How To Limit Liability In Managed IT Services

Yes, you can limit liability in a managed IT services agreement in New Zealand. A well drafted managed IT services liability clause can help protect your business if a client suffers downtime, data loss, a cyber incident or a third party platform failure.

The part that needs care is making the clause match the real risks of managed IT work. A general cap on liability might help, but it may not deal properly with service credits, backup responsibilities, security assumptions, client delays or the parts of the stack you don't control.

If you're providing IT support, your contract should be clear about what you're responsible for, what you're not responsible for, and what happens when something goes wrong. That clarity can make a huge difference when a client is losing money and looking for someone to blame.

Can A Managed IT Provider Limit Liability For Downtime?

Yes, you can usually limit liability for downtime, but your contract needs to spell out how the limit works and what counts as downtime.

Downtime is one of the biggest liability risks for managed service providers because the financial loss can quickly exceed your monthly fee. If a client's email, point of sale system, server, website or cloud environment goes down, they may say they lost sales, staff productivity or customers.

Your managed services agreement should deal with questions like:

• What services are covered by your uptime commitment?
• Is downtime measured monthly, weekly or per incident?
• Does scheduled maintenance count as downtime?
• Do outages caused by the client, their staff or their other suppliers count?
• What is the client's remedy if you miss the service level?

A common approach in a service level agreement is to use service credits for missed service levels. For example, if you commit to 99.5% uptime for a hosted service, the client might receive a credit against next month's fees if actual uptime falls below that level.

The key is to say whether the service credit is the client's only remedy for that service level failure. If you don't say this clearly, a client may try to claim service credits and additional losses on top, such as lost profits or compensation paid to their own customers.

What Should A Managed IT Services Liability Clause Cover?

Your liability clause should cover the specific ways managed IT work can go wrong, not just use a broad one size fits all cap.

Managed services are different from many other business services because you often sit close to your client's systems, data, users and security controls. That means your agreement should deal with the practical risk areas directly.

Downtime And Outages

Your IT services agreement should separate downtime you can control from downtime you can't control. For example, you may be able to control your response times, monitoring processes and escalation steps. You may not be able to control a Microsoft 365 outage, an internet provider failure or a client unplugging hardware during office renovations.

Your IT outage liability clause should clearly exclude outages caused by:

• scheduled maintenance notified to the client
• emergency maintenance needed to protect systems
• third party software, hosting, telecommunications or cloud providers
• client equipment, networks or user behaviour
• the client's failure to follow your reasonable instructions
• cyber attacks that weren't caused by your breach of the agreement

Cyber Incidents

Cyber liability needs careful wording. You may provide security tools, patching, monitoring or incident response, but you usually can't promise that a client will never be hacked.

Your agreement should be clear that security services reduce risk but don't eliminate it. It should also state the client's responsibilities, such as using strong passwords, enabling multi factor authentication, training staff, maintaining cyber insurance and approving recommended security updates.

Data Loss And Backups

Data loss is a high risk area because the client's expectation may be very different from what your service actually includes. If you provide backups, your agreement should say what is backed up, how often, how long backups are kept, and what recovery targets apply.

For example, a daily backup is very different from a real time backup. If a client expects no data loss but only pays for a basic daily backup, that mismatch needs to be fixed in the contract before something goes wrong.

Third Party Software And Platforms

Many managed IT services depend on tools you don't own, such as cloud platforms, antivirus software, remote monitoring tools, ticketing systems, payment systems and productivity suites.

Your contract should make it clear that you aren't liable for failures, changes, price increases, outages or discontinued features in third party products, except where the issue was caused by your own breach or negligence. You should also reserve the right to change equivalent third party tools where needed, as long as the service level remains reasonably similar.

How Do Liability Caps Work In An IT Support Contract?

A liability cap sets a maximum amount your business may have to pay if something goes wrong under the contract.

For managed IT services, the cap is often linked to the fees the client pays you. Common examples include:

• the fees paid in the 3 months before the claim
• the fees paid in the 6 or 12 months before the claim
• the fees paid for the affected service only
• a fixed dollar amount linked to your insurance cover

There isn't one perfect number for every MSP. A 12 month fee cap may suit a higher value, higher risk support arrangement. A 3 or 6 month fee cap may be more appropriate for a low cost helpdesk service with narrow responsibilities. If you handle sensitive data or business critical systems, you'll usually need a more tailored approach.

Say Anika runs a managed IT provider in Christchurch. She charges a client $1,500 per month for remote support, endpoint protection and backup monitoring. If her contract caps liability at 12 months' fees, her maximum exposure for most claims is $18,000. Without a cap, the client might argue for hundreds of thousands of dollars in lost revenue after an outage, even though Anika's annual fees are only a fraction of that amount.

You may also want different caps for different risks. For example:

• a general cap for ordinary service issues
• a higher cap for confidentiality or privacy breaches
• an uncapped position for unpaid fees owed by the client
• no cap for fraud or intentional wrongdoing

This structure often works better than trying to force every risk into the same limit.

How Should Your SLA Deal With Liability?

Your service level agreement should turn service promises into clear, measurable obligations and set out the remedy if you miss them.

An SLA isn't just a customer service document. It directly affects your liability because it tells the client what standard you're promising to meet. If the SLA is vague, the client may assume you promised more than you intended.

