Web Hosting and Data Centre Agreement Lawyers Adelaide: Uptime, Suspension, Liability and Exit
Web hosting and data centre agreements in South Australia
If a business runs on a hosted website or platform, the hosting agreement decides who carries the cost of an outage and when the host can switch the service off. Talon Legal reviews and drafts managed hosting, colocation and data centre agreements for Adelaide businesses and for the providers that host them. Book a same-day free 30-minute consultation or call (08) 7094 2021.
Web hosting agreement key facts
| Issue | Position in South Australia |
|---|---|
| Kinds of arrangement | Shared and managed hosting, where the provider runs the servers; colocation, where the customer's equipment sits in the provider's data centre; and dedicated or virtual servers between the two. |
| Suspension | Effective if the contract allows it and is followed. An IT provider was entitled to suspend its helpdesk when invoices were withheld outside the contract's dispute process (AIBI v Virtual Technology Services at [137] to [140]). |
| One-sided rights | In a standard form small business contract, a right for the host alone to suspend, terminate or decide whether the customer is in breach may be unfair (ACL section 25(a), (b) and (h)). |
| Liability caps | Read for what they say (Darlington Futures v Delco at [16]). For services not ordinarily acquired for personal use, liability to a consumer can be limited to resupply or its cost, unless that is not fair or reasonable (section 64A). |
| Terms declared unfair | Liability limitation, unilateral variation, automatic renewal and termination payment terms in equipment, software and support contracts (ACCC v Fujifilm Business Innovation Australia, by consent). |
| Service credits | A sum payable on default is a penalty only if out of all proportion to the interests it protects (Paciocco v ANZ, Kiefel J at [29]). |
| Security | A customer covered by the Privacy Act must take reasonable steps to protect personal information it holds (APP 11.1). Overreliance on third party providers counted against the company in the first civil penalty case ([52]). |
| Breach assessment | A suspected eligible data breach must be assessed within 30 days (Privacy Act section 26WH). Notification by the host or the customer relieves the other (section 26WM). |
| Critical infrastructure | A host's asset can be a critical data storage or processing asset where it serves business critical data for government or a critical infrastructure entity (SOCI Act section 12F). |
| Servers overseas | Disclosing personal information to an overseas recipient requires reasonable steps so the recipient does not breach the APPs (APP 8.1), and liability can follow (section 16C). |
| Time limits | Six years for a claim in contract or tort (Limitation of Actions Act 1936 (SA) section 35) and for ACL damages (section 236(2)). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need a web hosting agreement lawyer in Adelaide?
Our web hosting agreement lawyers in Adelaide act for online businesses, software companies and organisations whose systems are hosted by someone else, and for the Adelaide hosts and data centre operators that supply them. A hosting agreement sets the service, the uptime commitment, the host’s rights to suspend, the limits on its liability and the way out. The Australian Consumer Law (ACL) in the Competition and Consumer Act 2010 (Cth), the Privacy Act 1988 (Cth) and the Security of Critical Infrastructure Act 2018 (Cth) shape what it can say. This page states the law current to 24 October 2026.
This guide is part of our IT outsourcing, cloud and hosting practice. Related guides cover cloud services agreements, IT services and support agreements and data protection and privacy.
For the security terms in hosting contracts, see our guide to data security clauses. For testing systems a host runs for you, see penetration testing agreements.
Free Consultation. If a host has suspended your service or is threatening to, call before you respond. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- What should a hosting or data centre agreement cover?
- What uptime commitment can a business rely on?
- Can a host suspend or terminate the service?
- How far can a host limit its liability?
- Who is responsible for security and breaches?
- Do critical infrastructure laws apply to data centres?
- Does it matter where the servers are?
- How does a business leave a host?
- How similar matters tend to play out
- How we act on hosting agreements
- Case law
- Frequently asked questions
What should a hosting or data centre agreement cover?
The service the host actually provides, and what it does not. In managed hosting the host runs the servers, and the agreement should say who patches, monitors and backs up, how often, and how quickly a failure is fixed. Backups are the clause most often assumed and least often written down.
In colocation the customer’s own equipment sits in the provider’s facility. The agreement should cover physical access, power and cooling commitments, connectivity, the provider’s on-site help, insurance of the equipment, and who owns what. Some colocation terms let the provider hold the equipment until fees are paid. A customer should know whether its agreement does before a dispute arises.
Every hosting agreement should also deal with the acceptable use policy, which usually sits outside the main contract and can be changed by the host. A web hosting agreement lawyer will read the policy with the contract, because that is where most suspension rights live.
