How To Set A Liability Cap In An IT Support Contract

Priya runs a small managed IT services business in Manchester. One Friday afternoon, a client's server goes down during a software update and their online orders stop for three hours. The client asks Priya to cover lost sales, staff overtime, emergency consultant costs and reputational damage.

Priya has insurance and she's confident her team acted properly, but her contract doesn't say much about liability. Suddenly, a monthly support fee of £900 is sitting next to a claim that could be many times that amount.

If you provide IT support, this is exactly why your limitation of liability clause matters. A well-drafted liability cap in your IT support contract can help you price your services sensibly, manage risk and give your customers a clearer picture of what is and isn't covered.

The key is to make the cap fair, specific and aligned with the real risks in your services, especially downtime, data loss and cyber incidents.

Can You Limit Liability In An IT Support Agreement?

Yes, you can usually limit liability in an IT support agreement, but the limit needs to be properly drafted and, in many cases, reasonable under UK law.

For business-to-business contracts in England and Wales, the main law to keep in mind is the Unfair Contract Terms Act 1977, often called UCTA. UCTA can apply when you're trying to exclude or limit liability for negligence, breach of contract or misrepresentation, especially where you're using your standard terms.

In simple terms, UCTA asks whether the clause is reasonable. A court can look at things like:

• the bargaining power of each party
• whether the customer knew about the limitation before signing
• whether the cap reflects the price you're charging
• whether insurance was available
• whether the customer had a real chance to negotiate
• how clear and visible the clause was in the contract

This doesn't mean every low cap is invalid. It does mean a one-line clause saying you accept no liability for anything at all is unlikely to give you the protection you want.

If you deal with consumers as well as businesses, the Consumer Rights Act 2015 is also relevant. Consumer-facing terms need to be fair and transparent, and you can't simply remove statutory rights. Most IT support providers we're talking to here are contracting with business customers, but it's worth checking your customer base before reusing the same terms everywhere.

What Is A Sensible Liability Cap For A Managed IT Services Contract?

It depends on your fees, your role, your insurance and the level of risk you're taking on for the customer.

A common starting point in an IT services agreement is to cap liability at a multiple of fees paid, such as the fees paid in the last 12 months. That can work well for lower-risk helpdesk and maintenance services, but it may be too low for higher-risk work involving cyber security, data hosting, backups or business-critical infrastructure.

Some contracts use different caps for different risks. For example:

• general liability cap: 100% of the fees paid in the previous 12 months
• data protection or confidentiality cap: a higher amount, or a multiple of the general cap
• uncapped liability: only for things that legally or commercially shouldn't be capped, such as fraud
• service credits: a specific remedy for downtime or SLA failures

Let's say you charge a customer £1,200 per month for remote IT support. A 12-month fees cap would be £14,400. That might be commercially sensible if your work is limited to helpdesk support and routine monitoring. It may look very different if you're also responsible for backups, endpoint security, disaster recovery and 24/7 incident response.

The cap should make sense next to the contract value. If your cap is so low that it doesn't reflect the likely damage from a foreseeable issue, the customer may push back and a court may look more closely at whether it was reasonable.

One Cap Or Several Caps?

Many IT providers use a layered approach rather than one cap for everything. This lets you keep your general commercial risk manageable while giving customers more comfort on sensitive areas.

For example, your contract might say:

• standard claims are capped at fees paid in the previous 12 months
• claims involving confidentiality or personal data are capped at a higher fixed sum
• service level failures are dealt with through service credits
• certain liabilities aren't capped because the law doesn't allow it or because you've agreed not to cap them

This kind of structure is often easier to negotiate than a single very high cap across the entire agreement.

How Should Your Contract Deal With Downtime?

Your contract should deal with downtime by defining the service levels, the customer's remedies and the events that don't count as a service failure.

Downtime is one of the biggest pressure points in IT support contracts because the customer's losses can grow quickly. Even a short outage can affect sales, staff productivity and customer confidence.

Your agreement should be clear about what you actually promise. For example:

• are you promising uptime under a service level agreement, or only response times?
• does the SLA apply during business hours or 24/7?
• what counts as a support request?
• what counts as a critical incident?
• are resolution times guaranteed, or are they targets?
• does scheduled maintenance count as downtime?

