Vendor Contract Redlining: The 12 Clauses That Create the Most Liability in Indian MSAs

The money clauses

One: limitation of liability. The single most valuable clause in any MSA. It caps what you can owe if things go wrong, commonly at fees paid in the preceding twelve months. Check three things: that a cap exists at all, that it is mutual rather than protecting only the counterparty, and what is carved out of it, because carve outs, for confidentiality breach, IP infringement, indemnity claims, can quietly swallow the cap. A contract whose indemnity sits outside the cap has no cap for the claims most likely to occur. We dissect this interplay in our article on indemnity versus limitation of liability under Indian law. Two: consequential damages exclusion. The clause excluding indirect and consequential loss, lost profits, lost business, mirrors Section 73 of the Indian Contract Act, which already bars remote and indirect losses, but drafting it expressly avoids arguments about what was in the parties’ contemplation. Watch for one sided versions where only the vendor’s consequential liability is excluded while yours remains open. Three: indemnities. An indemnity is a promise to make the other side whole for defined losses, and under Sections 124 and 125 of the Contract Act it can operate without any breach at all, which makes broad indemnities more dangerous than breach claims. Redline the trigger words: an indemnity for losses arising out of or in connection with the services is an open field; an indemnity for losses caused by breach of this agreement, infringement of third party IP, or gross negligence is a fenced one. Insist that indemnity procedure requires notice, control of defence, and no settlement without consent. Four: payment terms and set off. Late payment interest, invoice dispute windows, and whether the customer may set off disputed amounts against undisputed invoices. Small enterprises should remember that the MSMED Act overrides any credit period beyond forty five days and imposes compound interest at three times the RBI bank rate, a lever we compute in our MSME interest article, and no MSA clause can contract out of it.

The ownership and secrecy clauses

Five: intellectual property. Who owns work product? The default expectations collide: customers assume they own what they paid for; vendors assume they keep their tools and templates. Clean drafting assigns deliverables to the customer upon payment, reserves the vendor’s pre existing IP and generic know how, and licences the reserved material to the extent embedded in deliverables. The classic ambush is the clause assigning everything including improvements to vendor tools, or, in the other direction, the vendor licence so narrow the customer cannot maintain its own system after termination. Six: confidentiality. Check the definition’s breadth, the term, confidentiality surviving three to five years post termination is common, trade secrets sometimes indefinitely, and the exceptions. Then check the remedy: confidentiality carved out of the liability cap is standard, but pair it with a materiality threshold so a trivial disclosure does not become an uncapped claim. Seven: data protection. Since the DPDP Rules 2025 started India’s compliance clock, every MSA touching personal data needs processor obligations: process only on instructions, security safeguards, breach notification to you within a defined window tight enough to let you meet your own seventy two hour reporting duty, deletion on termination, and audit rights. A vendor holding your customer data without these clauses is your penalty exposure wearing someone else’s logo, a theme our DPDPA compliance checklist develops.

The lifecycle clauses

Eight: term, termination, and transition. Look for asymmetry, the vendor terminating for convenience on thirty days while you are locked for three years, and for silence about what happens after termination: return of data, knowledge transfer, transition assistance at agreed rates. The worst vendor disputes are not about leaving; they are about being unable to leave, and exit drafting is cheapest at signature. Nine: service levels and remedies. SLAs without consequences are decoration. Check that service credits exist, that they are meaningful, and whether they are the exclusive remedy, because an exclusive remedy clause converts chronic failure into a small discount programme. Preserve termination rights for persistent SLA breach. Ten: force majeure. Post pandemic, everyone reads this clause. Check that it requires the event to actually prevent performance, not merely make it costlier, that payment obligations for services already rendered survive, and that extended force majeure, sixty or ninety days, gives you a termination right. Eleven: governing law, jurisdiction, and disputes. For domestic contracts, an Indian governing law and a workable seat of arbitration or court venue; beware exclusive jurisdiction in a city where you have no presence, which prices small disputes out of pursuit. Tiered dispute resolution, negotiation, then mediation, then arbitration, saves relationships and fees. Twelve: assignment and change of control. May the vendor assign the contract, or be acquired by your competitor, without your consent? A consent requirement, or at least a termination right on change of control, keeps you from waking up contracted to an adversary.

How to actually run a redline in-house

Triage by exposure, not by page count: read clauses one, three, and five first, because they carry most of the money. Mark every asymmetry, any right the other side has that you lack is a question to raise. Convert vague nouns into numbers: reasonable becomes thirty days, promptly becomes forty eight hours, material becomes a rupee threshold. And keep a fallback ladder for each clause: ideal, acceptable, walk away, so negotiations move in prepared steps rather than improvisation. Teams that institutionalise this, often with the 48 hour turnaround system we describe in our article on fast contract review, stop treating legal review as a bottleneck and start treating it as quality control.

Can AI help redline vendor contracts?

This is the corner of legal practice AI has changed fastest, and honestly so. Modern tools extract all twelve clauses from an MSA into a risk table in minutes, compare drafts against your playbook positions, flag missing protections, no cap, no data clauses, one way indemnity, and generate first pass markups in tracked changes. For high volume, mid value contracts, AI review plus human judgment routinely halves turnaround time, and the consistency, every contract checked against the same twelve risks, exceeds what tired humans achieve on Friday evenings. The boundaries: AI reads the contract, not the relationship, it does not know that this vendor holds your production data or that the counterparty’s parent is your competitor; it can misjudge enforceability questions under Indian law, such as when a limitation clause collides with public policy; and negotiation strategy, what to concede and what to hold, remains human work. Let AI find the twelve clauses and draft the markup; let a qualified human decide the asks and sign off the risk.

When to Review This

• Twelve clauses carry the weight of an Indian MSA: the money trio of liability cap, consequential exclusion, and indemnity; the ownership pair of IP and confidentiality plus the new data protection layer; and the lifecycle set from termination to change of control. The redlining method is triage by exposure, hunting asymmetry, and converting vagueness into numbers. Most vendor contract losses were visible in the draft, in one of these twelve places, before anyone signed, and the whole discipline of redlining is simply choosing to look there first.