From Startup Fortune · · 2m
How to Negotiate Data Processing Agreement Liability Cap
Founders must negotiate DPA liability caps to avoid catastrophic breaches.
In brief
Founders must negotiate DPA liability caps to avoid catastrophic breaches. Founders should push for 3x to 5x annual fees as data breach caps to align with cyber insurance limits. Originally reported by Startup Fortune.
DPA Liability Cap Problem
Section 9 of the DPA has no cap on liability. The founder who already won this deal on price now has to fight to keep one breach from wiping out the company.
Common Negotiation Mistake
Founders read the MSA liability section three times and skim the DPA once, usually because their counsel handling the MSA isn't the same person reviewing the DPA.
Superseded Liability Cap
The mechanism is called a superseded liability cap, or sometimes a supercap. The DPA includes language stating that, notwithstanding any limitation of liability in the MSA, liability arising from a data breach is subject to…
Customer's Reasoning
If you're processing their customer data, their employee data, or anything covered by GDPR, CCPA, or sector rules like HIPAA, a breach on your end creates real liability on their end.
Real Cost Example
A 12-month fee cap on a $40,000 annual contract doesn't come close to covering the cost of notifying 2 million affected users or responding to a regulator.
Negotiation Strategy
The most common landing zone is a multiple of the fees paid under the agreement rather than an uncapped number.
Insurance Requirement
Push for the cap to apply per claim or per year, not in aggregate across the life of a multi-year contract.
Critical Insurance Check
Before you counter a DPA liability clause, you need to know your cyber insurance policy's actual per-incident limit, not just that you have a policy.
Real Negotiation Win
Companies that handle this well tend to do one of two things before they ever sit down with an enterprise prospect's legal team.
What Actually Breaks Deals
The scenarios that blow up late in procurement aren't the ones where the customer demands a high cap, they're the ones where the founder didn't notice the DPA had a different cap than the MSA…
Procedural Fix
Route the DPA through the same reviewer who handles your MSA liability language, every time, and flag any clause that says "notwithstanding" the main agreement's limitation of liability before you sign anything.
The Real Risk
A single incident under an uncapped DPA clause can wipe out years of accumulated margin on a contract that looked profitable on paper.
The main idea
Founders should push for 3x to 5x annual fees as data breach caps to align with cyber insurance limits.
