Can IT Support Providers Limit Liability?

Can you really cap your liability if a client's system goes down, data is lost, or a third party platform stops working?

Yes, you usually can limit a lot of that risk in your IT support contracts - as long as the clause is clear, fair and matched to what you're actually promising. The key isn't to rely on a one-line disclaimer and hope it covers every possible outage.

Managed IT support comes with real pressure. Your clients trust you with critical systems, but you're often working with software, hardware, internet services, staff behaviour and cyber risks you don't fully control.

A well-drafted IT support services agreement helps set those boundaries early, so your client understands what you're responsible for, what they're responsible for, and what happens if something goes wrong.

Can IT Support Providers Legally Limit Their Liability In New Zealand?

Yes, IT support providers in New Zealand can often limit their liability in a contract, but not for everything and not in any way they like.

New Zealand law generally allows businesses to agree on risk allocation in commercial contracts. That means your Managed Services Agreement, IT support terms and conditions, or service agreement can usually include clauses that:

• cap your financial liability at a set amount
• exclude certain types of loss, such as lost profits or business interruption
• limit remedies to re-performing the service or providing service credits
• exclude responsibility for things outside your control, such as third party vendor outages
• set client responsibilities for passwords, backups, updates and access

However, your limitation clause still needs to sit within the wider law. For example, the Fair Trading Act 1986 prohibits misleading or deceptive conduct. If your marketing promises "24/7 guaranteed protection" but your contract says you don't guarantee availability or security, that mismatch can cause problems.

The Consumer Guarantees Act 1993 can also matter. If you're providing services to a consumer, you generally can't contract out of the consumer guarantees. If you're contracting with another business and the services are being acquired for business purposes, you may be able to contract out, but it needs to be in writing and fair and reasonable.

The Fair Trading Act also includes rules about unfair contract terms in standard form small trade contracts. If you're using take-it-or-leave-it terms with small business clients, a one-sided liability clause could be challenged if it goes further than reasonably needed to protect your business.

So, the answer is yes - but the clause needs to be drafted carefully, not just copied from another IT provider's agreement.

What Should A Managed Services Agreement Say About Liability?

A Managed Services Agreement should clearly say what services you're providing, what you're not providing, and how liability is capped if something goes wrong.

For IT support providers, liability issues usually come from a few predictable areas:

• outages and downtime
• data loss or failed backups
• cyber incidents, including ransomware and phishing
• third party software or cloud platform failures
• missed response times
• scope creep, where the client expects services that were never included

Your agreement shouldn't treat all of these risks the same way. A password reset ticket is very different from a managed backup failure affecting years of business records.

Core Documents To Use

Most IT support providers need a small suite of documents, not one overloaded document that tries to do everything. Depending on your business model, you may need:

• Managed Services Agreement: the main contract for ongoing IT support, monitoring, maintenance and support services
• Support Terms And Conditions: standard terms for ad hoc support or smaller clients
• Statement Of Work: the scope, fees, deliverables and assumptions for a specific project or client
• Service Level Agreement: response targets, support hours, exclusions and service credits
• Data Processing Or Privacy Schedule: how personal information is handled, security responsibilities and privacy breach cooperation
• Acceptable Use Or Client Responsibilities Policy: what the client must do to keep systems secure and accessible

Templates can be a helpful starting point, but an IT services agreement works best when it matches your actual services. If your business offers cyber monitoring, managed backups, Microsoft 365 administration and hardware support, your risk profile won't be the same as a simple helpdesk provider.

How Much Should You Cap Your Liability At?

It depends on your services, pricing and risk, but many IT support providers cap liability by reference to fees paid over a recent period.

Common approaches include:

• a cap equal to the fees paid by the client in the last 3 months
• a cap equal to the fees paid in the last 6 or 12 months
• a fixed dollar cap, such as $5,000 or $20,000
• the amount recoverable under your professional indemnity or cyber insurance, where appropriate
• separate caps for different risk categories, such as privacy, confidentiality and general service issues

For example, if a client pays you $850 a month for helpdesk and monitoring, it may not be commercially sensible for you to accept uncapped liability for a week of lost revenue if their systems fail. A 12-month fee cap would limit your exposure to $10,200, unless a carve-out applies.

