Cloud computing moves software or infrastructure away from the customer's own premises to a shared environment controlled by a third party, accessed over the internet or a private network. Instead of capital spend or a licence fee, the customer typically pays on subscription. The three main types, software as a service (SaaS), platform as a service (PaaS) and infrastructure as a service (IaaS), are usually layered: a SaaS product runs on a PaaS, which in turn runs on IaaS. A customer signing up for SaaS often has no visibility of that chain at all, only a login page and a monthly invoice.
That layering is part of why cloud agreements are harder to review than they first appear. The questions a lawyer needs to ask shift with each layer: where the data actually sits, who controls it, and what happens if something goes wrong.
The complimentary Practice Note, How to review a cloud computing agreement, produced in partnership with Knut Fournier of Pantheon Chambers, works through the due diligence, contractual, and practical points a review should cover, and flags where suppliers tend to push back.
What should due diligence cover before the contract is even drafted?
A proper review starts before the contract is even on the table. The Practice Note works through what to ask about a supplier's track record, its data centres and backup arrangements, its financial standing, and how far it's willing to go on security, along with the questions most suppliers will simply decline to answer in full.
Why does the service description matter more than it looks?
Commoditised cloud suppliers rarely offer much detail on what they're actually providing, and warranties are harder to come by than in most commercial contracts. The Practice Note sets out what a description needs to cover at minimum, and where a customer still has room to negotiate, particularly around a supplier's right to change the service on its own terms.
Who carries the risk when the data protection questions get complicated?
Customers stay on the hook for regulatory risk even after a supplier takes possession of their data, and cloud arrangements typically run through a chain of sub-contractors that makes accountability harder to pin down. The Practice Note explains what a customer needs in the contract to manage that exposure.
What happens if the relationship ends, or the service goes down?
Getting data back in a usable format on termination is not automatic, and outages can come from anything between a cyber-attack and a software bug. The Practice Note covers what protections are available, including how escrow, once reserved for on-premise software, has been adapted for SaaS.
What else is worth checking before signing?
Liability, warranties, suspension and termination rights, and governing law all deserve scrutiny before anyone signs. The Practice Note flags where these terms tend to favour the supplier by default, and where that can still be negotiated.
How Lexis+ Practical Guidance Hong Kong helps
The Technology, Media & Telecommunications (TMT) module of Lexis+ Hong Kong Practical Guidance is built for lawyers advising on technology, data and digital issues in real legal workflows. It gives practitioners access to practical guidance, precedents, checklists, playbooks, and issue spotters across fintech and cryptoassets, data protection and privacy, cybersecurity and cybercrime, AI governance, and digital media.
For deeper research and more efficient drafting, Lexis+ with Protégé brings legal research, document analysis, summarisation, and drafting into one platform. Protégé can help practitioners work with uploaded agreements, compare supplier drafts, generate timelines, and move from research to work product with greater confidence.
Complete the form below to download the full Practice Note, How to review a cloud computing agreement.
Note: After completing the form, the whitepaper will appear on the same page. Please stay on the page after submission. If you do not see the whitepaper, contact us at marketing.hk@lexisnexis.com for assistance.