If you provide managed IT services, your limitation of liability clause and your service level agreement should work together. If the SLA says the customer gets a service credit for downtime, the limitation clause should explain whether that service credit is the customer's sole remedy for that SLA failure.

For example, you might agree that if your hosted support platform is unavailable for longer than the agreed threshold, the customer gets a credit against their next invoice. That gives the customer a practical remedy, while helping you avoid an open-ended claim for lost profits.

Be careful with exclusions for downtime. It's reasonable to carve out things outside your control, such as:

• planned maintenance notified in advance
• failures in the customer's own systems or internet connection
• third-party platforms you don't control
• the customer's failure to follow your reasonable instructions
• emergency security work needed to protect the environment

What you don't want is wording so broad that the SLA becomes meaningless. If you promise support but exclude almost every likely scenario, that can create arguments and damage customer trust.

Can You Exclude Liability For Data Loss Or Cyber Incidents?

You can limit some liability for data loss and cyber incidents, but you can't treat every cyber or data issue as someone else's problem.

Data loss and cyber events are different from ordinary service issues because they can trigger contractual claims, regulatory duties, customer disruption and reputational harm at the same time.

Your contract should clearly separate responsibilities. For example:

• who is responsible for backups?
• how often are backups run?
• where are backups stored?
• what is the recovery time objective?
• what is the recovery point objective?
• who approves software updates and security patches?
• who is responsible for user access, passwords and multi-factor authentication?

If you only provide helpdesk support, you may not want to take responsibility for the customer's backup strategy. If you do provide backup, disaster recovery or managed services, you should define the scope very carefully.

Under the UK GDPR and the Data Protection Act 2018, you may be a processor for your customer, or in some cases an independent controller, depending on what you're doing with personal data. Your agreement should include the required data processing terms where you process personal data on the customer's behalf.

You can't contract out of your obligations to the Information Commissioner's Office or to individuals whose data is affected. The ICO can issue penalties under the UK GDPR, with the highest tier being up to £17.5 million or 4% of annual worldwide turnover, whichever is higher. For lower tier infringements, the maximum is £8.7 million or 2% of annual worldwide turnover, whichever is higher.

That doesn't mean every IT support provider is exposed to those figures in practice. It does mean your contract shouldn't simply say you have no responsibility for personal data under any circumstances.

A Practical Example

Say your customer refuses to enable multi-factor authentication despite your written recommendation. Later, an employee's email account is compromised through a phishing attack.

Your contract should help answer questions like:

• did you warn the customer about the risk?
• did the customer reject or delay the recommendation?
• were you responsible for email security settings?
• did the incident involve your negligence or the customer's internal practices?
• what costs are recoverable, and are they capped?

Good drafting won't stop every dispute, but it gives you a much stronger starting point than trying to reconstruct the relationship from emails after something has gone wrong.

What Liability Can You Not Easily Exclude?

Some liability can't be excluded at all, and some can only be limited if the wording is reasonable and legally effective.

Under UCTA, you can't exclude or restrict liability for death or personal injury caused by negligence. For other loss or damage caused by negligence, a limitation or exclusion must satisfy the reasonableness test.

You also generally can't exclude liability for fraud or fraudulent misrepresentation. If a supplier deliberately lies to induce a customer to enter a contract, a clause trying to exclude that liability is unlikely to help.

Other areas need particular care. Depending on the contract, these may include:

• data protection duties: you can't remove statutory obligations owed under UK data protection law
• confidentiality: customers often expect stronger remedies if sensitive business information is mishandled
• intellectual property infringement: if you're providing software, scripts or tools, customers may want protection if third-party rights are infringed
• deliberate default or wilful misconduct: many customers won't accept a cap for intentional wrongdoing
• payment obligations: you usually won't want the customer to cap what they owe you in unpaid fees

This is where the wording matters. A limitation clause shouldn't just list a cap. It should also explain what the cap applies to, what it doesn't apply to and how different claims are treated if they arise from the same incident.

For example, if one cyber incident leads to breach of contract, negligence, confidentiality and data protection claims, your agreement should say whether the cap applies once to the whole incident or separately to each type of claim. Otherwise, you may end up arguing about the cap just when everyone needs clarity.

How Do You Align Your Liability Clause With Insurance?

