Which commercial contract does your business need
Five agreements cover most of what a Canadian company selling to other businesses actually needs: a Master Services Agreement, a SaaS Agreement, a Service Level Agreement, a Data Processing Agreement, and a Statement of Work. Which ones apply depends on how the business actually sells and delivers, not on a generic checklist.
The tool below asks four questions and recommends the specific documents that fit, with the Canadian reasoning behind each one. The article underneath it explains how the five relate to each other.
Which Commercial Contract Do You Need
A handful of questions about how your company sells and delivers. You get the specific documents that fit, and the Canadian reasoning behind each one.
4 questions, about 2 minutes. No account, no email required.
Built for Canadian companies selling B2B. Recommends from the five commercial agreements this covers: MSA, SaaS Agreement, SLA, DPA, and SOW.
MSA vs SOW vs SLA vs SaaS Agreement vs DPA
Five documents, five different jobs. Most companies need more than one at once.
| Document | What it actually is | When you need it |
|---|---|---|
| MSA | The umbrella agreement for an ongoing services relationship: liability, confidentiality, IP, and payment terms, set once. | Repeat work for the same client, more than one engagement expected. |
| SOW | What the MSA points to for one specific engagement: scope, deliverables, timeline, and price. | Every project, whether or not there is an MSA above it. |
| SLA | The measurable performance promise: uptime, response times, and what happens on a miss. | Any specific performance commitment made outside a SaaS Agreement's own built-in terms. |
| SaaS Agreement | The master agreement for subscription software, usually with its own SLA and data-handling terms built in. | The product is subscription software, not bespoke services. |
| DPA | The agreement allocating responsibility for personal information that flows through what you provide. | Personal information belonging to a customer's own customers, employees, or users passes through the service. |
Questions founders ask
A Master Services Agreement sets the terms that do not change deal to deal: liability, confidentiality, IP ownership, and payment terms, for an ongoing relationship with a client. A Statement of Work sits underneath it and describes one specific engagement: scope, deliverables, timeline, and price. A single project can use a Statement of Work on its own; an ongoing relationship with repeat engagements needs both, the MSA once and a new SOW for each project.
Usually not right away. A well-drafted SaaS Agreement already includes its own uptime and support-response terms as a built-in section. A standalone Service Level Agreement becomes worth drafting on its own once a specific enterprise customer wants to negotiate that commitment apart from the rest of the deal, which tends to happen once a customer is large enough to run its own procurement process.
Whenever personal information belonging to a customer's own customers, employees, or users passes through what is provided, not just the customer's own business contact details. PIPEDA's accountability principle keeps a company responsible for that information even after it moves to a processor or sub-processor, so the obligation needs a written agreement to allocate it. This runs in both directions: a DPA is often needed with a company's own vendors and sub-processors, and enterprise customers will often ask to have their own DPA countersigned as processor.
Rarely without real changes. Canadian courts apply a different test than US courts to a limitation of liability clause (Tercon Contractors v. British Columbia, 2010 SCC 4 sets the Canadian test), and Canadian privacy law, PIPEDA federally and Quebec's Law 25 for Quebec residents, imposes obligations most US-drafted data terms never address. A US template can look complete and still leave the actual Canadian exposure uncovered.
Bonterms and Common Paper publish genuinely useful open-source standard contracts, and they are worth knowing about. Neither is drafted for Canadian law: PIPEDA, Quebec's Law 25, and the Canadian test for enforcing a liability cap are not addressed in either project's forms. This tool, and the documents it points to, are built for a Canadian company from the ground up.
Last reviewed 2026-08-25 by Brooke Ash, Head of Legal, Ruby. This tool gives general information, not legal advice, and using it does not create a solicitor-client relationship. Your situation may turn on facts this assessment does not ask about.
Ready to get these drafted?
Tell us about your matter and a Ruby lawyer will follow up directly.