What should a cloud services agreement say about outages and data loss?

A cloud services agreement must divide responsibility for outages, data loss and recovery according to the actual service model. For a business using hosted infrastructure or SaaS in Pakistan, a promise of high uptime is not sufficient without measurable standards, recovery terms, security allocation, remedies and an exit process. The agreement is mainly contractual, but sector duties can add mandatory obligations.

Identify the service model

Infrastructure hosting, managed databases and complete SaaS products place different responsibilities on the provider. Define who operates the application, controls credentials, installs patches, creates backups and maintains disaster-recovery systems. If responsibilities are unclear, the parties may each attribute an outage to the other.

Scope and acceptance

Specify platforms, storage volumes, implementation tasks, integrations, environments and supported versions. An initial migration should have test and acceptance criteria. A project should not enter the full service-fee period while critical functions remain uninstalled if contractual acceptance is required.

Availability commitments

Define the uptime percentage, calculation period, excluded circumstances and monitoring source. Monthly 99.9 percent availability differs from an annual measurement. Scheduled maintenance and external connection failures require express treatment. Make clear when downtime starts and ends and which logs control a dispute.

Incident response

Classify critical outage, partial degradation and security incident separately. Set realistic acknowledgement, escalation and reporting commitments. A fifteen-minute response time is not a promise to restore service in fifteen minutes. Identify decision-makers and contact arrangements for after-hours emergencies.

Recovery time objective

Recovery time objective describes the target period for restoring service after a qualifying disruption. It must correspond to funded infrastructure and tested procedures. A business-critical legal or payment application may require a shorter objective than a marketing microsite. The customer should identify which functions must return first.

Recovery point objective

Recovery point objective measures the acceptable data-loss interval. Hourly backups may permit more loss than continuous replication, subject to actual architecture. A provider should describe the database and file systems covered. The customer should not assume a quick restart restores all data from the moment of failure.

Backups and testing

Allocate creation, storage, retention and testing responsibilities. Replication can reproduce corrupted or deleted records; it is not always an independent restore point. Require periodic restoration tests, secure copies and a documented process for customer-requested exports. Define the treatment of damaged backups and errors discovered too late.

Ownership of customer content

The customer generally expects to retain rights in its uploaded records, software and intellectual property. Hosting is not a transfer of ownership. Any licence to process data should be limited to delivering the service or other expressly authorised purposes. AI training or reuse of confidential content requires separate legal and contractual assessment.

Cybersecurity duties

Define encryption, multifactor authentication, vulnerability handling, administrator access, event logging and incident investigation. The controls should match each party's technical responsibility. A cloud provider should not promise all risks disappear; a customer should not be made responsible for infrastructure controls it cannot access.

Breach communication

Set an incident notification framework identifying triggers, initial information and updates. There is no single notification interval that applies automatically to every Pakistani business. Financial regulators and foreign customer contracts may impose additional rules. A provider should give verified facts promptly without inventing complete forensic findings prematurely.

Third-party providers

Identify major subprocessors, hosting regions and onward service providers. The agreement should explain how customer information may be accessed and what happens when the provider changes a material subprocessor. Sector rules and foreign legal obligations may affect the ability to transfer data outside a particular jurisdiction.

Service credits

Availability failure may trigger credits against fees. Specify the formula, claim deadline and whether credits are exclusive remedies. A small credit cannot necessarily compensate for a substantial loss of customer records. The customer must decide whether the commercial risk is acceptable before contracting.

Liability allocation

A contract may cap liability, exclude indirect loss or contain special treatment for confidentiality, intellectual property and deliberate misconduct. Evaluate whether the cap realistically corresponds to possible exposure. Mandatory law cannot necessarily be avoided by a broad disclaimer. If the provider handles business-critical data, consider separately negotiated remedies and appropriate insurance.

Force majeure

Genuine extraordinary events may affect obligations, but ordinary hardware failure should not automatically be force majeure where redundancy was part of the service promised. The clause should require notice, mitigation and treatment of prolonged interruption. The customer may need the right to migrate if outages continue.

Regulatory inspection

A bank or licensed intermediary may need regulator access to relevant outsourced operations and data. The cloud contract should support lawful audit and preserve records. Confidentiality clauses should not prevent statutory inspection, while access to unrelated customer material requires safeguards. A supplier's standard refusal to permit any audit may make it unsuitable for a regulated service.

Data retention and deletion

Specify what happens to active files, logs and backups after account closure. A deletion commitment must reflect real systems and any lawful retention obligations. The provider should disclose when backups expire and what copies remain. Customers may need to preserve records for pending litigation or regulatory inquiries before deletion.

Exit and portability

Define export formats, access period, migration assistance and transition fees. Business-critical records should not become commercially inaccessible merely because parties disagree over an unrelated invoice. The agreement should permit practical retrieval and controlled transition, subject to valid security and payment rights.

Example: law firm platform

A practice-management service stores litigation documents and deadlines. A prolonged outage prevents access to filed evidence. The firm should assess uptime measurement, backup restoration, escalation and remedies, alongside client confidentiality. A vendor's monthly service credit may not adequately address operational damage. The contract should recognise the sensitivity of legal work.

Opinion and recommendation

A cloud agreement must define actual services, measurable availability, recovery objectives, security, data rights, liability and orderly exit. For regulated customers, sector outsourcing requirements should be incorporated. Negotiate around a realistic failure scenario, not merely the advertised uptime percentage.

Principal authorities: Contract Act, 1872; applicable confidentiality and intellectual property law; Prevention of Electronic Crimes Act, 2016 where relevant; SBP and SECP outsourcing and cybersecurity requirements for regulated customers.