Set and forget? The hidden risks in outdated terms and conditions
Many businesses treat their standard terms and conditions as a ‘set and forget’ document. Once uploaded to a website or incorporated into sales processes, they often remain unchanged for years. However, recent legal developments, changing commercial practices and increasing regulatory scrutiny mean that outdated terms may no longer provide adequate protection.
By conducting regular reviews and ensuring contractual terms align with your current business operations and legal requirements, businesses can reduce risk, improve enforceability and place themselves in a stronger position should a dispute arise. In this article, we will discuss 5 key areas for your next term and conditions review:
1. Consumer law compliance:
The Digital Markets, Competition and Consumers Act 2024 (DMCCA) has fundamentally changed the consumer law landscape. In previous articles (found here and here) we have discussed the new rules that all businesses must follow when dealing with consumers.
The Competition and Markets Authority now has direct enforcement powers and can impose substantial financial penalties for consumer law breaches. Business should ensure that their terms and conditions:
- have up-to-date cancellation provisions (especially for online sales);
- do not use drip pricing methods; and
- do not include any potentially unfair contract terms.
When reviewing standard terms and conditions, you should pose the question: “Would the regulator see these terms and conditions as clear, fair and transparent?” If the answer is no, it may be time to review your terms to ensure compliance with the DMCCA and the wider consumer protection regime.
2. Limitation of liability clauses
Limitation of liability clauses are often very significant provisions in a set of terms and conditions. They determine who bears the financial risk when things go wrong and are frequently tested when disputes arise. Many limitation clauses are copied from historic precedents and no longer reflect the actual risks faced by businesses.
A common issue is that businesses grow significantly while their terms remain static. A £5,000 limitation may be appropriate for a small business with lower value products/services. However, if a business is frequently delivering six figure contracts, the same cap may no longer be commercially realistic or reflect the risks associated with the services being provided. Businesses should regularly consider whether existing caps and exclusions remain proportionate to your current operations.
Another common issue is whether new risks have emerged for the business that need to be limited. Many standard terms and conditions were drafted before businesses became heavily reliant on AI, cloud-based software, large scale data processing and cyber security issues. A clause drafted in 2010 may be silent on the losses arising from any of these new tech risks. As technology becomes more integrated into everyday business operations, contractual risk allocation should evolve accordingly.
3. Automatic renewals and subscription models
Over the past decade, businesses across a wide range of sectors have moved away from one-off transactions and towards recurring revenue models. What began with software-as-a-service (SaaS) providers is now common among training providers, professional services firms, membership organisations, maintenance businesses, retailers and digital content providers.
Whilst subscription models can provide predictable revenue and improve customer retention, they also create legal and reputational risks if the contractual terms are not carefully drafted.
An automatic renewal clause typically provides that a contract will continue for a further period unless one party gives notice to terminate. For businesses this can provide greater revenue certainty, reduce customer churn and minimise lengthy contract negotiations. However, a business should always be aware that customers may become frustrated when renewal provisions are hidden in lengthy terms and conditions, include unusually long notice periods and are unable to identify the cancellation procedures.
Consumer protection legislation continues to evolve and ‘easy in, easy out’ contracting is slowly becoming the norm. For many businesses, a contract that is perceived as unfair can be more damaging than one that is legally vulnerable. You should make sure that any commercial terms:
- include straightforward cancellation rights;
- operate transparent renewal processes; and
- have clear notice of upcoming payments.
4. Data protection obligations
Many businesses assume data protection compliance sits entirely within a privacy notice on their website. In reality, a privacy policy is only part of the picture. Standard terms and conditions often play a critical role in allocating responsibility for data protection, including:
- information security;
- data breaches;
- use of customer data;
- confidentiality obligations; and
- allocation of responsibility under data protection legislation.
Whether a business is processing customer data, storing information in the cloud, operating a CRM system or simply handling contact details, its contractual terms should reflect how personal data is collected, used and protected. Customers are increasingly scrutinising these provisions during procurement and supplier onboarding exercises.
A key question for any business: “Do your contractual provisions align with your actual data handling practices?” If not, then you need to update the terms and conditions to ensure they accurately reflect how personal data is handled in practice.
5. Boilerplate clauses
When reviewing standard contract terms such as terms and conditions, many businesses naturally focus on pricing, payment terms, limitations of liability and termination rights. However, some of the most significant contractual disputes arise from the so-called “boilerplate” provisions found at the end of an agreement. These clauses are often copied from precedent documents and carried forward year after year without review. Whilst they may appear routine, they can have a significant impact on how a contract operates in practice and how disputes are resolved.
Common examples of boilerplate provisions that may no longer reflect modern business practices include:
- Notice provisions specifically requiring a notice to be served by hand, by post or at the registered office address. This no longer reflects how modern businesses communicate.
- A clause prohibiting assignment of the contract, but the business has gone through an acquisition or group restructuring and is no longer the same entity that entered the contract.
- A variation clause prohibiting variation of the price of goods, but the production costs have risen significantly in recent years.
There can be significant challenges when incorporating boilerplate clauses into terms and conditions, directors will need to make sure they are suitable for the business and are still enforceable if a dispute arises.
Practical steps for businesses
Businesses should consider carrying out an annual review of their standard terms and conditions by asking:
- Have there been any legal developments since the terms were last updated?
- Do the terms accurately reflect current business practices?
- Have any new products, services or technologies been introduced?
- Do liability allocations remain commercially appropriate?
- Are consumer-facing provisions clear and compliant?
Standard terms and conditions are among the most frequently used legal documents within a business, yet they are often among the least frequently reviewed.
In an environment shaped by enhanced consumer law enforcement, evolving technology, increasing data protection obligations and increasingly sophisticated customers, the question is no longer whether a business has terms and conditions. The more important question is whether those terms continue to protect the business they were designed to serve.
If your business requires a bespoke set of commercial terms or you would like us to review existing T&C’s, the Geldards commercial contracts team are here to assist you.