You should align your liability clause with insurance by checking what your policies actually cover, not just the headline policy limit.

It's common to see a contract cap set at the same amount as the provider's professional indemnity insurance. That can be sensible, but only if the insurance responds to the type of claim being made.

Before agreeing to a cap, check:

• your professional indemnity cover
• your cyber insurance cover
• your public liability cover
• any exclusions for cyber events, ransomware, data loss or outsourced providers
• the excess or deductible you must pay
• whether defence costs sit inside or outside the limit
• whether the policy is claims-made, and whether the retroactive date is correct
• whether multiple claims from one incident are aggregated

Insurance can give you financial backing, but it isn't a substitute for clear contract terms. If your contract promises something your policy doesn't cover, you're still on the hook to the customer even if the insurer says no.

For example, your customer might ask you to accept unlimited liability for data loss. Your cyber policy might have a £250,000 limit and exclude losses caused by the customer's failure to maintain basic security controls. If you accept unlimited liability anyway, you've taken on a risk that sits outside your commercial model.

When negotiating, it's perfectly reasonable to explain that your cap is linked to the fees, the scope of work and the insurance available for that service. Most business customers understand this when it's explained clearly.

What Terms Should Your IT Service Contract Include?

Your IT service contract should include the liability cap, but it also needs the surrounding terms that make the cap work in practice.

A limitation clause is much stronger when the rest of the agreement clearly sets expectations. Helpful terms include:

• scope of services: what you're doing and what you're not doing
• customer responsibilities: access, information, approvals, security practices and internal backups
• service levels: response times, support hours, priority levels and escalation steps
• planned maintenance: when it can happen and how much notice you'll give
• change control: how extra work, urgent fixes and out-of-scope requests are approved and charged
• fees and payment: recurring fees, project fees, late payment and suspension rights
• data protection: UK GDPR processor terms where needed
• confidentiality: how sensitive information is protected
• security requirements: who manages passwords, access permissions and patching
• backups and disaster recovery: what is included, what is tested and what recovery targets apply
• third-party services: how cloud platforms, software vendors and telecoms providers are handled
• termination: notice periods, offboarding, data return and handover assistance

Templates can be a useful starting point, but IT support contracts often need tailoring. A generic service agreement may not deal properly with backups, cyber security, remote access, administrator privileges, maintenance services or service credits.

Also think about your sales process. If your limitation clause is hidden in a document sent after the customer has already agreed the deal, you may have a harder time relying on it. Give customers your terms before they sign or start using the service, and make acceptance clear.

Common Mistakes To Avoid

The most common mistake is treating the liability cap as a copy-and-paste clause rather than a commercial risk decision.

Watch out for these issues:

• using one cap for every customer: a micro-business on basic support and a larger customer on 24/7 managed services may need different terms
• forgetting indirect losses: lost profits, lost revenue and loss of goodwill should be dealt with clearly
• promising outcomes you can't control: avoid guaranteeing uptime, cyber security or recovery times unless you're set up to deliver them
• ignoring customer dependencies: customers need to cooperate, approve changes and follow security recommendations
• not matching the cap to insurance: a high cap can leave you exposed if your policy doesn't respond
• leaving data protection out: if you access personal data, UK GDPR terms should be addressed properly
• unclear service credits: say whether credits are the only remedy for an SLA failure
• no offboarding process: disputes often happen when a customer leaves and needs data, passwords and handover support

A good IT support agreement doesn't need to be aggressive. In many cases, fair and clear drafting helps the customer feel more confident because they can see what happens if something goes wrong.

Key Takeaways

• You can usually include a liability cap in an IT support contract, but it needs to be clear, fair and reasonable under UK law.
• Downtime should be handled through carefully drafted SLAs, service credits, exclusions and customer responsibilities.
• Data loss and cyber incidents need special attention because UK GDPR, backups, security controls and insurance can all overlap.
• You can't exclude liability for death or personal injury caused by negligence, and you generally can't exclude fraud or fraudulent misrepresentation.
• Your cap should line up with your fees, your role in the customer's systems and the insurance cover you actually have.
• The limitation clause works best when the whole IT service contract is tailored to your services, rather than dropped into a generic template.

If you'd like help with your IT support contracts, liability caps, service level terms or data protection clauses, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.