The carve-out makes the cap effectively unlimited.
Counterparty added
…aggregate liability shall not exceed fees paid in the prior 12 months; provided that this limit shall not apply to claims arising from a data breach.
Your counter
…this limit shall not apply to be capped at 3× annual fees for claims arising from a data breach.
Their carve-out reopens unlimited exposure on your largest risk. Your playbook floor allows a data-breach super-cap — not an uncapped exclusion.