Service Agreement Review: Questions Small Businesses Should Ask

Key takeaways

• A South African small business should review a service agreement as an operating system, not as a collection of legal phrases. The contract should identify the correct parties, connect price to measurable work, allocate dependencies and change risk, protect information and intellectual property, define responsibility when performance fails, and provide a workable exit and handover.
• Before signing, answer five controlling questions:
• 1. What exactly must each party do, by when, and how will completion be proved?
• 2. What events change the price, timing or scope, and who may approve that change?

Start with the business record, not the draft

The draft cannot be assessed without the commercial facts it is supposed to record. Assemble a short deal record before marking clauses.

Include:

• the proposal, request for proposal, quotation and final commercial approval;
• emails or meeting notes recording promised outcomes, assumptions and exclusions;
• the supplier's presentation or product description relied on in the decision;
• budget approval and the intended price model;
• technical, security, data and insurance requirements;
• the implementation plan and required customer inputs;
• any existing agreement being replaced, including notice and migration duties;
• approved deviations from procurement or contracting policy; and
• the latest clean draft, tracked draft and schedules.

Record the business objective in one sentence. “Obtain support services” is too vague. State what capability, deliverable or result the business is buying, the operational deadline, the systems or sites involved and what would make the arrangement unacceptable.

Then compare the contract with the source record. If a sales promise is absent from the agreement, do not assume the email will automatically cure the omission. An entire-agreement clause, integration rule, hierarchy clause and the admissibility and weight of contextual evidence can affect the dispute. Put material commitments into the controlled contract documents.

The commercial-law checklist can help identify the entity, governance and contract records. Keep a separate issue list showing the clause, business concern, proposed wording, decision owner and status.

Confirm the parties, capacity and signing authority

Use the registered name, entity type, registration number and chosen address for each party. A trading name, website brand or business unit may not be the legal person responsible for payment or performance.

Check whether the service provider is:

• a company or close corporation;
• an individual or sole proprietor;
• a partnership;
• a trust acting through identified trustees; or
• an agent contracting for a disclosed principal.

Do the same for the customer. Then identify whether a parent company, subcontractor, reseller, licensor or overseas affiliate performs any critical obligation. If the financially stronger parent is not a party or guarantor, its brand and consolidated accounts do not automatically support the contracting entity's promises.

For a company, the Companies Act gives the board authority to manage the company's business and affairs subject to the Act and memorandum of incorporation. Delegations, approval thresholds, conflicts and signing mandates still matter. Obtain the relevant resolution, delegation or procurement approval instead of relying on an email footer or job title.

Test authority for four different acts:

1. approving the original agreement;
2. signing it;
3. accepting deliverables or service credits; and
4. ordering changes, waiving rights or terminating.

The people doing those acts need not be the same. A project manager's authority to manage tasks should not silently become authority to approve unlimited additional fees or waive a material breach.

Map the complete contract stack and its order of precedence

A service agreement often consists of more than the signature document. It may incorporate statements of work, service levels, security schedules, data-processing terms, acceptable-use rules, online policies, price sheets, purchase orders and change requests.

List every incorporated document and its exact version. Follow every hyperlink before signing and save a dated copy. A clause that allows one party to change an online policy unilaterally can alter security, support, product functionality or permitted use after the commercial decision.

Create an order-of-precedence rule for conflicts. Decide, for example, whether negotiated special terms outrank the supplier's standard conditions, whether a statement of work may change the master agreement, and whether a purchase order is administrative only. The hierarchy should match the intended bargain rather than whichever document happens to be issued last.

Identify the provisions that survive termination. Confidentiality, payment, intellectual property, audit, limits of liability, indemnities, dispute resolution, data return and record-retention clauses may need different survival periods. A blanket statement that “all terms survive” can undermine the concept of termination; no survival wording can leave essential exit duties uncertain.

Make scope testable

Scope is the core exchange. Describe services, deliverables, volumes, locations, systems, standards, exclusions and customer dependencies with enough precision for another person to decide whether performance occurred.

For each deliverable, ask:

• what input starts the work;
• who supplies that input and in what format;
• what output is required;
• which specification or quality standard applies;
• when it is due and what pauses the timetable;
• how delivery is evidenced;
• who tests or accepts it;
• what happens if it is rejected; and
• whether re-performance, correction, credit, termination or damages may follow.

Avoid an acceptance mechanism under which silence automatically means acceptance before the business has a realistic testing opportunity. If deemed acceptance is used, define delivery, the review period, objective rejection grounds, the form of notice and a correction cycle.

Dependencies need symmetrical treatment. If the supplier's deadline moves when the customer is late, define the affected dependency, notice required, mitigation duty and the extent of the extension. “Any customer delay relieves the supplier of all obligations” is not an operational rule.

