Five checks to run before you sign

Almost nobody does this, and it is the single most useful thing on the list. The liability cap is not a legal question first. It is an arithmetic one.

Write down the worst plausible failure. Not the worst imaginable, the worst plausible. You lose a week of their data. Your integration writes bad records into their finance system. Your service is down through their peak trading day.

Now put a figure on it, roughly. What would that cost them to fix, in staff time, in lost trade, in their own customers’ claims?

Then find your cap. It will usually be expressed as the fees paid in the preceding twelve months. Work out what that number actually is for this customer. If the contract is 2,000 pounds a month, your cap is 24,000. If the plausible failure costs them 250,000, you have just found the gap.

This cuts both ways. A cap far larger than any plausible failure is also worth spotting, because you may be able to trade it for something you want more, like faster payment terms.

Search the document for “indemnify”, “indemnity” and “hold harmless”. Do it literally, with the search box. They are rarely all in one place.

For each one, answer three questions in writing.

• Which way does it run: are you indemnifying them, or they you? Mutual indemnities are common and are not automatically fair, because the risks on each side are rarely the same size.
• What sets it off: a third party claim, a data breach, an IP allegation, or simply any breach of the agreement? The last one is much broader than it looks and is worth pushing back on.
• Is it capped: an indemnity that sits outside the liability cap makes the cap decorative for exactly the events most likely to bankrupt you.

Then check whether it survives termination. A surviving indemnity is an obligation you keep carrying after the relationship has ended and the revenue has stopped, sometimes for years.

Contracts are usually clear about ownership of the core product and vague about everything created around it. That vagueness is not neutral. It favours whoever has better lawyers when the relationship ends badly.

Go through this list and find the answer for each. If you cannot find it, that is the finding.

• Their data: when can they get it out, in what format, and for how long after termination will you keep it available?
• Configuration and setup: the work done to make the product fit their business. Frequently unaddressed, and frequently valuable.
• Integrations and custom work: if you built something specifically for them, who owns it, and can you reuse the approach for the next customer?
• Feedback and improvements: if their suggestions shaped the roadmap, make sure the contract does not accidentally give them rights in the result.
• Anonymised or aggregated data: if you use usage data to improve the product, say so explicitly. Assuming it is fine is not the same as agreeing it.

This is the check that most often changes the answer, and it takes two minutes. Describe, in a plain sentence, what happens to personal data in this arrangement. Then ask who decided.

If you decide why the personal data is used and how, you are a controller. If you only act on their documented instructions, you are a processor. If you both decide, you are joint controllers.

It matters because the classification decides who must report a breach and within what deadline, who answers a subject access request, who owes the individual their rights, and who carries a fine. Getting it wrong does not shift the duty, it just means nobody is doing it.

The ICO’s guidance on controllers and processors is free and genuinely well written. Read it before you pay anyone to summarise it.

Go back through the document and find the clause you could not comfortably explain to a colleague. Not the longest one. The one where you read it and moved on slightly faster than you should have.

That discomfort is information. It usually means one of three things: the drafting is genuinely ambiguous, it refers to something outside the document you have not read, or it describes an arrangement that does not match how the deal actually works.

All three are worth an hour of somebody’s time. And if you are only going to spend money on advice once in this negotiation, that clause is where to spend it, because it is the one you cannot self-assess.

These five checks will find most of what is wrong with most contracts, and they cost you an afternoon rather than several thousand pounds. That is a genuinely good trade and I would rather you did them than not.

What they cannot do is negotiate. Finding a bad cap tells you the position is wrong. It does not tell you whether this is the deal to fight it on, what to trade for it, or how hard the other side will actually push if you ask.

They also will not catch the risk that comes from what is absent. A contract can be perfectly drafted and still say nothing about the one thing that is most likely to go wrong in your particular business.

So run the checks, and treat what they surface as a shortlist rather than a verdict. The shortlist is a much cheaper thing to take to a lawyer than the whole document.