TRW & Co · Technology, Data & IP
IT Contract and Outsourcing Lawyers in London
IT contract lawyers in London advise on software, SaaS, cloud, systems integration and outsourcing agreements. With no single technology statute, the contract carries the risk: liability caps, service levels, data protection terms, TUPE and exit plans. Regulated firms must also meet FCA and PRA outsourcing and operational resilience expectations.
Key pointCourts read liability caps by their exact words: in Drax v Wipro a cap was treated as a single aggregate limit, not a cap per claim. State expressly how caps, service credits and liquidated damages interact.
At a glance
Implied care and skill
The Supply of Goods and Services Act 1982 implies that business services will be performed with reasonable care and skill unless validly excluded.
Article 28 processor terms
Where suppliers process personal data, the UK GDPR requires written terms covering instructions, security, sub-processing, assistance and data return or deletion.
Financial services rules
FCA SYSC 8 and PRA SS2/21 set outsourcing expectations, and critical third party rules in PS16/24 have applied since 1 January 2025.
TUPE on service changes
Outsourcing, re-tendering and insourcing can transfer the employees assigned to a service automatically, on their existing terms.
Insolvency termination limits
Section 233B of the Insolvency Act 1986 restricts suppliers from terminating supply contracts because the customer enters an insolvency process.
Swipe or scroll →
What IT and outsourcing law covers in England and Wales
IT contract lawyers in London advise on the agreements through which organisations buy, build and run technology: software licences, SaaS and cloud subscriptions, systems integration and implementation projects, managed services, business process outsourcing, data centre and hosting arrangements, and the AI tools now embedded in all of them. They also advise when those arrangements fail, through renegotiation, exit or dispute.
There is no single statute for technology contracts in England and Wales. The terms the parties agree do most of the work, shaped by general contract law, implied terms legislation, controls on exclusion clauses and a growing body of sector rules on data, cyber security, operational resilience and employment. That makes drafting decisive: a poorly defined service, an unclear liability cap or a missing exit plan can cost far more than the contract's annual fee.
IT and outsourcing become legal questions at the points that matter commercially: choosing a supplier, signing a cloud platform's standard terms, launching a transformation programme, moving a function offshore, bringing a service back in house, or discovering that a project is late, over budget or not working. IT contract lawyers London customers and suppliers instruct help both sides allocate risk in a way that is realistic and enforceable.
The legal and regulatory framework
Contract law and implied terms
Where a supplier provides a service in the course of business, the Supply of Goods and Services Act 1982 implies a term that it will be carried out with reasonable care and skill, unless the contract validly excludes or modifies it. The Unfair Contract Terms Act 1977 prevents exclusion of liability for death or personal injury caused by negligence and subjects many other exclusions, particularly in standard terms, to a reasonableness test. Contracts with consumers are governed by the Consumer Rights Act 2015 instead.
The courts interpret technology contracts like any other commercial contract, but several decisions have particular weight. In Triple Point Technology v PTT [2021] UKSC 29, the Supreme Court held that liquidated damages for delay accrued up to termination even though the software was never accepted, and that an exception to a liability cap for negligence covered negligent performance generally. In Drax Energy Solutions v Wipro [2023] EWHC 1342 (TCC), the court read a liability cap as a single aggregate cap rather than a cap per claim. Both show how much turns on the exact words of the limitation clause; see our guide to limitation of liability clauses.
Data protection and cyber security
Most IT and outsourcing contracts involve personal data. The UK GDPR requires controllers to use only processors that provide sufficient guarantees and to put in place written terms covering the matters listed in Article 28, including instructions, confidentiality, security, sub-processing, assistance and deletion or return at the end. The Data (Use and Access) Act 2025 amended the UK regime, including the test for international transfers. Transfers to offshore suppliers need a lawful mechanism; the ICO's international transfers guidance explains the options.
Operators of essential services and relevant digital service providers are subject to the Network and Information Systems Regulations 2018. The proposed Cyber Security and Resilience Bill would extend that regime to more managed service providers and data centres; see our note on the Cyber Security and Resilience Bill.
Financial services outsourcing
Regulated firms carry extra obligations. The FCA's SYSC 8 rules require firms not to outsource important operational functions in a way that impairs internal control or the regulator's ability to supervise. The PRA's supervisory statement SS2/21 sets detailed expectations for banks and insurers on materiality assessment, due diligence, contract terms, access and audit rights, sub-outsourcing, business continuity and exit. Operational resilience rules require firms to stay within impact tolerances for important business services, including when a supplier fails.
Under powers added by the Financial Services and Markets Act 2023, HM Treasury can designate critical third parties to the UK financial sector, which then become directly subject to the regulators' rules published in PS16/24, in force from 1 January 2025. EU financial entities and their suppliers are subject to the Digital Operational Resilience Act, which has applied since 17 January 2025.
Employment and public sector rules
Outsourcing, re-tendering and insourcing a service will often be a service provision change under the Transfer of Undertakings (Protection of Employment) Regulations 2006, so employees assigned to the service transfer automatically on their existing terms. Public sector buyers procure under the Procurement Act 2023, which governs procurements started from 24 February 2025. These rules apply across Great Britain in broadly the same way, while Northern Ireland has its own TUPE regulations and Scotland has its own procurement framework for devolved bodies.