Separate a target, estimate, service level, warranty and condition. They perform different functions. If an implementation date is essential to a launch, say what legal and commercial consequence follows from missing it rather than using “target” in one schedule and “binding deadline” in another.

Connect service levels to the real service

A service-level schedule should measure what the customer needs, not only what is easy for the supplier to report.

Identify:

• the service boundary and measurement source;
• operating hours and excluded maintenance;
• incident severity criteria;
• response, workaround and resolution measures;
• availability calculation and excluded events;
• reporting frequency and access to underlying records;
• repeated-failure thresholds;
• service-credit calculation and claim procedure; and
• whether a credit is the sole remedy.

A rapid response does not guarantee a rapid resolution. System availability may exclude a dependency that is essential to the customer. A credit can be too small to change conduct or so complex that it is never claimed.

Do not let the service-level schedule contradict the main agreement's warranties, liability cap or termination rights. If repeated critical failure should permit termination, link the objective threshold to a clear notice and exit path.

Test fees, tax and change control together

Price cannot be reviewed without scope and change control. Identify whether fees are fixed, time-based, volume-based, milestone-based, recurring, usage-based or a combination.

For every fee, check:

• whether VAT is included or added;
• the invoice trigger and supporting detail;
• the payment period and start date;
• currency and exchange-rate method where relevant;
• reimbursable expenses and pre-approval;
• deposits, retainers and unused balances;
• annual increases, indexation or repricing rights;
• minimum commitments and overage rates;
• disputed-invoice treatment;
• interest and recovery costs; and
• fees on suspension, termination and transition.

Prevent informal scope growth. A change mechanism should require a written description of the change, reason, impact on fees, delivery dates, dependencies, security and other terms, plus approval by named roles before work starts.

Emergency work may need a shorter route, but it should still create a prompt written record and a spending limit. A clause allowing the supplier to perform any “necessary” additional work at standard rates gives the customer little control over cost.

If a fee operates as a penalty, liquidated damages or forfeiture on breach or withdrawal, the Conventional Penalties Act may apply. Penalty stipulations are capable of enforcement, but section 3 allows a court to reduce a penalty that is out of proportion to the prejudice suffered. That is not a licence to accept an unexplained charge. Identify the triggering act, amount, interaction with damages and commercial justification before signing.

Review term, renewal, suspension and exit as one system

Write a timeline showing signature, commencement, implementation, initial term, renewal notice, price-review dates and the first available exit date.

Ask whether renewal is automatic, optional or subject to agreement. An automatic renewal with a narrow notice window can extend a poor arrangement. Record the notice date in the contract register rather than depending on the supplier's reminder.

The Consumer Protection Act may apply to some service transactions involving a small business, but “small business” is not the legal test. Section 5 contains transaction and consumer rules and exemptions. The published threshold for a juristic person is R3 million in asset value or annual turnover at the time of the transaction, and the Act contains important qualifications. Section 14's fixed-term provisions do not apply to transactions between juristic persons. Do not copy a consumer-cancellation summary into a company-to-company agreement without first checking application, the current threshold and the exact provision.

Separate:

• termination for material breach after a cure opportunity;
• immediate termination for defined serious events;
• termination for convenience;
• insolvency and business-rescue events;
• repeated service failure;
• unlawful performance or loss of a required licence; and
• termination triggered by an unaccepted change.

Suspension can be as damaging as termination. Limit it to defined grounds, require notice where practical, protect data and critical functions, and state how disputed invoices affect the right. A service provider should not be able to suspend an entire service because a minor, genuinely disputed amount remains open.

Build the exit schedule before dependency forms. It should address transition assistance, fees, timetable, data export, deletion, credentials, customer property, work in progress, third-party licences, domain or account transfers, knowledge handover, records, final invoices and continuing cooperation.

Allocate warranties, indemnities, liability and insurance deliberately

These clauses work together. Review the risk scenario, responsible party, remedy, procedure and financial backstop rather than negotiating each heading in isolation.

A warranty is a contractual promise about a fact, authority, standard or performance. An indemnity can allocate specified third-party or direct claims and their defence. An exclusion removes categories of loss. A liability cap limits exposure. Insurance may fund some risk but does not replace the contractual obligation.

For each material risk, ask:

1. What event triggers responsibility?
2. Must fault, breach or negligence be proved?
3. Is the claim direct, third-party or regulatory?
4. Who controls defence and settlement?
5. What notice and cooperation are required?
6. Does an exclusion apply?
7. Is the claim inside or outside the cap?
8. Is the cap based on fees, time, event or aggregate exposure?
9. Does insurance actually cover the event and amount?