What uptime commitment can a business rely on?
Only the commitment written into the agreement, with the remedy the agreement gives. Uptime figures in marketing material are usually not part of the contract, although a figure promised with no reasonable grounds may be misleading (ACL sections 4(1) and 18). The agreement should define availability, the period it is measured over, what counts as downtime and what is excluded, such as scheduled maintenance.
The usual remedy is a service credit. A credit is a fixed sum triggered by a failure, so the penalties doctrine is the check. In Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28, Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects, which may be business or financial interests ([29]). The appellants did not establish that the bank’s late payment fee was a penalty ([69]). Credits rarely fail that test.
The more important point is what happens when outages repeat. If credits are the sole remedy and there is no right to terminate for chronic failure, a business can be locked into a service that does not work. That right has to be negotiated at the start.
Where the customer is a consumer, which includes a business paying $100,000 or less for the services (ACL section 3 and regulation 77A), the services must be rendered with due care and skill and be fit for a purpose made known (sections 60 and 61). Those guarantees sit alongside any credits and cannot be excluded (section 64).
Can a host suspend or terminate the service?
If the contract allows it and the host follows the clause. In AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696, a customer unhappy with its IT provider withheld payment, and the provider suspended its helpdesk and stopped processing tickets for 36 days ([2]). The contract allowed disputed amounts to be withheld only once its dispute mechanism had been activated ([137] to [139]). It had not been, so the provider did not breach the agreement by suspending ([140]).
Hosting terms often go further, allowing suspension for any breach of the acceptable use policy, sometimes without notice. In a standard form consumer or small business contract, a term that lets one party alone avoid or limit performance, terminate, or decide whether the other is in breach is a statutory example of a term that may be unfair (ACL section 25(a), (b) and (h)). A small business contract is one where at least one party employs fewer than 100 persons or had turnover under $10,000,000 (section 23(4)).
A host has legitimate reasons to act quickly, such as a compromised site sending spam or attacking other customers. The provider must prove a term is reasonably necessary to protect its legitimate interests (section 24(4)). A suspension right tied to real security risks, with notice where practicable and prompt restoration once fixed, is far easier to defend than an open discretion.
How far can a host limit its liability?
As far as the words clearly go, subject to statute. Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 came to the High Court from South Australia. A limitation clause is construed according to its natural and ordinary meaning, read in light of the contract as a whole. Where appropriate, an ambiguous clause is read against the party relying on it ([16]). A clearly drafted cap will usually be applied.
Statute sets the floor. A term that purports to exclude, restrict or modify the consumer guarantees is void (ACL section 64), and the Full Federal Court said the evident purpose of section 64 is that parties cannot contract out of them (Valve Corporation v ACCC [2017] FCAFC 224 at [107]). For services not of a kind ordinarily acquired for personal use, liability can be limited to supplying the services again or the cost of doing so, unless the customer shows reliance on the limit is not fair or reasonable (section 64A(2) and (3)).
A cap can also be unfair. In ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928, a liability limitation term was among ten categories of terms in small business contracts for equipment, software and support declared unfair and void by consent ([1] to [3] and orders). Since 9 November 2023, making a standard form contract containing an unfair term the host proposed, or relying on one, is a contravention (section 23(2A) and (2C)). For a body corporate the maximum penalty is the greatest of $100,000,000, three times the benefit, or 30% of adjusted turnover (section 224).
Who is responsible for security and breaches?
Both parties, for the parts each controls, and the customer for the personal information it holds whatever the host promises. An entity holds personal information if it has possession or control of a record containing it (Privacy Act section 6(1)). It must take reasonable steps to protect the information (APP 11.1), including technical and organisational measures (APP 11.3).
In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, overreliance on third party service providers was one reason the company had not taken reasonable steps ([52]). After a cyberattack it relied on a provider’s assessment that monitored only 3 of at least 127 affected computers ([77]). Because it knew the assessment was limited, relying on it alone was unreasonable ([78]).
A hosting agreement should give the customer prompt notice of incidents, access to logs and the host’s cooperation, because the customer must assess a suspected eligible data breach within 30 days (section 26WH). Where a breach is an eligible data breach of both the host and the customer, notification by one of them relieves the other of the statement and notification obligations (section 26WM). The agreement should say who does it.
Ransomware raises its own deadline. A business with annual turnover over $3,000,000 that pays a ransom must report the payment within 72 hours (Cyber Security Act 2024 section 27). If a host might pay on a customer’s behalf, the agreement should forbid it or say who reports.
