infrastructure failure cascaded across YouTube, Shopify, Snapchat, and Gmail, affecting millions of users worldwide. Every one of these SaaS services depended on Google’s underlying infrastructure. Their respective SLAs offered service credits — not compensation for the actual business losses suffered by the merchants, creators, and enterprises whose operations were paralysed.

A critical distinction that practitioners must understand is that SLAs are typically drafted to avoid the legally powerful term “warranty.” They function as capped-remedy performance benchmarks. The remedy is specified within the SLA itself — almost always service credits — and the contract expressly provides that this is the customer’s sole and exclusive remedy for the performance failure. Breaking through this limitation requires demonstrating that the failure rises to the level of a material breach of the master agreement itself, not merely an SLA miss.

Data Breaches: When Provider Security Fails

Data breach incidents represent the highest-stakes category of cloud contract failure. The 2019 Salesforce permissions incident — where a configuration error granted some users the ability to view and modify all data on a particular service — exemplifies how a single security lapse can simultaneously breach confidentiality and integrity obligations, and how the provider’s remedial response (blocking all access to fix the problem) can itself create an availability breach.

The contractual implications are layered. A data breach may simultaneously constitute a breach of the security obligations in the master agreement, a breach of the data processing agreement (DPA) required under regulations like the GDPR or India’s DPDPA 2023, a breach of confidentiality covenants, a trigger for mandatory regulatory notifications, and the basis for third-party claims from affected data subjects. The customer — as data controller — often bears the primary statutory obligation to notify regulators and affected individuals, even when the breach was entirely the provider’s fault. This allocation creates a fundamental tension: the entity that suffers the regulatory consequences is not the entity that caused the breach.

Material Breach: The Threshold for Termination

Most cloud contracts provide a mutual right of termination for cause upon a material breach that remains uncured for a specified period — typically 30 days after written notice. The challenge lies in defining what constitutes “material.” A single SLA miss is rarely material. A catastrophic and prolonged outage may be. A data breach exposing millions of records almost certainly is. Some contracts pre-identify specific events as material breaches — repeated SLA failures exceeding a defined threshold, breach of data protection obligations, or failure to maintain required security certifications — thereby removing the ambiguity that otherwise surrounds materiality determinations.

In October 2019, when Microsoft Azure ran out of specific server types in a US region, preventing customers from provisioning new virtual machines, the question of materiality depended entirely on the customer’s specific contractual terms and business context. For a customer whose operations required scaling capacity during a peak period, the inability to provision resources could constitute a material failure; for another with stable workloads, it might not.

Unilateral Amendment as Breach

A subtler but increasingly important category of breach arises from the provider’s exercise of claimed rights to unilaterally amend contract terms. When a provider modifies its security practices, data processing locations, sub-processor arrangements, or pricing without meaningful customer consent, the amendment may itself constitute a breach — particularly where the original contract was entered into in reliance on the specific terms that have been changed. In jurisdictions with robust consumer protection frameworks, courts may treat such amendments as unfair contract terms and refuse to enforce them.

⬥ ⬥ ⬥

II. Contractual Remedies: What the Agreement Actually Provides

The first line of defence for any aggrieved cloud customer is the contract itself. Understanding the hierarchy of contractual remedies — and their practical limitations — is essential.

Service Credits: The Default (and Inadequate) Remedy

Service credits are the cloud industry’s standard remedy for SLA failures. They function as a pre-agreed form of liquidated damages — the provider credits a percentage of the monthly fee for each increment of downtime or performance degradation. The typical structure caps total credits at 10% to 30% of the monthly fee, regardless of the scale of actual losses.

Typical SLA Credit Structures

The fundamental problem with service credits is the disproportion between the remedy and the harm. A customer paying USD 10,000 per month who suffers a 24-hour outage causing USD 500,000 in lost revenue may receive a credit of USD 1,000 to USD 3,000. Service credits are not designed to make the customer whole; they are designed to incentivise the provider while insulating it from the full economic consequences of its failures.

Practitioners should note that in data centre leasing contexts, SLA breach consequences can be far more severe. A single one-second outage can trigger a full month’s rent credit. A longer or repeated outage may activate early termination rights, potentially slashing the facility’s income to zero. The contrast with standard cloud service SLAs — where credits rarely exceed 30% of monthly fees — underscores how poorly many cloud customers are protected.

Liability Caps: The Provider’s Shield

Beyond service credits, the limitation of liability clause is the most consequential provision in any cloud contract. Standard provider terms typically cap aggregate liability at the total fees paid in the preceding twelve months. This cap applies regardless of the nature or severity of the breach — a deliberate design choice that protects the provider’s business model at the expense of the customer’s recovery.

Carve-Outs and Super Caps

Sophisticated customers increasingly negotiate “carve-outs” — categories of liability excluded from the standard cap. Common carve-outs include breaches of data protection and confidentiality obligations (often subject to a separate, higher “super cap” of 2× to 5× annual fees), intellectual property infringement (frequently uncapped, particularly for provider indemnities), gross negligence and wilful misconduct (typically uncapped as a matter of public policy), fraud (uncapped in virtually all jurisdictions), and regulatory fines and penalties attributable to the provider’s breach (an emerging battleground in negotiations).