Watch for an asymmetric system: broad customer indemnities, narrow supplier warranties, an exclusion of the customer's likely losses and a cap too low to support the supplier's core obligations. The right answer is not always unlimited liability. It is a supportable allocation aligned with control, foreseeable harm, price and insurance.

Clauses that limit risk, create an indemnity, require acknowledgement of facts or impose unusual danger may also engage section 49 of the Consumer Protection Act where the Act applies. Section 48 addresses unfair, unreasonable or unjust terms; section 51 prohibits specified terms. Application and effect require transaction-specific review. The unfair-contract-terms glossary provides context without deciding enforceability.

The breach-of-contract guide explains the wider remedial context. A service agreement should still state its own notice, cure, re-performance, cancellation and claim mechanics rather than rely on a generic remedy label.

Contractual enforcement is shaped by public policy, but fairness is not a general power to rewrite a poor bargain. In Beadica, the Constitutional Court stressed the central role of pacta sunt servanda and a disciplined public-policy analysis. In Barkhuizen v Napier, it addressed the validity and enforcement of contractual time bars. Treat notice and claim periods as operational deadlines and negotiate them before signature.

Identify intellectual property and permitted use

“All intellectual property belongs to the customer” is rarely a complete allocation. Distinguish:

• intellectual property each party owned before the project;
• reusable tools, methods, templates and libraries;
• project-specific deliverables created under the agreement;
• customer data and materials;
• third-party or open-source components;
• improvements, feedback and derivative work; and
• brand names, logos and publicity rights.

For each category, state ownership, licence scope, territory, duration, transferability, sublicensing, modification, source or editable format, third-party restrictions and what happens on termination.

The Copyright Act contains default ownership rules and specific exceptions; payment for work does not always transfer every right. A contract should record the intended ownership or licence and any required assignment formalities rather than rely on an assumption about “commissioned work”. The intellectual-property glossary introduces the categories, but specialist review may be needed for software, databases, designs, trade marks, inventions and open-source obligations.

Make sure the supplier can lawfully grant the promised rights. Obtain a third-party component register where the service depends on licences the customer cannot control. Decide whether the customer may continue using deliverables after expiry, non-payment disputes or supplier insolvency.

Treat confidentiality, POPIA and security as separate layers

Confidentiality clauses protect defined business information by contract. POPIA regulates personal information through statutory roles and conditions. Security obligations protect systems and information against risk. One generic paragraph does not perform all three functions.

Identify what personal information will be processed, for whose purpose, where it will be stored, who can access it, which subcontractors are used and whether it will cross a border.

Under POPIA, the responsible party determines the purpose and means of processing. An operator processes for a responsible party under a contract or mandate without coming under the direct authority of that party. Section 21 requires the operator relationship to be governed by a written contract requiring security measures, and the operator must notify the responsible party immediately where there are reasonable grounds to believe unauthorised access or acquisition occurred. Sections 19 to 22 address security safeguards and notification; section 72 controls transfers outside South Africa.

The agreement should define:

• each party's role for each data set;
• documented processing instructions;
• purpose and permitted use;
• minimum access and confidentiality controls;
• risk assessment and security measures;
• subcontractor approval and equivalent obligations;
• incident reporting content and timing;
• investigation, containment and notification cooperation;
• audit or assurance evidence;
• retention, return and deletion;
• cross-border location and transfer basis; and
• allocation of regulatory and data-subject claims.

Do not promise that the service provider is “POPIA compliant” without identifying the processing and controls. The responsible party retains accountability for compliance with the conditions even when an operator performs processing.

Control assignment, subcontracting and change of ownership

The service may depend on the chosen provider's people, licences, security posture or financial capacity. Decide whether rights may be ceded, duties delegated, the contract assigned or performance subcontracted, and whether consent is required.

In University of Johannesburg v Auckland Park Theological Seminary, the Constitutional Court confirmed that contract interpretation is a unitary exercise considering text, context and purpose from the outset. It also considered when contractual rights are personal and cannot be freely ceded. A service agreement should state the intended transfer rules rather than leave material identity questions to later interpretation.

For subcontractors, require disclosure of critical functions, responsibility for performance, confidentiality, security and POPIA flow-downs. Consent should not be meaningless, but it also should not create an impractical veto over every ordinary supplier.

Address change of control where ownership could place sensitive work with a competitor or change financial and regulatory risk. Define the event, notice, information rights and any termination option. Do not confuse a share sale with an assignment of the contract; the legal and commercial effects differ.

Make notices, disputes and electronic signing workable

The notice clause should name permitted addresses, delivery methods, deemed-receipt rules and the people authorised to receive formal notices. Operational chat messages and support tickets should not accidentally become termination notices, but the formal route must be usable.

