Your SaaS terms may contain a sentence like this: “After termination of the agreement, the Customer’s data will be deleted within 30 days.” It sounds prudent. Since September 12, 2025, it has been incompatible with the switching procedure described in Chapter VI of the EU Data Act—and it may be the smallest problem in your contract package.
Chapter VI requires providers of cloud and SaaS data processing services to support a multi-stage process when a customer switches providers. The notice period can be up to two months, followed by a transitional period of up to 30 days with full service continuity. After migration, the customer must have at least 30 days to retrieve exportable data. A typical data processing agreement, meanwhile, may require deletion “no later than 30 days” after termination. The two documents can point in opposite directions.
For a business selling SaaS in Poland, the main risk may therefore lie not in the terms alone, but in the clause that says which document prevails when the terms and the data processing agreement conflict. This article examines that issue alongside the switching timeline, fees, liability provisions, security promises, and operational decisions that the documents must reflect.
The concepts that matter
| Term | Meaning in this article |
|---|---|
| Data processing service | A cloud or SaaS service in which the provider stores and processes customer data on its infrastructure, typically through a subscription model. |
| Switching | The process by which a customer moves data and digital assets to another provider or to its own infrastructure. |
| Transitional period | The period following notice during which the provider maintains full service continuity so the customer can migrate. |
| Exportable data | Customer-entered data subject to export, as distinct from the provider’s reference data and internal data. |
| Digital assets | Digital elements, including applications the customer is entitled to use independently of its contract with the current provider. |
| Unfairness test under Article 13 | A test for certain unilaterally imposed business-to-business contract terms. A term that grossly departs from good commercial practice and is contrary to good faith does not bind the other party. |
Do not combine two different portability rights into one clause. Article 20 of the EU General Data Protection Regulation (GDPR) concerns a natural person’s right against a controller of personal data. Chapter VI of the Data Act concerns a customer’s rights against a data processing service provider. The right holder, legal basis, and provider obligations differ. A single “data portability” clause that treats both provisions as one mechanism is a flawed starting point.
The Data Act switching timeline
Many SaaS templates either omit the Data Act or offer only a sentence promising an export in a machine-readable format. That does not cover the procedure addressed by Article 25.
The following is the timeline the approved analysis says SaaS terms should reflect from September 12, 2025:
| Stage | Period | What the terms need to address |
|---|---|---|
| Customer request | Day 0 | The customer submits a switching request in documentary form. It should state whether the customer wants to move to another provider, move to its own infrastructure, or have the data deleted without a migration. |
| Notice period | Up to two months | The customer may choose a shorter period. The agreement continues on its existing terms. |
| Transitional period | Up to 30 calendar days | The provider maintains full service continuity, assists with migration, and informs the customer of known continuity risks. The customer has a right to extend this period once for a period it considers more appropriate. |
| Technical infeasibility | Notice within 14 working days; alternative period of up to seven months | If a 30-day transition is technically infeasible, the provider must notify the customer and propose an alternative. |
| Data retrieval | At least 30 days after migration is complete | The service is no longer provided, but exportable data remains available and secure. |
| Notice before deletion | At least seven days under the proposed contractual arrangement | The provider tells the customer that it intends to delete the data. |
| End of the agreement | After the procedure is complete | The agreement is treated as terminated, and the provider informs the customer. |
The distinction between giving notice and completing the exit process is essential. Even with a shorter notice period chosen by the customer, a 30-day transition followed by at least 30 days for retrieval cannot be reconciled with an unconditional promise to delete everything within 30 days of termination. The seven-day deletion notice in the table is a contractual design choice, not presented here as a separate statutory deadline.
Which providers need to address this? The source analysis covers B2B SaaS and cloud providers that offer a commercial product through a service catalog. It states that the Article 31 exception concerns non-production versions made available for limited-time testing. On that analysis, if a customer enters real data into a trial, the exception does not apply merely because the trial is free. Recital 98 provides relief from certain obligations for services developed to order for an individual customer; a standard SaaS product sold through a website is not the example the source treats as qualifying.
Five weaknesses in common SaaS terms
1. A deletion sentence takes the place of a switching procedure
“Customer data will be deleted within 30 days” does not specify how a customer requests a switch, how notice works, what happens during transition, when data remains available for retrieval, or how the customer exercises the right to extend the transitional period. Article 25(2) calls for a procedure, not simply an end date for storage.
2. The contract does not define what can be exported
Without an exportable-data catalog, a customer may seek the provider’s licensed reference material—such as sanctions lists, registers, or dictionaries—alongside its own data.