That said, a cap shouldn't be set so low that it looks unfair or inconsistent with the deal. If you manage a client's backups, security patching and cloud environment, a $500 cap may be difficult to justify, especially if the client is relying on you for critical systems.

Should You Use One Cap Or Several Caps?

Several caps can work better than one cap where your services carry different levels of risk.

For example, your agreement might say:

• general liability is capped at 12 months of fees
• liability for privacy or confidentiality breaches is capped at a higher amount
• service level failures are dealt with through service credits as the client's sole remedy
• unpaid fees, fraud and deliberate wrongdoing aren't capped

This can feel more balanced to clients because you're not saying "we're never responsible". You're saying the risk needs to be proportionate to the fees, the service and the issue.

Can You Exclude Liability For Outages And Downtime?

Yes, you can usually limit liability for outages and downtime, especially where the outage is caused by third party systems, scheduled maintenance, the client's own equipment or events outside your control.

Your contract should be specific about what counts as downtime and what doesn't. For example, downtime might exclude:

• planned maintenance windows
• emergency maintenance needed to protect systems
• internet service provider outages
• cloud platform outages, such as Microsoft, Google, AWS or another vendor
• failures caused by the client's hardware, software or network configuration
• failures caused by the client delaying approvals, access or payment
• security incidents caused by compromised credentials or unsafe user behaviour

If you offer service levels, be careful with the wording. A response time isn't the same as a resolution time. If you promise to respond within 2 hours, that should mean you'll acknowledge and start assessing the ticket within that time. It usually shouldn't mean you'll fix the issue within 2 hours unless you're genuinely prepared to guarantee that.

Service credits in a service level agreement can be useful here. Instead of the client claiming broad losses for downtime, your contract can say their remedy for a service level failure is a credit against future fees. This gives the client something meaningful while keeping your risk measurable.

Say Aroha runs a small managed IT business in Wellington. One of her clients loses access to its cloud accounting platform for half a day because the software vendor has a regional outage. If Aroha's agreement clearly excludes third party platform downtime and says service credits only apply to failures within her reasonable control, she's in a much stronger position than if her contract simply says "reliable IT support".

Can You Limit Liability For Data Loss And Failed Backups?

Yes, but you need to be especially clear because data loss is one of the highest-risk issues for IT support providers.

If you provide backup or maintenance services, your agreement should explain exactly what you're promising. Vague wording like "we take care of your backups" can create unrealistic expectations. Stronger wording will usually cover:

• what systems, folders, servers or accounts are included
• how often backups are scheduled
• how long backups are retained
• what is excluded, such as personal devices or unsupported software
• the client's responsibility to tell you about new systems or data locations
• whether test restores are included and how often they happen
• the recovery point objective, meaning how much data could be lost between backups
• the recovery time objective, meaning how long restoration may take

You should avoid promising that data can always be recovered. Backups can fail for reasons outside your control, including corrupted source data, vendor issues, client misconfiguration, expired licences, lack of storage, or ransomware already present in the backed-up environment.

A practical clause might say that you don't guarantee complete data recovery, and that your liability for data loss is limited unless the loss was directly caused by your breach of the agreement. Depending on the service, you may also want a separate cap for backup-related claims.

It's also sensible to require the client to check backup reports, notify you of missing data sources and keep separate copies of critical information where appropriate. This isn't about shifting all risk to the client. It's about making sure both sides understand that backups are a shared operational responsibility.

What About Cyber Incidents And Privacy Breaches?

You can limit liability for cyber incidents, but your contract shouldn't overpromise security or ignore your privacy obligations.

Cybersecurity is a good example of why wording matters. If your website says you "prevent ransomware" or "guarantee complete protection", a client may argue they relied on that promise. A safer approach is to describe your services accurately, such as monitoring, alerting, patch management, endpoint protection configuration or incident support.

Under the Privacy Act 2020, a business that holds personal information must take reasonable steps to protect it. If a privacy breach is likely to cause serious harm, the agency must notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of the breach.

In an IT support relationship, your client may be the main agency responsible for personal information, but you may also hold, access or process that information. Your contract should set out:

• what personal information you can access
• how you'll protect credentials and systems
• when you'll notify the client of a suspected security incident
• who deals with Privacy Commissioner notifications
• what assistance you'll provide during an investigation or response
• whether extra incident response work is included or charged separately

For higher-risk clients, such as health providers, finance businesses or online platforms, it may make sense to have a higher liability cap for confidentiality, privacy and security obligations. Some clients will ask for these obligations to be uncapped. Whether that's reasonable depends on the size of the contract, your insurance and the level of control you have over the client's systems.

