IT Services and Support Agreement Lawyers Adelaide: SLAs, Suspension and Exit
IT services and support agreements in South Australia
When an IT provider stops answering tickets, or a business stops paying invoices, the support agreement decides who was entitled to do what. Talon Legal drafts and reviews managed services, support and consultancy agreements for Adelaide IT providers and the businesses that rely on them. Book a same-day free 30-minute consultation or call (08) 7094 2021.
IT services agreement key facts
| Issue | Position in South Australia |
|---|---|
| Guarantees for IT services | For a consumer customer: due care and skill (Australian Consumer Law section 60), fitness for a purpose made known (section 61), and supply within a reasonable time where none is fixed (section 62). |
| Who is a consumer | A customer paying $100,000 or less, or acquiring services of a kind ordinarily acquired for personal, domestic or household use (section 3 and regulation 77A). |
| Contracting out | Void for the guarantees (section 64). For services not ordinarily acquired for personal use, liability can be limited to supplying the services again or the cost of doing so, unless that is not fair or reasonable (section 64A). |
| Suspension for non-payment | Effective if the contract allows it. In AIBI v Virtual Technology Services, a provider was entitled to suspend helpdesk services when disputed invoices were withheld without activating the dispute process ([137] to [140]). |
| Unfair terms | Void in standard form consumer and small business contracts (section 23(1)); making, applying or relying on them is a contravention (section 23(2A) to (2C)). |
| Small business contract | One party employs fewer than 100 persons or had turnover under $10,000,000 in its last income year (section 23(4)). |
| Terms declared unfair in IT supply contracts | Unilateral variation, automatic renewal, liability limitation, termination payment and non-reciprocal terms (ACCC v Fujifilm Business Innovation Australia, by consent). |
| Service credits and fixed sums | A sum payable on default is a penalty only if out of all proportion to the interests the clause protects (Paciocco v ANZ, Kiefel J at [29]). |
| Data security | A customer covered by the Privacy Act must take reasonable steps to protect personal information (APP 11.1); overreliance on third party providers counted against the company in the first civil penalty case ([52]). |
| Maximum penalty (unfair terms) | Body corporate: the greatest of $100,000,000, three times the benefit, or 30% of adjusted turnover. Anyone else: $2,500,000 (section 224). |
| Time limits | Six years for contract claims (Limitation of Actions Act 1936 (SA) section 35) and ACL damages claims (section 236(2)). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need an IT services agreement lawyer in Adelaide?
Our IT services agreement lawyers in Adelaide act for managed service providers, support businesses and consultants, and for the businesses that buy from them. An IT services agreement sets the service levels, the price, what happens when an invoice is disputed and how the relationship ends. The Australian Consumer Law (ACL) in Schedule 2 of the Competition and Consumer Act 2010 (Cth) overrides some of those terms, and the Privacy Act 1988 (Cth) governs the data the provider can reach. This page states the law current to 24 October 2026.
This guide is part of our information technology law practice. Related guides cover software licences and SaaS agreements, software development agreements, data protection and privacy and technology IP and IT disputes.
For service businesses outside IT, see our guide to service agreements and terms of business.
IT providers doing security work can see our guides to penetration testing agreements, data security clauses and cyber incident response.
Free Consultation. If services have been suspended or an invoice is in dispute, call before you act. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- What should an IT services agreement cover?
- Do service levels and service credits work?
- Can a provider suspend services for unpaid invoices?
- Which consumer guarantees apply to IT services?
- When are managed service terms unfair?
- Who is responsible for data security?
- How should exit and transition work?
- How similar matters tend to play out
- How we act on IT services agreements
- Case law
- Frequently asked questions
What should an IT services agreement cover?
The services, the standard they are delivered to, the price, and the way the relationship changes and ends. In practice that means a service description precise enough to tell whether a request is in or out of scope, service levels for response and resolution, the fee model and how it changes, the provider’s access to systems and data, and the exit process.
The agreement should also say what happens when things go wrong on either side. Most disputes in this area start with one of two events: the customer withholds payment because it is unhappy with the service, or the provider suspends the service because it has not been paid. A good agreement deals with both before they happen.
Consultancy and scoping engagements need the same discipline in a shorter form. The deliverable, the fee basis, and who owns the report or the design should be written down before the work starts.
Do service levels and service credits work?