Define the export scope and exclusions. The source proposes identifying customer-entered data as exportable, setting out formats such as XLSX or CSV, JSON for APIs, and PDF for reports, and excluding internal application data and reference databases licensed to the provider.
3. Required information is missing from the public-facing materials
The source identifies information under Articles 24 and 26 that should be available outside the terms: a register of exportable-data structures and formats; migration procedures and known technical limitations; and information about the jurisdiction of the IT infrastructure and measures to prevent third-country authorities from accessing non-personal data stored in the EU.
A separate web page or document, referenced by the terms, can carry this information.
4. Trial accounts fall between the documents
If a trial permits real customer data, check both the switching terms and the personal-data documentation. The source describes a common gap: trial data appears in neither the data processing agreement nor the privacy policy, leaving its deletion deadline undefined. It recommends extending the procedure to free-of-charge contracts, with separate, shorter deadlines.
5. There is no rule for an incomplete request
A customer may ask to switch without saying whether it wants an export, a transfer to its own infrastructure, or deletion only. Without a rule for missing information, the provider may not know which process or deadlines to apply.
One proposed drafting solution is to give the customer a specified number of days to clarify the request and state that, if it does not, the request will be treated as a deletion request. The number of days—“X” in the proposed clause—must be chosen and written into the contract.
The data processing agreement’s precedence clause
A personal-data processing agreement—often called a DPA in international business contracts—may say:
“If this agreement conflicts with the SaaS terms on a matter concerning personal data processing, this data processing agreement prevails.”
That sounds orderly. In a SaaS product handling primarily personal data, including many CRM, HR, and AML/KYC tools, it may instead unsettle the entire contract structure.
| Interaction between documents | Potential effect identified in the source |
|---|---|
| The terms contain the Data Act exit procedure, but the DPA requires deletion within 30 days. | The shorter DPA deadline may be treated as prevailing in a dispute, defeating the intended multi-stage procedure. |
| The terms cap financial liability, but the DPA has no equivalent cap. | Claims concerning personal data may fall outside the cap in the terms. |
| The terms allow an audit once every 12 months, at the customer’s cost and on 30 days’ notice, while the DPA permits inspection at any time and without charge if ordered by a supervisory authority. | The documents create conflicting audit regimes. |
The source proposes two approaches:
- Narrow the precedence clause to substantive processing matters—such as purposes, scope, and categories of personal data—while expressly excluding damages liability and service-exit deadlines.
- Align the documents directly: use consistent periods and have the DPA expressly refer to the Data Act switching section in the terms.
The point is not to let a general precedence sentence decide issues that the documents should address deliberately.
Switching charges: the phase-out
The Data Act fee schedule affects how a SaaS provider prices migration support.
| Period or situation | Rule described in the source |
|---|---|
| September 12, 2025, to January 12, 2027 | Reduced switching charges may be collected, but may not exceed costs actually incurred by the provider. |
| From January 12, 2027 | Charges for the switching procedure are prohibited, including charges for migration and testing tools. |
| Parallel multi-cloud use | Charges for outbound data traffic, or egress, remain permissible up to costs actually incurred. |
From January 2027, the source’s position is that the provider cannot pass switching costs to a departing customer through an export feature, transitional environment, or testing tool. This needs attention in the product budget as well as the contract.
Article 13 and the liability cap
Article 13 of the Data Act addresses unfair contract terms between businesses. According to the source’s analysis:
- A unilaterally imposed term is subject to the test; standard SaaS terms are generally imposed in that way.
- A term that grossly deviates from good commercial practice and is contrary to good faith does not bind the other party.
- The provider bears the burden of showing that a term was not unilaterally imposed.
Article 13(4) lists terms treated as always unfair, including an exclusion or limitation of the imposing party’s liability for intentional acts or gross negligence. A blanket provision stating that “the provider’s liability is limited to X” may therefore fail insofar as it covers that conduct.
The source recommends a two-track liability provision: address intentional fault in the general framework and gross negligence as well for matters connected with making data available. It links that approach to Article 13 of the Data Act and Article 473 § 2 of the Polish Civil Code, which prohibits excluding liability for intentionally caused damage. The exact clause must also be aligned with the DPA rather than drafted in isolation.
The source reports no Polish court judgments or decisions by the President of UOKiK—the Polish competition and consumer protection authority—applying Article 13 to a particular contract term at the time of publication. That limits predictability; it does not remove the contractual risk.
