Limitation of liability clauses explained: examples, carve-outs, and how to negotiate

What a limitation of liability clause actually does

A limitation of liability (LoL) clause caps how much one party can recover from the other when something goes wrong. It usually has two moving parts: a cap on direct damages (a dollar figure or a multiple of fees paid) and a waiver of indirect / consequential damages (lost profits, lost data, business interruption). Together they decide the worst-case financial exposure on the contract.

A typical SaaS example

Except for the Excluded Claims, each party's total aggregate liability arising out of or related to this Agreement shall not exceed the fees paid or payable by Customer to Vendor in the twelve (12) months preceding the event giving rise to the claim. In no event shall either party be liable for any indirect, incidental, special, consequential, or punitive damages, including lost profits or lost data.

That's a 1× 12-month fees cap with a mutual consequential-damages waiver — the market default for mid-market SaaS.

Common cap shapes

• 1× fees paid (last 12 months) — vendor-friendly, default in most SaaS order forms.
• 2×–3× fees paid — typical after a customer redline; still standard for regulated buyers.
• Super-cap — a higher cap (often 5×–10× fees, or a fixed dollar amount) that applies only to specific high-risk categories such as data-breach or IP indemnity.
• Uncapped — reserved for the carve-outs below.

Carve-outs that should always sit above the cap

A cap without carve-outs is a blank cheque for bad behaviour. Insist on uncapped (or super-capped) liability for:

1. Breach of confidentiality — especially for regulated data.
2. IP infringement indemnity — the vendor should stand behind what they built.
3. Data-protection / privacy breach — GDPR and CCPA fines are potentially uncapped, so the contract shouldn't shield the party that caused them.
4. Gross negligence, willful misconduct, and fraud — most jurisdictions won't enforce a cap on these anyway; make it explicit.
5. Payment obligations — the customer's duty to pay fees owed should never be capped.

Red flags in a limitation of liability clause

• One-sided cap — the clause caps the vendor's liability but leaves the customer exposed (or vice versa).
• Cap below one month of fees — anything less than 3× monthly fees is effectively no remedy.
• Consequential-damages waiver with no carve-outs — waives lost profits even for confidentiality breach or data loss.
• Aggregate cap that includes indemnities — folds the IP / privacy indemnity into the same small bucket as the general cap.
• "Sole and exclusive remedy" language — pairs the cap with a waiver of every other legal remedy the customer might have.

How to negotiate the cap

1. Anchor on risk, not fees. Ask: what's the realistic worst-case loss if this vendor fails? If a breach could cost you $2M, a $50K cap is meaningless.
2. Start at greater of 2× fees or a floor. "The greater of 2× fees paid in the prior 12 months or USD 250,000" gives a meaningful floor on small contracts.
3. Get uncapped carve-outs for the five categories above. Vendors will push back on data-breach; a super-cap (e.g., 5× fees) is a common compromise.
4. Make the cap mutual. Both parties should be subject to the same cap, subject to the same carve-outs.
5. Match the cap to the indemnity. The IP and privacy indemnity is worthless if it's subject to a 1× fees cap.

Quick-reference checklist

• Cap is at least 1× 12-month fees, mutual, and stated in a specific currency.
• Consequential-damages waiver is mutual.
• Confidentiality, IP indemnity, data breach, gross negligence, willful misconduct, fraud, and payment obligations are carved out of the cap and the consequential-damages waiver.
• Any super-cap is explicitly stated (e.g., 5× fees for data-breach claims).
• The clause is not the "sole and exclusive remedy" — customers keep injunctive relief and statutory remedies.
• The cap references fees paid (not "fees payable under this order form"), so it isn't gamed by future SOWs.

Related reading

For a deeper look at how to size the cap itself — 1×, 3×, super-caps, and the four carve-outs that make a cap meaningful — see Liability caps explained. If you want an AI to check these clauses for you, ContractScan AI surfaces cap size, missing carve-outs, and one-sided waivers automatically on every upload.