The concept of the “super cap” — a higher liability ceiling for specific breach categories — has become the standard compromise between providers who resist uncapped liability and customers who refuse to accept a nominal cap for catastrophic data breach events. A typical structure might set the general liability cap at 12 months of fees but establish a super cap of 24 months for data protection breaches, reflecting the greater potential impact of security failures.

Indemnification: Shifting the Defence Burden

Indemnification provisions address a distinct question from liability caps: not how much can be recovered, but who bears the burden of defending against third-party claims and paying the associated costs. In cloud contracts, the most common indemnities run in both directions.

The provider typically indemnifies the customer against third-party intellectual property infringement claims arising from the customer’s authorised use of the service and, in negotiated agreements, against third-party claims resulting from the provider’s breach of data protection or confidentiality obligations. The customer typically indemnifies the provider against claims arising from the customer’s content, the customer’s use of the service in violation of the acceptable use policy, and the customer’s breach of applicable laws.

A critical practical point: indemnification obligations are often carved out from the liability cap. This means that while direct damages may be capped at 12 months of fees, the provider’s obligation to defend and indemnify against, say, IP infringement claims may be uncapped. Microsoft’s Enterprise Agreement, for instance, typically includes an uncapped indemnity for intellectual property infringement. Practitioners should carefully map the interaction between indemnity provisions and liability caps, as the relationship between these clauses frequently determines the actual economic exposure of each party.

Termination Rights and Transition Services

Termination for cause upon material breach is a standard remedy, but its practical utility depends on the availability of adequate transition provisions. A customer that terminates for the provider’s breach but cannot extract its data in usable formats, or that loses access immediately upon termination, has won the legal battle but lost the operational war.

Well-drafted termination provisions should include a post-termination transition period (typically 30 to 90 days) during which the provider continues to deliver services at pre-existing terms, an obligation for the provider to cooperate with the replacement provider in transferring data and operations, data return in interoperable formats specified in the contract, certified destruction of all residual copies of customer data after completion of the transition, and survival of critical provisions — confidentiality, indemnification, limitation of liability, and dispute resolution — beyond termination.

⬥ ⬥ ⬥

III. Statutory Remedies: Beyond the Four Corners of the Contract

Where contractual remedies are inadequate — and they frequently are — statutory frameworks may provide additional avenues of recovery.

Data Protection Legislation

Data protection statutes impose obligations on cloud providers that cannot be contractually disclaimed. Under the EU’s GDPR, a data processor (the cloud provider) that processes personal data outside or contrary to the controller’s documented instructions automatically assumes the obligations of a data controller — including direct liability to data subjects. Penalties can reach €20 million or 4% of global annual turnover. Under India’s DPDPA 2023, penalties for significant breaches can reach ₹250 crore (approximately USD 30 million), and the Act’s consent-centric framework imposes strict obligations on both data fiduciaries and processors.

Crucially, these statutory obligations exist independently of the contract. A liability cap that limits the provider’s contractual exposure to 12 months of fees does not limit the regulator’s ability to impose fines directly on the provider. And where the provider’s breach causes the customer to incur regulatory penalties, the customer may seek to recover those penalties from the provider through the contractual indemnity — if one exists and if it survives the liability cap.

Consumer Protection Laws

In many jurisdictions, consumer protection legislation provides a statutory floor below which contractual limitations cannot operate. The UK’s Unfair Contract Terms Act 1977 prohibits the exclusion of liability for death or personal injury arising from negligence and subjects all other limitation clauses to a reasonableness test. Australia’s Competition and Consumer Act 2010 renders unfair terms in standard form consumer contracts void. The EU’s Unfair Contract Terms Directive empowers courts to strike down terms that create a significant imbalance to the consumer’s detriment.

In India, the Consumer Protection Act 2019 provides consumers with the right to seek compensation for deficiency in services. Where a cloud service marketed to consumers — such as iCloud, Google Drive, or Dropbox — fails to deliver the promised level of service or security, the affected consumer may have statutory remedies that override the contractual limitations. The UNCITRAL Notes on Cloud Computing Contracts specifically observe that waiver clauses for security incidents where the customer has no ability to effect security may be found “abusive” and therefore invalid.

Product Liability: An Emerging Frontier

The EU’s revised Product Liability Directive (2024) represents a significant expansion of liability into the cloud domain by extending product liability principles to software and AI systems. Where a cloud service defect — whether in software, configuration, or security architecture — causes damage, the provider may face strict product liability regardless of fault and regardless of contractual limitations. This development could fundamentally reshape the remedial landscape for cloud failures within the European Union.

⬥ ⬥ ⬥

IV. Equitable Remedies: Injunctions and Specific Performance

In situations where monetary damages are inadequate — as they frequently are in data-intensive cloud relationships — equitable remedies may offer the only meaningful protection.