They work when they are measurable and the consequence is clear. A service level that says the provider will respond promptly gives the customer nothing to enforce. One that sets response and resolution times by priority, measured from the ticket, gives both sides a standard.
Service credits, a reduction in the fee when a service level is missed, are the usual consequence. A credit is a fixed sum triggered by a failure, so the penalties doctrine is the relevant check. In Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28, Kiefel J, with French CJ agreeing, said the question is whether a provision for payment of a sum on default is out of all proportion to the interests of the party it protects, which may be business or financial interests ([29]). Credits sized to the value of the service lost rarely raise the issue.
The agreement should say whether credits are the customer’s only remedy for a missed service level, and when repeated failures allow the customer to terminate. For a consumer customer, credits sit on top of the statutory guarantees, which cannot be excluded (ACL section 64).
Can a provider suspend services for unpaid invoices?
Yes, if the contract allows it and the provider follows it. In AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696, an IT provider and its customer fell out over service quality and additional charges, and the customer withheld payment. The provider suspended its helpdesk services and stopped processing tickets for 36 days, relying on a clause entitling it to withhold services if invoices went unpaid ([2]).
The contract allowed disputed amounts to be withheld only if the dispute resolution mechanism had been activated. It had not, so the invoices were payable in full ([137] to [139]). Perram J held that the provider did not breach the agreement by withholding its helpdesk services ([140]), and said that even if the point had arisen he would not have found the suspension to be a repudiation ([145]).
The lesson runs both ways. A customer that disputes an invoice should use the contract’s dispute process before withholding payment. A provider that wants to suspend should check the clause, give any notice it requires, and consider what suspension does to a customer’s operations and data. For a small business customer on standard terms, a one-sided right to suspend or terminate can also be tested as unfair (section 25(a) and (b)).
Which consumer guarantees apply to IT services?
For a consumer customer, three guarantees apply to services: they must be rendered with due care and skill (ACL section 60), be reasonably fit for any purpose the customer makes known (section 61), and, where the contract fixes no time, be supplied within a reasonable time (section 62).
A business customer is a consumer if the price was $100,000 or less, or the services are of a kind ordinarily acquired for personal, domestic or household use (section 3 and regulation 77A of the Competition and Consumer Regulations 2010). Many support contracts for small and medium businesses are under that figure.
The guarantees cannot be excluded. A term that excludes, restricts or modifies them is void (section 64), and the Full Federal Court described the purpose of section 64 as preventing parties from contracting out of them (Valve Corporation v ACCC [2017] FCAFC 224 at [107]). For services not of a kind ordinarily acquired for personal use, the provider can limit its liability to supplying the services again or the cost of doing so, unless the customer shows that relying on the limit is not fair or reasonable (section 64A(2) and (3)).
When are managed service terms unfair?
When they are in a standard form consumer or small business contract and meet the test in section 24: a significant imbalance, not reasonably necessary to protect the provider’s legitimate interests, and detriment if relied on. The provider must prove a term is reasonably necessary (section 24(4)).
The Federal Court has dealt with IT supply contracts. In ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928, the respondents supplied office equipment with associated software and ongoing support services ([1]). By consent, the Court declared ten categories of terms in their small business contracts unfair and void, including unilateral variation, automatic renewal, liability limitation, disproportionate termination and termination payment terms (orders). In ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224, automatic renewal and unilateral price variation clauses in a services supplier’s standard terms were declared unfair ([56]).
A negotiated contract may not be standard form at all. In AIBI, the provider proved that its contract was not standard form; the customer had been given an effective, and successful, opportunity to negotiate it ([93], [96]). The 2023 amendments now require the court to weigh how often the same terms are used (section 27(2)(ba)), and a contract can still be standard form despite an opportunity to negotiate minor changes or to negotiate a different contract (section 27(3)).
The stakes rose on 9 November 2023. Since then, making a standard form contract containing an unfair term the provider proposed, or applying or relying on one, is a contravention, each term counts separately, and the maximum penalty for a body corporate is the greatest of $100,000,000, three times the benefit, or 30% of adjusted turnover (sections 23(2A) to (2C) and 224).
Who is responsible for data security?
Both parties, in different ways, and the contract should say how. A customer covered by the Privacy Act must take reasonable steps to protect the personal information it holds from misuse, interference, loss and unauthorised access, modification or disclosure (APP 11.1). Those steps include technical and organisational measures (APP 11.3). Handing systems to a provider does not hand over the obligation.