Your SLA should define key items such as:

• support hours, including public holidays and after hours support
• response times and resolution targets
• priority levels for incidents
• uptime commitments, if any
• maintenance windows
• client responsibilities for access, approvals and information
• how service credits are calculated

Be careful with response and resolution times. A response time means when you acknowledge or start working on an issue. A resolution time means when the issue is fixed. If you promise a 2 hour resolution for every critical incident, that may be unrealistic when the problem depends on a third party vendor, hardware replacement or the client's own network.

A more practical structure is often:

• Priority 1: major outage affecting the whole business, with urgent response and continuous work during support hours
• Priority 2: significant issue affecting a team or important function
• Priority 3: standard user or device issue
• Priority 4: low priority requests, changes or general questions

Your SLA liability wording should also say that service credits don't apply where the failure was caused by excluded events, such as client delays, third party outages, unauthorised changes, force majeure events or the client's failure to maintain required licences.

Can You Exclude Liability For Cyber Incidents Or Data Loss?

You can often limit liability for cyber incidents and data loss, but you usually shouldn't try to exclude all responsibility for them.

If your business is paid to provide cybersecurity, backup or monitoring services, a blanket exclusion for all cyber incidents or all data loss may be commercially unrealistic. It can also undermine trust with clients. A better approach is to define exactly what your service includes and then limit liability around that scope.

For cyber services, your agreement should explain:

• which tools and controls you're supplying
• whether you provide monitoring, alerts or active response
• whether patching is automatic or requires client approval
• what security responsibilities stay with the client
• what happens if the client rejects or delays your recommendations

For backups, your agreement should explain:

• what data is backed up
• how often backups run
• where backups are stored
• how long backups are retained
• the recovery point objective and recovery time objective, if you offer them
• whether test restores are included

If you don't provide backups, say so clearly. If you only monitor backup alerts from another provider, say that too. Many data loss claims start because the client thought backup management was included when it wasn't.

What NZ Laws Can Affect Your Limitation Clauses?

New Zealand law generally allows businesses to agree on liability limits, but some laws can affect how far your clauses can go.

The Fair Trading Act 1986 is a key one. You can't use a liability clause to make misleading statements acceptable. For example, if your proposal says you provide 24/7 monitoring, but your contract quietly narrows that to business hours checks only, that mismatch can create risk.

The Fair Trading Act also has unfair contract term rules. These can apply to standard form consumer contracts and small trade contracts. For small trade contracts, the rules can apply where both parties are in trade and, when the trading relationship first arises, it provides for or is more likely than not to involve consideration of less than $250,000 in any 12 month period. If a term is unfair, the Commerce Commission can seek court orders and the term may not be enforceable.

This doesn't mean liability caps are banned. It means they should be reasonably balanced, transparent and tied to the commercial deal. A clause that caps all liability at $100 while you provide business critical IT support may be harder to defend than a cap linked to fees and paired with clear service descriptions.

The Consumer Guarantees Act 1993 can also matter. If your client is acquiring services for business purposes, you may be able to contract out of the CGA, but it needs to be in writing and fair and reasonable. If you work with consumers, different rules apply and you need more care.

The Privacy Act 2020 matters if you handle personal information for clients, such as staff records, customer databases, support tickets or access logs. If there's a notifiable privacy breach, the organisation that holds the personal information may need to notify the Privacy Commissioner and affected people if the breach has caused, or is likely to cause, serious harm.

Your managed service provider agreement should deal with privacy roles, security measures, data handling, subcontractors, breach notification and cooperation. Even if your client has the main privacy obligations, your contract should explain what you'll do if you discover a security incident involving personal information.

Common Mistakes To Avoid In A Managed Service Provider Agreement

The most common mistake is using a generic service agreement that doesn't reflect how managed IT services actually work.

Templates can be a useful starting point, but they often miss the details that matter for IT support, SLAs, cyber risk and third party platforms. Watch out for these issues:

• No clear scope: the client assumes everything is included, while you assume it's out of scope.
• No client responsibilities: the contract doesn't say the client must provide access, approvals, passwords, licences or accurate information.
• Unrealistic SLAs: response times and resolution targets don't match your staffing, tools or supplier dependencies.
• No third party exclusions: you're left exposed for cloud, internet, software or hardware failures you didn't cause.
• Weak backup wording: the contract doesn't say what is backed up, how often or what recovery looks like.
• No service credit structure: the client may claim broad losses instead of a defined credit.
• No privacy process: the contract doesn't say how security incidents involving personal information will be handled.

Your agreement should also deal with payment, suspension for non payment, changes to the service, onboarding, offboarding, intellectual property, confidentiality, subcontractors and acceptable use. These aren't just legal extras. They help your service run smoothly day to day.

Key Takeaways

• You can usually limit liability in a managed IT services agreement, but the clause should match the real risks of IT support, outages, cyber incidents and data loss.
• Your SLA should clearly separate response times, resolution targets, uptime commitments and service credits.
• Service credits should say whether they're the client's only remedy for missed service levels.
• Liability caps often work best when linked to fees, insurance or the affected service, with different caps for different risks.
• New Zealand laws such as the Fair Trading Act 1986, Consumer Guarantees Act 1993 and Privacy Act 2020 can affect how your clauses work.
• Clear client responsibilities are just as important as exclusions, especially for security, backups, access and third party platforms.

If you'd like help with managed services agreements, SLA liability clauses, privacy and data protection terms, or software supplier terms, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.