The Electronic Communications and Transactions Act generally prevents information from being denied legal effect merely because it is a data message. Sections 11 to 13 address data messages, writing and signatures; section 22 addresses contract formation. Some laws and transactions require particular formalities, and parties may set agreed signature or notice requirements. Confirm whether the chosen electronic-signature method, counterpart process and delivery evidence satisfy the contract and applicable law.

Choose governing law, courts or arbitration, seat, rules, language, interim relief and escalation steps deliberately. Arbitration may offer confidentiality and specialist appointment, but it has costs, procedural consequences and limited review or appeal routes. The arbitration glossary explains the mechanism.

Do not add mediation, arbitration and court proceedings as stacked mandatory steps without timelines and an urgent-relief exception. A dispute clause should move a real conflict toward resolution rather than create a preliminary conflict about the forum.

Run a controlled redline and approval process

Use one document owner. Give each draft a version, date and status. Keep redlines against the last agreed version and do not paste accepted clauses into an older file.

For every open issue, record:

• the clause and risk;
• the business fact driving the concern;
• the proposed position and fallback;
• who can accept the risk;
• whether another schedule must change; and
• the final decision and approver.

Do not send internal risk notes, privileged advice or approval limits to the counterparty. Remove comments and metadata from the execution copy. Compare the final clean document with the agreed redline, confirm every schedule and hyperlink, and verify signature blocks.

Use the contract-review service page to understand the discovery category, and the commercial-lawyer directory to locate potential practitioners. Lexuno does not endorse a listed practitioner; verify current experience with the contract type, industry, technology, data and transaction value.

Twenty questions before signature

1. Are the registered parties and any guarantor correctly named?
2. Who approved, signed and may later change or terminate the agreement?
3. Which documents form the contract, and which one prevails on conflict?
4. What outcome, deliverable or service is actually being purchased?
5. Which assumptions, exclusions and customer dependencies affect performance?
6. How will delivery, testing, rejection and acceptance be proved?
7. Do service levels measure availability, response and resolution that matter?
8. Which fees are fixed, variable, recurring, reimbursable or subject to increase?
9. Can work or fees change without prior written authority?
10. What happens to a disputed invoice while services continue?
11. Which warranties, remedies and repeated-failure rights apply?
12. What is indemnified, who controls defence and which procedure applies?
13. Which losses are excluded and which claims sit inside or outside each cap?
14. Who owns existing tools, new deliverables, data and improvements?
15. What third-party and open-source restrictions travel with the service?
16. What personal information is processed, where and by which operators?
17. When may services be suspended or the agreement terminated?
18. What data, access, work and assistance must be delivered on exit?
19. Which notice, time-bar, governing-law and dispute clauses control a claim?
20. Which unresolved issue needs specialist legal, tax, technical, security or insurance review?

Source and review note

This is general legal information, not advice on a particular service agreement. Source review covered the Consumer Protection Act and current juristic-person threshold notice, POPIA, the Electronic Communications and Transactions Act, the Companies Act, the Conventional Penalties Act and Constitutional Court authority on interpretation, public policy and time bars. The parties, authority, incorporated documents, scope, tax, data roles, intellectual property, consumer-law application, liability, insurance, penalties, notices, dispute forum and exit consequences remain transaction-specific. A qualified South African commercial-law reviewer must verify current law, industry regulation and every proposed clause before signature or publication.

Authoritative sources used:

• Consumer Protection Act 68 of 2008, especially sections 5, 14, 22, 48 to 51 and 54.
• Consumer Protection Act juristic-person threshold notice, setting the published section 5 threshold at R3 million.
• Protection of Personal Information Act 4 of 2013, especially sections 8 to 22, 72 and the responsible-party and operator definitions.
• Electronic Communications and Transactions Act 25 of 2002, especially sections 11 to 13 and 22.
• Companies Act 71 of 2008, especially sections 19, 20, 66, 74 to 77 and 218.
• Copyright Act 98 of 1978, especially sections 21 to 22 on ownership and assignment formalities.
• Conventional Penalties Act 15 of 1962, especially sections 1 to 4.
• [University of Johannesburg v Auckland Park Theological Seminary [2021] ZACC 13](https://www.saflii.org/za/cases/ZACC/2021/13.html), on unitary contextual interpretation and personal contractual rights.
• [Beadica 231 CC v Trustees for the time being of the Oregon Trust [2020] ZACC 13](https://www.saflii.org/za/cases/ZACC/2020/13.html), on enforcement, pacta sunt servanda and constitutional public policy.
• [Barkhuizen v Napier [2007] ZACC 5](https://www.saflii.org/za/cases/ZACC/2007/5.html), on contractual time limitations and public-policy analysis.

FAQs

Related Lexuno paths

Related articles