When the security documents promise more than the system delivers
An accurate contract package must describe the product that exists, not the product the provider hopes to build. Compare the security appendix with the application and ask its developer to verify each claim before signing.
| Promise in the documents | Product reality in the example | Risk |
|---|---|---|
| “Central event logging and a record of every database access” | Only creation and modification timestamps are retained; there is no user activity log. | Without logs, determining the scope of an incident may be impossible. In decision ZSOŚS.421.25.2019, Poland’s data protection authority, UODO, identified a lack of traceability as a security risk and imposed a PLN 50,000 fine. |
| “Central identity management, including SSO and MFA support” | Multifactor authentication is technically supported but is not enabled for application users. | A customer may reasonably read the statement as a description of an implemented control. |
| “RPO/RTO parameters in accordance with the contractual SLA” | The terms contain no recovery point objective (RPO) or recovery time objective (RTO). | The document refers to a commitment that has not been specified. |
| “Permanent deletion on request” | Records are marked as deleted, but there is no permanent database-purging process. | The permanent-deletion promise and statement about supporting GDPR Article 17 requests are inaccurate. |
| “Backup data is deleted under the standard retention cycle” | No retention cycle has been defined. | Storage is open-ended, creating the Article 5(1)(e) GDPR storage-limitation issue identified in the source. |
Three SLA provisions that can change the service level
Define the hours in the availability calculation
A 98% availability commitment measured only from 8 a.m. to 6 p.m. on business days is materially different from 98% measured around the clock. An overnight or weekend outage would not lower the first metric.
Choose the measurement window and make the denominator clear. The source proposes this clarification: periods excluded from downtime do not reduce the total number of hours used to calculate the metric.
For context, Microsoft Power Platform documentation equates 99.9% monthly availability with approximately 43 minutes of downtime, and 99.95% with approximately 21 minutes. Such figures are useful only when the contract defines downtime and measurement consistently.
Define what downtime is not
If the SLA lacks exclusions, reduced performance, a longer processing time, failure of one feature, or an incorrect AI-generated result may be argued to be downtime. A model hallucination could then become the basis for a service-credit claim. Address those cases expressly rather than assuming that “availability” resolves them.
Make the final-month credit usable
If downtime occurs in the last month of a contract, there may be no next invoice against which to apply a service credit—even if the credit is described as the customer’s exclusive remedy. The source proposes a reduction of the final period’s fee or a partial refund within 14 days after the claim is approved.
AML and AI products need additional decisions
An AML tool is not necessarily a records archive
Under Article 49 of the Polish AML Act, an obliged entity—such as a bank, fintech company, accounting firm, or real estate agent covered by the relevant obligations—has a five-year duty to retain documentation. When that entity uses a SaaS tool to verify counterparties, the statutory retention duty remains with the customer, not the tool provider.
The operational assumptions may differ. The customer may believe its compliance records are safely archived in the application, while the provider expects regular downloads. The mismatch may emerge only during an authority inspection or account closure.
The source recommends making three points near the start of the terms: the application is an operational tool rather than an archive; the customer must download results on an ongoing basis; and backups are not an archiving service. Clear expectations can prevent the dispute rather than merely limit damages after it arises.
Check how an LLM provider handles prompts
If the service uses a large language model, review that provider’s terms. The source notes that OpenAI retains API data by default for up to 30 days for abuse detection, that flagged content may be reviewed by authorized personnel, and that zero-data-retention arrangements may depend on contractual status.
Prompts containing personal data involve personal-data processing; in an AML/KYC tool, the source expects this to be common. Decide how the processing will be disclosed across the subprocessor list, DPA, and confidentiality provisions.
Document the AI Act classification
The source identifies August 2, 2026, as the date from which the AI Act obligations it discusses for Annex III high-risk systems and Article 50 transparency apply. It distinguishes risk scoring of a counterparty that is a legal person from Annex III, point 5(b), which refers to assessing the creditworthiness of natural persons. If a tool assesses natural persons and its output materially affects a financial decision, however, the source considers high-risk classification justified.
Do not rely on an unsupported statement that the tool falls outside the category. The source calls for a documented assessment against the AI Act text.
Access revocation cannot wait weeks
For a tool processing information about suspected criminal offenses, the source considers “without undue delay, but no later than 21 days” an indefensible deadline for removing a former customer employee’s access under Article 32 GDPR.
Choose who administers accounts and set a deadline that fits that model:
| Model | Operation | Revocation approach |
|---|---|---|
| Customer administrator | The customer manages users in an administration panel. | Immediate action is the customer’s responsibility. |
| Provider-managed access | The customer sends a request and the provider acts on it. | Specify hours or business days, not weeks. |
Do not confuse revoking one former user’s access with blocking an entire customer account after contract termination. They present different risks and need separate deadlines.
Polish enforcement: what the source confirms—and does not
Article 37(1) of the Data Act requires each EU Member State to designate at least one competent authority. The draft Polish implementing act, Sejm paper no. 3266, provides for the President of UKE, Poland’s electronic communications regulator, to serve as the principal authority and introduces administrative fines.
