Outsourcing Agreements

The uptake of cloud computing among SMEs is rapidly growing. Services range from a single application delivered as Software as a Service (SaaS) to entire data centres being transitioned to the cloud using Infrastructure as a Service (IaaS). Outsourcing in some form is vital for many SMEs. However outsourcing also has its risks.

We solve problems from early stage negotiations through to adapting established outsourcing agreements to make sure they are fit for purpose.

Key points for an Outsourcing Agreement

From experience, the following will always be important :-

• Structure - the simplest form of structure is an IT outsourcing agreement directly between the customer and the supplier of the services.  But there can be added layers of complexity to work through.
• Risk - where the outsourcing arrangement is more complex a joint venture structure, whether corporate or contractual in nature, often gives the customer a greater degree of control. Like all joint ventures, the parties should consider ownership of intellectual property and exit provisions at the commencement of the collaboration.
• Protecting Intellectual property - where any software is involved establishing ownership is crucial. Is code being developed or licensed? What happens to improvements? These base level ownership provisions are often forgotten in the eagerness to start the provision of services.
• Supplier status - If the proposed supplier is not the main trading entity within its group, or does not have sufficient assets to meet its potential contractual liabilities then there are risks. In such circumstances we consider solutions such as a parent company guarantee.
• Step In rights - allows the customer to step in and take over the outsourced operations if the supplier cannot or does not perform. Once the supplier is able to demonstrate that it will again be able to meet its contractual obligations, the customer steps out. The events which can give rise to the right to step-in are not limited to the supplier’s contractual breach but can include no-fault triggers.

Risks with outsourcing

• Loss of control – reduced oversight of outsourced functions can impact quality and responsiveness.
• Data Protection breaches – risk of non-compliance with UK GDPR and data security obligations.
• Service delivery failures – potential for poor performance, missed SLAs, or disruption to business continuity.
• Hidden costs – unexpected fees or unclear pricing structures can lead to financial exposure.
• Intellectual Property risks – unclear IP ownership or misuse of confidential information.
• Termination – difficulties exiting or transitioning to a new provider without disruption.
• Regulatory compliance – risk of breaching sector-specific regulations (e.g. FCA, NHS frameworks).
• Reputational Damage – failures by the provider may reflect poorly on your business.

Data protection

Data protection issues are a major cause of tension between customers and suppliers of outsourcing agreements. Issues are especially common in IT service and cloud-based contracts and usually revolve around:

• Distinctions between controllers and processors;
• Restrictions on data transfers; and
• Security obligations.

Unless contractual provisions provide clarity, a fact-finding exercise will reveal what role each party is taking with respect to the handling and control of data. Cross-warranties are not uncommon and special care has to be taken when data is likely to flow outside the EEA. This is particularly important for companies in a group with overseas entities.

Our specialist lawyers provide highly commercial, affordable advice and can draft, advise on, review or negotiate the right form of outsourcing agreement for you.