Do critical infrastructure laws apply to data centres?
To some hosts and some customers. Under the Security of Critical Infrastructure Act, a data storage or processing service includes a commercial service enabling end users to store or back up data, and a commercial data processing service (section 5). Business critical data includes personal information relating to at least 20,000 individuals (section 5).
A host’s asset is a critical data storage or processing asset where it is used wholly or primarily to provide such a service relating to business critical data. The end user must be a Commonwealth, State or Territory body, or the responsible entity for a critical infrastructure asset, and the host must know that (section 12F(1) and (2)). A responsible entity that becomes aware a provider supplies it with such a service must take reasonable steps to tell the provider as soon as practicable (section 12F(3)).
Where the cyber incident notification rules in Part 2B apply to an asset, a critical cyber security incident with a significant impact on availability must be reported within 12 hours, and other incidents with a relevant impact within 72 hours (sections 30BB, 30BC and 30BD). Hosts serving those customers should expect their contracts to pass these duties through.
Does it matter where the servers are?
For personal information, yes. Before disclosing personal information to an overseas recipient, an entity must take such steps as are reasonable in the circumstances so that the recipient does not breach the APPs (APP 8.1). If the recipient then does something that would breach the APPs, the act is treated as the Australian entity’s breach (section 16C).
The Information Commissioner’s APP guidelines say that a provider engaged only to store information may be a use rather than a disclosure, where a binding contract confines it to that purpose, binds its subcontractors the same way and leaves the customer in effective control. A host whose overseas staff can access the data for other purposes may fall outside that position. The agreement should state where data is stored, who can access it from where, and how the location can change.
How does a business leave a host?
On the terms agreed at the start. The exit clause should give the customer a copy of its data in a usable format, a period after termination during which the service stays up, migration help at a stated price, return of colocated equipment, and confirmed deletion once the move is complete.
Deletion is also a legal duty. An APP entity that no longer needs personal information for any permitted purpose, and is not required by law to keep it, must take reasonable steps to destroy or de-identify it (APP 11.2).
Termination payment and disproportionate termination terms were among the terms declared unfair in Fujifilm (orders). A term letting only one party terminate, or penalising only one party for terminating, is a statutory example of a term that may be unfair (section 25(b) and (c)).
How similar matters tend to play out
Three illustrations of how the law on this page combines on ordinary facts. They are not predictions. Outcome depends on the contract, the evidence and the court.
Lower range. An online store’s host suspends its site without notice because a compromised plugin is sending spam. The terms allow suspension at the host’s discretion. Cleaning the site and asking for restoration usually resolves it within days. For the future, a small business can press for notice and a defined restoration process, because an unrestricted discretion can be tested as unfair (section 25(a) and (h)).
Middle range. A software company’s managed hosting fails for 14 hours in a month. The agreement gives a 10% credit as the sole remedy and no right to terminate. A clearly worded sole remedy clause will usually be applied (Darlington at [16]), and the credit is unlikely to be a penalty (Paciocco at [29]). The leverage lies in the renewal negotiation, where a termination right for repeated failure belongs.
Upper range. An Adelaide data centre hosts a system holding personal information about 50,000 customers of an energy company that is a responsible entity for a critical infrastructure asset. If the host knows that, and the system is used wholly or primarily for that service, the asset may be a critical data storage or processing asset (section 12F(2)). The energy company must take reasonable steps to tell the host (section 12F(3)).
How we act on hosting agreements
We act for hosted businesses and for hosts. For a customer, the aim is an uptime commitment with a remedy that matters, suspension only for real reasons and with notice, and an exit it can use. For a host, it is terms that protect its network and survive the unfair contract terms test.
