MSA Drafting for Tech Companies: Which Clauses Actually Carry the Risk?

By LegalInk Editorial · 2026-08-31

MSA Drafting for Tech Companies: Which Clauses Actually Carry the Risk?

Five clauses carry most of the legal risk in a technology MSA: intellectual property ownership, indemnity, limitation of liability, Digital Personal Data Protection Act compliance, and termination. Get these right and the statements of work that follow inherit sound default terms; leave a gap in any one and that gap propagates across every project order for the life of the relationship. This is the drafting failure corporate counsel see most often in vendor MSAs.

The enforceability of these agreements is governed by the Indian Contract Act, 1872. The Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 add obligations that must sit in the MSA itself — not in a data processing addendum that parties often never execute.

Why the MSA Is the Highest-Stakes Document in the Engagement

Unlike a standalone project contract, the MSA sets default terms that cascade across every subsequent transaction with a counterparty. A weak IP or liability clause negotiated once will govern dozens of individual statements of work, often for years. Counsel reviewing vendor MSAs frequently underestimate this multiplier effect and treat the MSA as boilerplate.

Intellectual Property: Ownership, Licence, and Background IP

IP is where negotiations stall most often, and for good reason. Under Indian law, IP created by a contractor vests in the contractor unless expressly assigned in writing. Without a clear assignment clause, a vendor retains ownership of custom code, configurations, and deliverables — even when the client has paid in full.

Background IP vs. Foreground IP

Distinguish the two categories explicitly:

• Background IP: Pre-existing technology, tools, frameworks, and methodologies the vendor brings into the engagement. The client should receive a limited, non-exclusive licence to use it only to the extent necessary to enjoy the deliverables.
• Foreground IP: New IP created specifically for the client. The MSA should state whether this is assigned or licensed, and if assigned, set out the mechanics — consideration, timing, and any registration obligations.

Assignment Must Be Express

Indian law has no statutory "work-for-hire" doctrine equivalent to US copyright law; assignment must be express. Under the Copyright Act, 1957, an assignment of copyright must be in writing and signed by the assignor. Ensure the MSA, or an exhibit to it, constitutes that written assignment — not a vague promise to "execute further documents" later.

Indemnity: Scope, Carve-Outs, and Procedure

Indemnity clauses in tech MSAs typically cover IP infringement claims, data breaches, and gross negligence or wilful misconduct. The drafting risk lies in overbroad indemnities that quietly negate the limitation of liability clause.

Limit indemnity obligations to claims arising from the indemnifying party's breach, negligence, or wilful act. Reciprocal indemnities — each party covering the other for its own IP infringement — are generally preferable to one-sided client-protective drafts.

Always include a procedural condition: the indemnified party must promptly notify the indemnifier of any claim, grant sole control of the defence, and cooperate reasonably. An indemnifier who is not notified promptly and is denied control of the defence has a real argument to resist the obligation.

Finally, carve out claims arising from the client's misuse of deliverables, unauthorised modifications, or use in combination with third-party products not specified in the statement of work.

Limitation of Liability: Setting and Protecting the Cap

Uncapped liability in a technology MSA is commercially untenable and, increasingly, uninsurable. The clause needs precision.

The standard construct caps each party's aggregate liability at fees paid or payable in the twelve months preceding the event giving rise to the claim. Mutual caps are preferable; asymmetric caps — a higher cap on the vendor — are common in enterprise software deals and should be flagged during review.

Exceptions to the Cap

Most MSAs except the following:

• Indemnity obligations for third-party IP infringement claims
• Breaches of confidentiality
• Gross negligence or wilful misconduct
• Death or personal injury caused by negligence

Each exception creates a pocket of uncapped exposure. Counsel should negotiate to narrow them, particularly the confidentiality carve-out — a breach by a junior employee could otherwise expose a party to unlimited liability.

Consequential loss exclusions (loss of profit, revenue, data, or goodwill) matter equally and should be drafted as mutual exclusions. One-sided waivers are routinely challenged and signal an imbalanced draft.

DPDP Compliance: Embedding Data Obligations in the MSA

The Digital Personal Data Protection Act, 2023 introduces a Data Fiduciary / Data Processor framework that must be reflected in every technology MSA where personal data is processed. Where the vendor processes personal data on behalf of the client, the MSA — or a binding data processing agreement incorporated by reference — must govern that relationship.

The MSA should specify:

• The nature, purpose, and duration of the processing
• The vendor's obligation to process personal data only on documented instructions from the client as Data Fiduciary
• Sub-processor restrictions and prior written consent requirements
• Security safeguards consistent with the vendor's DPDP obligations
• Breach notification: the Act requires notification to the Data Protection Board and affected Data Principals, so the MSA should allocate responsibility and set internal timelines
• Data return and deletion obligations on termination

Deferring DPDP compliance to an addendum "to be agreed" is a real risk. If it is never executed, the parties operate without a compliant processing framework. Use the LegalInk compliance framework for technology to map data processing obligations before the MSA is finalised.

Termination: Triggers, Consequences, and Continuity

Termination clauses must address three scenarios — for cause, for convenience, and for insolvency — each with a distinct notice period and consequence regime.

Termination for convenience, on 30 to 90 days' written notice, is standard. Clients should resist provisions letting vendors terminate for convenience mid-project without a transition period. Vendors should resist convenience clauses that omit payment for work completed to the termination date.

Termination for cause should require written notice of breach and a cure period (typically 15 to 30 days), except for breaches incapable of remedy, such as IP infringement continuing after notice.

Include a survival clause listing obligations that continue post-termination: confidentiality, IP ownership, indemnity, limitation of liability, and dispute resolution. Omitting it creates ambiguity about whether these protections remain enforceable once the agreement ends.

Draft your MSA with pre-built clause libraries — structured for Indian law and DPDP-aware by default.

Frequently Asked Questions

Does an MSA need to be stamped in India to be enforceable?

Stamping requirements vary by state. An unstamped or insufficiently stamped agreement is inadmissible as evidence but can typically be admitted on payment of the deficit duty and penalty. Ensure the MSA is properly stamped in the state where it is executed or where the principal place of business is located.

Can an MSA assign IP rights without a separate deed of assignment?

Yes, provided the MSA is in writing, signed by the assignor, and contains clear language of assignment rather than an agreement to assign. Under the Copyright Act, 1957, the assignment should identify the work, the rights assigned, the territory, and the duration. A well-drafted IP clause can satisfy these requirements directly.

What limitation of liability cap is standard in Indian technology contracts?

Market practice ranges from fees paid in the preceding six to twelve months for mid-market contracts to fixed monetary caps in large enterprise deals. There is no statutory floor or ceiling; the cap is entirely negotiated. Keep it mutual and the exceptions narrow.

Is a separate data processing agreement required under the DPDP Act?

No. The obligations can be embedded within the MSA or in a binding schedule to it. What matters is that the agreement exists, is executed, and contains the required provisions. A reference to a DPA "to be agreed later" does not satisfy the requirement.

MSA drafting for tech companies is not a template exercise. The IP, indemnity, liability, DPDP, and termination clauses interact — a gap in one creates exposure across the others. LegalInk at legalink.co.in provides structured drafting tools and compliance frameworks built for Indian corporate counsel working on exactly these agreements.

Statute citations in this article are verified against LegalInk's verified law registry before publication. Always confirm the current text of any provision before relying on it.

← Back to all posts