The source does not confirm that the Polish implementing act had been adopted as of the article’s publication. On that stated basis, it reports no designated national authority enforcing Chapter VI and no national schedule of penalties. The Data Act itself applies directly, so the source’s conclusion is that provider obligations do not wait for Polish implementing legislation.
Separately, the Article 13 risk is contractual: an unfair term may not bind the other party whether or not an authority imposes a fine.
Why this affects more than a niche of the market
According to the source’s cited Eurostat figures for 2025, 52.74% of EU enterprises used paid cloud services; of those, 96.44% purchased at least one SaaS service. Switching provisions therefore matter to providers serving a substantial share of the European B2B market.
The European Commission has also published non-binding standard contractual clauses for cloud contracts, grouped as Switching & Exit, Termination, and Security & Business Continuity clauses. They are a drafting starting point, not a substitute for the Data Act requirements or a review of the actual product.
A 12-question review before sending SaaS documents to customers
| # | Question | Where to check |
|---|---|---|
| 1 | Is there a separate switching section covering the request, notice, transition, retrieval, and deletion stages? | Terms, particularly the termination section |
| 2 | Are deletion deadlines consistent between the terms and the DPA? | Both documents side by side |
| 3 | Is the DPA precedence clause limited to the processing matters it is meant to govern? | DPA final provisions |
| 4 | Are exportable data and exclusions listed? | Terms appendix |
| 5 | Are data formats, structures, and infrastructure-jurisdiction information publicly available? | Provider website or referenced document |
| 6 | Do the switching procedure and DPA address trial accounts? | Terms and DPA |
| 7 | Does the SLA define both what counts as downtime and what does not, including AI-output errors? | SLA appendix |
| 8 | Can a customer use an approved service credit when the contract has ended? | SLA appendix |
| 9 | Is former-user access revoked in hours or days rather than weeks? | Terms or security appendix |
| 10 | Do statements about logs, MFA, RPO/RTO, backup retention, and deletion match the system? | Security appendix and technical documentation |
| 11 | Do the terms distinguish an operational tool from an archive? | General provisions |
| 12 | Is the language model provider disclosed, including relevant prompt-retention information? | Subprocessor list and related documents |
What to do this week
Start with three comparisons:
- Read the termination section. If exit is described only as deletion within 30 days, the terms do not contain the switching procedure set out above.
- Put the DPA next to the terms. Compare deletion dates and read the precedence clause. A carefully drafted switching section is of little use if another document overrides it.
- Ask the application developer for evidence. Confirm whether logging, MFA, permanent deletion, and backup-retention controls actually work as the security appendix says.
Adapting SaaS documents to the Data Act is not just a wording exercise. It requires decisions about export functionality, service continuity, personal-data roles, AI prompts, backups, and customer access.
We help SaaS providers and technology companies with a compliance audit, redrafting of the contract framework, or a complete document package that includes the public information layer and a check against the product’s architecture. If you need to review your switching procedure or reconcile your documents with the system you operate, contact us.
Frequently asked questions
Does Chapter VI apply to a small SaaS provider, not just a large cloud platform?
The source’s analysis says yes: size does not itself remove a commercial data processing service from Chapter VI. It distinguishes a standard catalog SaaS product from the individually commissioned services discussed in Recital 98.
Where should I start with SaaS terms drafted before the Data Act applied?
Read the exit section for the full switching timeline, not just an export promise or a 30-day deletion sentence. Then compare it with the DPA’s deletion deadline and precedence clause.
Must switching be free before January 2027?
Under the schedule described above, reduced charges up to costs actually incurred may be charged until January 12, 2027. From that date, the source describes a prohibition on switching-procedure charges, including migration and testing tools, while preserving the stated cost-based treatment of egress during parallel multi-cloud use.
Does a free trial need an exit procedure?
The source says a trial into which the customer enters real data does not benefit from the Article 31 testing exception merely because it is free. Address the trial in the switching terms, DPA, and privacy documentation, with its own clear deadlines.
How long should customer data remain available after notice?
Do not use a blanket “30 days after termination” rule. Account for the notice period, a transitional period of up to 30 days with service continuity, and at least 30 days for retrieval after migration. If the customer is an obliged entity under the Polish AML Act, its five-year statutory records duty remains its own; using the application does not transfer that duty to the provider.
Why is a standard DPA precedence clause a problem?
Where the service handles mainly personal data, a broad clause may give priority to a conflicting deletion deadline, place claims outside a liability cap found only in the terms, and create competing audit rules. Limit the clause appropriately or align the documents expressly.