Can You Exclude Third Party Software And Vendor Issues?

Yes, you can usually exclude or limit liability for third party software and vendor issues, provided your contract explains this clearly.

IT support providers often sit between the client and vendors like Microsoft, Google, Xero, MYOB, antivirus providers, internet providers and hardware manufacturers. You may configure, support or administer those tools, but you don't control their uptime, pricing, product changes or licence terms.

Your agreement should say that third party products are subject to the vendor's own terms. It should also make clear that you're not responsible for:

• vendor outages or service degradation
• changes to third party features, pricing or licence conditions
• security vulnerabilities in third party products, unless you agreed to manage them and failed to do so
• losses caused by the client's breach of a vendor licence
• delays in vendor support or warranty processes
• compatibility issues caused by unsupported or outdated systems

This doesn't mean you can ignore vendor-related support altogether. If you've agreed to manage a Microsoft 365 tenancy, apply security settings or monitor alerts, you still need to do those things with reasonable care and skill. The point is to separate your responsibilities from the vendor's responsibilities.

The Fair Trading Act 1986 matters here too. If you're reselling or recommending software, don't exaggerate what it can do. Your client contract, including any service agreement, should line up with your sales emails, proposal and website wording.

Which Losses Should Your IT Services Contract Exclude?

Your IT services contract should usually exclude losses that are too broad, unpredictable or disproportionate to your fees.

Common excluded losses include:

• loss of profit
• loss of revenue
• loss of business opportunity
• loss of goodwill or reputation
• business interruption losses
• loss of anticipated savings
• indirect or consequential losses
• losses caused by third party systems or services

Be careful with the phrase "consequential loss" on its own. It can lead to arguments because people don't always agree on what it means. It's usually better to list the specific losses you're excluding, then also refer to indirect or consequential loss.

You should also decide what isn't excluded. Clients will often expect carve-outs for things like:

• your unpaid fees
• breach of confidentiality
• misuse of intellectual property
• privacy and data protection breaches
• fraud or deliberate misconduct
• liability that can't legally be excluded

These carve-outs don't always need to be unlimited. For some businesses, a higher separate cap is more manageable than an uncapped obligation. The right position depends on your services, client base, insurance and negotiating power.

Common Mistakes To Avoid

The biggest mistake is assuming a liability clause will protect you if the rest of the contract is unclear.

Watch out for these common issues:

• Promising outcomes you can't control: avoid guarantees like no downtime, no cyber incidents or full data recovery unless you're prepared to stand behind them.
• Using the same cap for every client: a small helpdesk client and a large managed infrastructure client may need different caps.
• Forgetting client responsibilities: your client should be responsible for user behaviour, access, approvals, unsupported systems and telling you about changes.
• Mixing response times with fix times: make sure your service levels don't accidentally promise a resolution by a set time.
• Ignoring the Consumer Guarantees Act: if the client is acquiring services for business purposes and you want to contract out, it needs to be handled properly.
• Letting marketing overtake the contract: your proposal, website and onboarding documents shouldn't make bigger promises than your agreement.
• Not checking insurance: your liability cap, exclusions and professional indemnity or cyber cover should work together.

A clear contract also helps with client relationships. When everyone knows what's included, what costs extra and what risks sit outside your control, you're less likely to face difficult conversations after an outage.

Key Takeaways

• IT support providers in New Zealand can often cap liability, but the clause needs to be clear, fair and suited to the services.
• Your agreement should deal directly with outages, data loss, failed backups, cyber incidents and third party software issues.
• Service levels should distinguish response times from resolution times, and service credits can help keep remedies predictable.
• Privacy and cybersecurity clauses should reflect the Privacy Act 2020 and avoid promising complete protection.
• Consumer Guarantees Act and Fair Trading Act issues can affect how far you can limit liability, especially with standard terms and smaller clients.
• Your liability cap should match your fees, insurance, risk profile and the client's reliance on your services.

If you'd like help with your managed services agreement, IT support terms, service levels or privacy and cyber clauses, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.