| Stage | What happens | What we do |
|---|---|---|
| Review | The host's terms and acceptable use policy are sent before signing. | Identify suspension, variation, liability, data location and exit risks. |
| Negotiation | The customer seeks changes, or the host updates its standard terms. | Negotiate service levels, notice, caps, termination rights and data return. |
| Suspension | The host suspends or threatens to. | Advise on the clause, the dispute process and restoration. |
| Incident | A breach or outage occurs. | Advise on the 30 day assessment, notification, credits and termination. |
| Exit | The customer moves host or the agreement ends. | Enforce data return, equipment return, transition and deletion. |
We cannot promise an outcome, and no lawyer can. We can make sure the business knows what its hosting agreement says before the day it needs it.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
Web hosting case law
AIBI concerned an IT services contract and Fujifilm technology supply contracts. The other decisions deal with the guarantee, penalty, construction and data security points that every hosting agreement raises.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696 | Federal Court | Suspension for unpaid invoices outside the dispute process | [2], [137] to [140] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Liability limitation and termination terms unfair | [1] to [3] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | How exclusion and limitation clauses are construed | [16] |
| Valve Corporation v ACCC [2017] FCAFC 224 | Full Federal Court | No contracting out of the consumer guarantees | [107] |
| Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28 | High Court | When a sum payable on default is a penalty | [29], [69] |
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Overreliance on providers; inadequate provider assessment | [52], [77], [78] |
Case notes
AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696
An IT provider suspended its helpdesk for 36 days after its customer withheld payment ([2]). The customer had not activated the dispute process the contract required before withholding disputed amounts, so the invoices were payable ([137] to [139]), and the suspension was not a breach ([140]).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
The respondents supplied office equipment with associated software and ongoing support services ([1]). After mediation, Stewart J made consent declarations that ten categories of terms in their small business contracts, including liability limitation, disproportionate termination and termination payment terms, were unfair and void ([3] and orders).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
On appeal from South Australia, the High Court held that exclusion and limitation clauses are construed according to their natural and ordinary meaning, in light of the contract as a whole, and where appropriate against the party relying on them in case of ambiguity ([16]).
Valve Corporation v ACCC [2017] FCAFC 224
The Full Court said the evident purpose of section 64 is that parties cannot contract out of the consumer guarantees, so a term purporting to disapply them is void ([107]).
Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28
Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the late payment fee was a penalty ([69]).
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
The company had not taken reasonable steps to protect personal information, in part because of its overreliance on third party service providers ([52]). Its reliance on an external provider’s assessment that monitored 3 of at least 127 affected computers was unreasonable, because it knew the assessment was limited ([77] to [78]).
Frequently asked questions
What uptime should a hosting agreement guarantee?
One that matches how much the business depends on the service, defined precisely, with a remedy. A business that cannot tolerate repeated outages should also have a right to terminate for chronic failure, because credits alone may not justify staying.
Can a host suspend a website without notice?
If the agreement allows it. In a standard form small business contract, a right for the host alone to suspend or decide whether the customer is in breach may be unfair (ACL section 25(a) and (h)), and the host must prove the right is reasonably necessary (section 24(4)).
Can a host suspend services over an unpaid invoice?
If the contract allows it and the customer has not used the contract’s dispute process. In AIBI v Virtual Technology Services, a provider was entitled to suspend its helpdesk because disputed invoices were withheld without activating the dispute mechanism ([137] to [140]).
Are hosting service credits enforceable?
Generally, if they are not out of all proportion to the interests they protect (Paciocco v ANZ, Kiefel J at [29]). Credits sized to the value of the service lost rarely raise the issue.
Can a hosting agreement exclude all liability for an outage?
Not for the consumer guarantees where they apply (ACL section 64). For services not ordinarily acquired for personal use, liability can be limited to resupply or its cost, unless that is not fair or reasonable (section 64A). A clearly worded cap will otherwise usually be applied (Darlington at [16]).
Who is responsible if a hosted system is hacked?
Each party for the parts it controls under the agreement. The customer must still take reasonable steps to protect personal information it holds (APP 11.1), and overreliance on providers counted against the company in the Australian Clinical Labs case ([52]).
Who notifies a data breach on hosted systems?
Either the host or the customer can. Where the breach is an eligible data breach of both, notification by one means the other need not notify (Privacy Act section 26WM). The agreement should say which of them does it.
Do critical infrastructure laws apply to data centres?
To some. A data centre asset used wholly or primarily to store or process business critical data for government, or for the responsible entity for a critical infrastructure asset, may be a critical data storage or processing asset (SOCI Act section 12F).
Does it matter if the servers are overseas?
For personal information, yes. Disclosing it to an overseas recipient requires reasonable steps so the recipient does not breach the APPs (APP 8.1), and the Australian entity can be liable for the recipient’s acts (section 16C).
What should happen to the customer's data when a hosting agreement ends?
It should be returned in a usable format and then deleted once the move is confirmed. A provider that no longer needs personal information must take reasonable steps to destroy or de-identify it (APP 11.2).
Do I need a web hosting agreement lawyer?
For a platform the business depends on, yes. A web hosting agreement lawyer can settle uptime, suspension, liability and exit before they are tested. A free 30-minute consultation will tell you where you stand.