A limiting clause is read in its ordinary meaning in the context of the whole contract, so the cap means what the words say and no more.
Why it matters when the plan changes
For work that informs decisions about people and plans, the consequential losses a client can imagine are large, and the fees are not. The cap is where both sides agree what the supplier is actually standing behind, inside a wider agreement that also fixes term and scope. Negotiating it late, or leaving it to a template, produces a number unrelated to the risk, because such clauses are read in their ordinary and natural meaning, not whatever meaning either side later prefers.
The tension is that a supplier wants the cap low and the client wants it high, and both are arguing about a scenario neither expects. The useful conversation is about which losses are plausible, which are excluded, and which cannot be capped at all. Data protection carve-outs are the usual place that conversation becomes specific, since a processor's security duties sit in the processing agreement under Article 28 of the General Data Protection Regulation, so that category is capped on its own terms.
In practice
A client's legal team strikes a supplier's cap and proposes unlimited liability for any loss arising from a recommendation. The supplier cannot insure it and the deal stalls. The eventual settlement caps general liability at a fee multiple, carves out data protection and confidentiality at a higher figure, and excludes consequential loss, which is roughly where both templates began.
Evidence
Limiting clauses are construed in their ordinary and natural meaning in the context of the contract.
Exclusion clause, Wikipedia (2026)A processor's obligations, including security, are set in the processing agreement, which is why data protection is often carved out of a general cap.
Article 28, General Data Protection Regulation (2016)
What it cannot tell you
A liability cap tells you the ceiling agreed in a contract; it does not tell you whether that ceiling matches the actual risk, whether the supplier carries insurance to pay it, or whether a court will enforce it against a specific loss. Carve-outs and exclusions sit in separate clauses and must be read together with the cap to know what is actually protected.
Questions
As a multiple of fees paid over a period, commonly twelve months before the claim, or as a fixed sum. Courts construe such clauses in their ordinary and natural meaning within the whole contract, as set out in the exclusion clause entry on Wikipedia from 2026, so the precise wording of the multiple matters.
Losses the law will not let a party exclude, such as those from fraud, and often data protection breaches. Article 28 of the General Data Protection Regulation, dated 2016, fixes a processor's security obligations in the processing agreement, which is why data protection is frequently carved out and capped separately, usually higher than the general limit.
Losses that follow indirectly from a breach rather than flowing directly from it, such as lost profit or a failed transaction. Most suppliers exclude them entirely, because they are large, speculative and uninsurable, and most clients accept the exclusion in exchange for a meaningful direct-loss cap.
Because the imagined consequences of a wrong recommendation about a leadership team are far larger than any fee, and because the decision the recommendation informs is the client's. The cap and the scope clause together record that the supplier stands behind a bounded output, not the client's decision.
Usually, within limits set by what the supplier can insure. A supplier's insurance cover is the practical ceiling, and a client asking for more is asking for a promise that cannot be kept. The productive negotiation is about carve-outs and exclusions rather than about the headline multiple.