The first civil penalty case shows how that is assessed. In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, one reason the company had not taken reasonable steps was its overreliance on third party service providers, without adequate procedures of its own to detect and respond to cyber incidents ([52]). After a cyberattack, it relied on its external cyber provider’s assessment, which monitored only 3 of at least 127 affected computers and reviewed one firewall log ([77]). Because the company knew the assessment was limited, relying on it alone was unreasonable ([78]).
An IT services agreement should therefore set the security standard, give the customer visibility of incidents quickly enough to meet its own 30 day assessment obligation (Privacy Act section 26WH), and require the provider to cooperate with a breach assessment. Where data is held offshore, the customer must also take reasonable steps so that the overseas recipient does not breach the APPs (APP 8.1).
How should exit and transition work?
Exit is where customers find out what their agreement really says. The questions are practical: how much notice is needed to end the agreement, what the provider must do to hand over systems, credentials and documentation, how data is returned and then deleted, and what the provider can charge for transition work.
Disproportionate termination terms and termination payment terms were among the categories declared unfair in Fujifilm (orders). A termination right for one party alone, and a term penalising one party for termination, are statutory examples of terms that may be unfair (section 25(b) and (c)). A customer negotiating an agreement should settle the exit terms at the start, when it has leverage, rather than at the end, when it has none.
How similar matters tend to play out
Three illustrations of how the law on this page combines on ordinary facts. They are not predictions. Outcome depends on the contract, the evidence and the court.
Lower range. A small accounting firm disputes a managed service provider’s invoice and stops paying it. The agreement requires a dispute notice before amounts can be withheld. Serving the notice and paying the undisputed part keeps the firm inside the contract, and prevents the provider relying on a suspension clause as the provider did in AIBI ([137] to [140]).
Middle range. A provider’s standard terms allow it to raise fees on 30 days’ notice, renew automatically for three years, and charge the balance of the term on early exit. Most of its customers are small businesses. Those are the categories of term declared unfair in Fujifilm. Rewriting them before a customer complains avoids a contravention under section 23(2C) each time the provider relies on them.
Upper range. A ransomware attack reaches a customer’s systems through the provider’s remote access tool. The customer must assess the breach within 30 days and notify if it is eligible. If the agreement gave the customer no right to the provider’s logs or cooperation, the customer’s assessment depends on the provider’s own account, which the Australian Clinical Labs case shows is not enough ([77] to [78]).
How we act on IT services agreements
We act for providers and for customers. For a provider, the aim is terms that are enforceable and survive the unfair terms test, with a suspension right it can actually use. For a customer, it is service levels that mean something, control of its data, and a clean exit.
| Stage | What happens | What we do |
|---|---|---|
| Review | The provider's terms or the customer's proposed agreement are sent for advice. | Check the guarantees, unfair terms, suspension, liability, data and exit clauses. |
| Drafting | The services agreement and schedules are prepared. | Draft the service description, service levels, credits, fees, security and transition terms. |
| Operation | Disputes arise about scope, charges or performance. | Advise on the dispute process, withholding, suspension and service credits. |
| Incident | A security incident affects systems or data. | Advise on the 30 day assessment, cooperation obligations and notifications. |
| Exit | The agreement ends or is terminated. | Enforce the transition and data return obligations, or resolve the final account. |
We cannot promise an outcome, and no lawyer can. We can make sure the agreement gives the business the rights it will need on the worst day of the relationship.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
IT services case law
AIBI concerned an IT services contract, and Fujifilm concerned equipment, software and support contracts. The other decisions deal with the guarantee, penalty, limitation and data security points that every IT services agreement raises.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696 | Federal Court | Suspension for unpaid invoices; negotiated contract not standard form | [2], [93], [96], [137] to [140], [145] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Unfair terms in equipment, software and support contracts | [1] to [3] |
| ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224 | Federal Court | Automatic renewal and price variation terms unfair | [56] to [58] |
| Valve Corporation v ACCC [2017] FCAFC 224 | Full Federal Court | No contracting out of the guarantees | [107] |
| Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28 | High Court | When a sum payable on default is a penalty | [29], [69] |
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Overreliance on providers; inadequate provider assessment | [52], [77], [78] |
Case notes
AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696
An IT provider suspended its helpdesk for 36 days after its customer withheld payment ([2]). The customer had not activated the dispute process the contract required before withholding disputed amounts, so the invoices were payable ([137] to [139]), and the suspension was not a breach ([140]). The contract was not standard form because the customer had an effective and successful opportunity to negotiate it ([93], [96]).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
The respondents supplied office equipment with associated software and ongoing support services ([1]). After mediation, Stewart J made consent declarations that ten categories of terms in their small business contracts were unfair and void ([3] and orders).
ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224
A services supplier’s automatic renewal and unilateral price variation clauses created a significant imbalance in small business standard form contracts ([56]). The supplier did not show the terms were reasonably necessary to protect its legitimate interests ([57] to [58]).
Valve Corporation v ACCC [2017] FCAFC 224
The Full Court said the evident purpose of section 64 is to stop parties contracting out of the consumer guarantees, so a term purporting to disapply them is void ([107]).
Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28
Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the bank’s late payment fee was a penalty ([69]).
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
The company had not taken reasonable steps to protect personal information, in part because of its overreliance on third party service providers ([52]). Its reliance on an external provider’s assessment that monitored 3 of at least 127 affected computers was unreasonable, because it knew the assessment was limited ([77] to [78]).
Frequently asked questions
Can an IT provider suspend services if an invoice is unpaid?
If the contract allows it and the provider follows the clause. In AIBI v Virtual Technology Services, a provider was entitled to suspend helpdesk services for 36 days because the customer withheld payment without activating the contract’s dispute process ([137] to [140]).
Can a customer withhold payment if the service is poor?
Only as the contract allows. In AIBI, disputed amounts could be withheld only once the dispute resolution mechanism was activated, and because it was not, the invoices were payable in full ([137] to [139]).
Do the consumer guarantees apply to IT support?
If the customer is a consumer: a price of $100,000 or less, or services of a kind ordinarily acquired for personal use (ACL section 3 and regulation 77A). The services must then be rendered with due care and skill and be fit for any purpose made known (sections 60 and 61).
Can an IT services agreement exclude liability?
Not for the consumer guarantees where they apply (section 64). For services not ordinarily acquired for personal use, liability can be limited to supplying the services again or the cost of doing so, unless that is not fair or reasonable (section 64A).
Are service credits enforceable?
Generally, if they are not out of all proportion to the interests they protect (Paciocco v ANZ, Kiefel J at [29]). Credits sized to the value of the service lost rarely raise the issue.
Which managed service terms are most likely to be unfair?
Unilateral variation, automatic renewal, liability limitation, termination payment and one-sided termination terms. Those categories were declared unfair in small business contracts for equipment, software and support in ACCC v Fujifilm Business Innovation Australia, by consent.
Is a negotiated IT contract protected by the unfair terms law?
Only if it is still a standard form contract. In AIBI, a contract the customer had effectively negotiated was not standard form ([93], [96]). Since 2023 the court also weighs repeat use of the same terms, and minor negotiated changes do not prevent a contract being standard form (section 27(2)(ba) and (3)).
Who is responsible if the IT provider causes a data breach?
The customer remains responsible for taking reasonable steps to protect personal information it holds (APP 11.1). The Australian Clinical Labs case found overreliance on third party providers was one reason those steps were not taken ([52]). The agreement decides what the customer can recover from the provider.
How long does a business have to assess a data breach?
If there are reasonable grounds to suspect an eligible data breach, the assessment must be reasonable and expeditious, and all reasonable steps must be taken to complete it within 30 days (Privacy Act section 26WH).
What should the exit clause say?
Notice periods, handover of systems, credentials and documentation, return and deletion of data, and the cost of transition work. One-sided termination rights and disproportionate termination payments are statutory examples of terms that may be unfair (ACL section 25(b) and (c)).
Do I need an IT services agreement lawyer?
For an agreement the business depends on, yes. An IT services agreement lawyer can settle suspension, service levels, data and exit before they are tested. A free 30-minute consultation will tell you where you stand.
Related IT and technology guides
Related guides
- Information technology lawyers Adelaide
- Software licences and SaaS agreements
- Software development agreements
- Data protection and privacy
- Technology IP and IT disputes
- IT outsourcing, cloud and hosting
- Web hosting and data centre agreements
- Cybersecurity
- Commercial and business law
- Litigation and dispute resolution