Limitation of liability clauses explained

Almost every liability clause does two distinct jobs, and it helps to read them separately.

• The exclusion: certain types of loss are off the table entirely — indirect, consequential, special, punitive, lost profits, lost data, loss of goodwill.
• The cap: whatever remains is limited to a maximum amount, typically expressed as fees paid in the preceding twelve months.

Direct damages flow naturally from the breach itself — the cost of buying replacement services, refunding what you paid. Consequential damages flow from your particular circumstances — the customer you lost, the production line that stopped, the reputational hit.

The line between them is genuinely blurry, and courts in different jurisdictions draw it differently. Lost profits are the perennial battleground: sometimes direct, sometimes consequential, depending on the deal and the forum. If a specific loss really matters to you, name it in the contract rather than relying on the category label.

Common market positions, roughly in order of how customer-friendly they are:

• Fees paid in the last 12 months — the most common SaaS default.
• Total fees paid under the agreement — better for the customer in later years.
• A multiple of annual fees (2x, 3x) — used where the customer's exposure clearly exceeds the contract value.
• A fixed sum — usual where fees are small but the risk is not.
• Fees paid in the last 3 months, or the amount of a single invoice — very supplier-friendly; question it.

The exceptions often matter more than the number. Standard, widely accepted carve-outs include death or personal injury caused by negligence, fraud and fraudulent misrepresentation, and anything a governing law says cannot be limited.

Frequently negotiated carve-outs include breach of confidentiality, IP infringement indemnities, data protection breaches, and gross negligence or wilful misconduct. Each one you add converts a capped risk into an uncapped one, so consider a separate super-cap — for example, three times annual fees for data breaches — instead of unlimited exposure.

Watch for a cap that limits the supplier's liability while leaving the customer's obligations, especially payment and indemnities, unlimited. That asymmetry is sometimes justified and is often just boilerplate nobody questioned.

Also check whether the customer's payment obligation is carved out of its own cap; if it is not, a cap can accidentally limit the amount the customer owes for services already received.

Courts can refuse to enforce a limitation clause. Typical grounds are unconscionability, a cap that leaves the other party with no meaningful remedy at all, statutory prohibitions (personal injury, consumer rights, some jurisdictions' treatment of gross negligence), and failure of essential purpose where the only agreed remedy turns out to be worthless.

A cap set so low that it is effectively an exclusion is the one most likely to be struck down — which is why setting it at a token amount can backfire on the party relying on it.