Injunctive Relief may be sought where the provider threatens or continues a breach that cannot be adequately compensated by damages — for example, where the provider is about to delete customer data, disclose confidential information, or transfer data to a jurisdiction that would violate applicable law. Most well-drafted cloud contracts include a mutual acknowledgment that breach of confidentiality or data protection obligations would cause irreparable harm entitling the non-breaching party to seek injunctive relief without the need to prove actual damages or post a bond.

Specific Performance — an order requiring the provider to perform its contractual obligations — is theoretically available but practically rare in cloud contexts. Courts are generally reluctant to order ongoing performance of complex technology services, preferring to award damages. However, specific performance may be appropriate in narrow circumstances, such as ordering the provider to return customer data in the contractually specified format upon termination, or to comply with a litigation hold obligation that is essential to the customer’s pending proceedings.

⬥ ⬥ ⬥

V. The Data Breach Remedial Framework

Data breaches merit separate treatment because they engage a unique combination of contractual, statutory, and tort-based remedies, often simultaneously.

The Shared Responsibility Paradox

The “shared responsibility model” that underpins cloud security creates a remedial paradox. Under most data protection statutes, the customer (as data controller) bears primary responsibility for protecting the data it processes — including data processed by its cloud provider. When a breach occurs due to the provider’s negligence, the customer faces regulatory exposure for failing to ensure adequate security, while the provider’s contractual liability is capped at a nominal amount.

This paradox has driven a fundamental shift in contract negotiation priorities. The most fiercely negotiated clauses in modern cloud contracts are no longer pricing or functionality — they are limitation of liability and indemnification provisions relating to data breach events. Customers are increasingly insisting on higher caps or uncapped liability for data protection breaches, mandatory cyber insurance requirements, specific breach notification timelines (48 to 72 hours), provider obligations to cooperate in breach investigation and remediation, and the provider bearing the costs of notification, credit monitoring, and forensic investigation where the breach is attributable to the provider’s systems.

Breach Cost Allocation: A Comparative View

⬥ ⬥ ⬥

VI. Insurance as a Remedial Layer

Given the persistent gap between contractual recovery and actual losses, cyber insurance has emerged as a critical remedial layer in cloud risk management. Both providers and customers increasingly recognise that contractual remedies alone cannot bridge the financial exposure created by catastrophic cloud failures.

Cloud breach insurance markets are projected to grow threefold by 2030. Modern cyber insurance policies can cover first-party costs such as forensic investigation, notification, credit monitoring, business interruption, and data restoration, as well as third-party liability including regulatory defence costs, fines (where insurable under local law), and settlements from data subject claims.

Well-negotiated cloud contracts now routinely require both parties to maintain specified minimum insurance coverage — typically commercial general liability, errors and omissions, and cyber insurance specifically covering data breach events. The contract should require the other party to provide certificates of insurance, name the counterparty as an additional insured, and maintain coverage for a specified period after termination.

⬥ ⬥ ⬥

VII. Dispute Resolution: Litigation, Arbitration, and Practical Realities

The choice of dispute resolution mechanism significantly affects the speed, cost, and enforceability of remedies in cloud contract disputes.

Most major cloud providers specify arbitration or exclusive jurisdiction in their home forum — typically California for US providers. For international customers, this creates practical barriers to enforcement. The customer must litigate or arbitrate in a foreign jurisdiction, under unfamiliar procedural rules, against a provider with vastly greater resources and home-forum advantage. The UNCITRAL Notes recommend that customers negotiate for dispute resolution in the customer’s jurisdiction, or at minimum, in a neutral forum with established expertise in technology disputes.

Claims limitation periods — often contractually shortened to 12 to 24 months from the date of the breach — add urgency to dispute resolution. A customer that discovers a data breach 18 months after it occurred may find its contractual window for claims has already closed or is about to expire. Practitioners should calendar these deadlines immediately upon engagement and negotiate for statutory limitation periods rather than shortened contractual ones wherever possible.

A growing trend in enterprise cloud contracts is the inclusion of escalation procedures — requiring the parties to attempt resolution through designated senior executives before resorting to formal dispute resolution. While these provisions can be valuable in preserving commercial relationships, they also delay the commencement of formal proceedings and may prejudice a party’s ability to seek urgent interim relief.

⬥ ⬥ ⬥

VIII. Negotiation Checklist: Strengthening Remedial Protections

Drawing together the analysis above, the following negotiation priorities are recommended for customers seeking to strengthen their remedial position in cloud contracts.

⬥ ⬥ ⬥

IX. Conclusion

The remedial landscape in cloud computing is characterised by a persistent and widening gap between the harm that cloud failures can cause and the remedies that standard contracts actually provide. Service credits remain woefully inadequate. Liability caps bear no relationship to actual breach costs. Consequential damages — the category that encompasses most real-world losses — are routinely excluded. And the customer, not the provider, bears the primary statutory burden for data protection compliance.

Closing this gap requires a multi-layered strategy: robust contractual negotiation, strategic use of statutory remedies, appropriate insurance coverage, and proactive vendor management that treats the cloud relationship as an ongoing governance obligation rather than a one-time procurement event.

Juris Altus  |  jurisaltus.com  |  Excellence in Legal Practice & Innovation
Panchkula • Delhi-NCR • International Alliance Network