How IT contract lawyers in London choose the right contract model
The structure of the deal should follow the risk. A commodity SaaS subscription and a multi-year transformation of core banking systems need very different contracts. IT contract lawyers in London start by agreeing with the client which model fits and how much negotiation is realistic.
| Model | Typical use | Negotiating leverage | Key legal focus |
|---|---|---|---|
| SaaS or cloud subscription | Standard software or infrastructure delivered as a service | Low for hyperscale providers; moderate for specialist vendors | Service levels, data location and security, suspension rights, exit and data return |
| Software licence and support | On-premises or private cloud software | Moderate | Licence scope, audit rights, maintenance commitments, escrow |
| Systems integration or implementation | Building or configuring a new platform | Moderate to high | Milestones, acceptance testing, delay remedies, change control, ownership of deliverables |
| Managed IT services | Running infrastructure, applications or service desks | High | Service descriptions, service credits, transition, TUPE, step-in and exit |
| Business process outsourcing | Finance, HR, customer service or claims handling | High | Regulatory compliance, data protection, workforce transfer, governance |
| Multi-sourcing with a service integrator | Several suppliers coordinated by one integrator | High | Cross-supplier collaboration duties, responsibility matrix, dispute coordination |
Our guides to SaaS agreements and key terms in an outsourcing contract explain each model in more depth.
Liability and remedies
Liability clauses decide who bears the cost when a project fails or data is lost. Customers usually want higher caps, or uncapped liability, for data protection breaches, confidentiality and wilful default; suppliers want a single aggregate cap linked to fees and exclusions for indirect and consequential loss. The clause should state clearly whether a cap is per claim, per year or for the life of the contract, and how it interacts with service credits and liquidated damages.
AI and new technology
Contracts for AI tools raise further questions: rights in input and output data, training on customer data, accuracy and bias, explanations for automated decisions, and the allocation of intellectual property risk. Our artificial intelligence team and our guide to AI contracts address these issues.
From procurement to signature: the process
- Define requirements. Set out the business need, the service scope, required service levels, security standards, regulatory constraints and the exit position before going to market.
- Run the selection. Issue a request for proposal with the key contract principles attached, so bidders price the risk allocation you want rather than their own terms.
- Due diligence. Assess the supplier's financial standing, security certifications, sub-contractors, data locations, insurance and, for regulated firms, the materiality of the arrangement.
- Negotiate the contract. Agree the master terms, service descriptions, service level regime, charges, governance, data protection terms, transition plan and exit plan as one package.
- Regulatory notifications. Where required, notify the FCA or PRA of material outsourcing, record the arrangement in the firm's register and update operational resilience mapping.
- Transition. Manage the transfer of services, data, assets and, where TUPE applies, employees, with information and consultation carried out on time.
- Govern and review. Run governance meetings, track service credits and change requests, and review the contract against business needs and regulatory change.
- Plan the exit. Keep the exit plan current, test it where proportionate and start re-procurement early enough to avoid being locked in.
The exit plan is the clause most often left until last and the one most needed when a relationship sours. Agree the scope of exit assistance, the data to be returned and in what format, the charges for exit services and the period for which the supplier must continue to provide service during migration, while you still have the leverage of an unsigned deal.
Key documents and schedules
An outsourcing or major IT agreement is usually a master agreement plus schedules. The schedules are where most disputes are won or lost, so IT contract lawyers London clients rely on review them as closely as the legal terms.
- Service description. What exactly is to be delivered, to what standard, and with what dependencies on the customer.
- Service levels and credits. Measurable service levels, measurement periods, credit calculations and termination triggers for persistent failure.
- Charges. Pricing model, indexation, volume bands, benchmarking and any gainshare.
- Implementation plan. Milestones, acceptance tests and delay remedies for build projects.
- Data protection schedule. Article 28 processing terms, security measures, sub-processor approvals and transfer mechanisms.
- Governance and change control. Boards, reporting, escalation and how changes to scope and price are agreed.
- Exit plan. Exit assistance, data return, knowledge transfer and continuity of service.
- Employee schedule. TUPE indemnities, employee liability information and arrangements on exit.
Risks and common mistakes
Signing a provider's standard terms without a risk review
Cloud and SaaS providers often present non-negotiable terms. Even where changes are impossible, the customer should understand what it is accepting: rights for the provider to suspend service, to change features or terms unilaterally, to use customer data for its own purposes, and to limit liability to a small multiple of monthly fees. Where terms cannot be changed, the response is to manage the risk elsewhere, through architecture, backups, insurance, alternative providers or a documented decision by the business to accept the risk. Regulated firms must also check the terms meet regulatory expectations.
Vague service descriptions
When a service is described in marketing language, disputes about what was promised are almost inevitable. Customers then struggle to prove breach and suppliers struggle to resist scope creep. A good service description identifies inputs, outputs, standards, assumptions and customer dependencies, and links them to measurable service levels. It is worth investing time here before signature, because the description also drives pricing, change control and exit.
Ambiguous liability caps and exclusions
Recent cases show courts reading caps and exclusions according to their precise wording. A clause that does not say whether a cap is aggregate or per claim, or that excludes loss of data or loss of profits without considering whether those are the main losses the customer will suffer, can leave a party without the protection it thought it had. Draft caps with worked examples in mind, carve out the losses that matter most, and check consistency with service credits and liquidated damages.
Forgetting TUPE on outsourcing, re-tendering and insourcing
Moving a service to a supplier, between suppliers or back in house frequently transfers the employees assigned to it. Failing to plan for this leads to unexpected staff costs, claims for failure to inform and consult, and unfair dismissal exposure. Contracts should include employee liability information, indemnities and clear rules about changes to the workforce during the term and before exit. See our guide to TUPE transfers.
Relying on termination for supplier insolvency
Section 233B of the Insolvency Act 1986 restricts a supplier's right to terminate when its customer enters an insolvency process. Customers, by contrast, can usually terminate if a supplier becomes insolvent, but termination may not keep the service running. Practical protection comes from source code or SaaS escrow, step-in rights, data portability, business continuity plans and monitoring the supplier's financial health.
In technology contracts, the cheapest time to agree how to leave is before you have arrived.
When projects fail: renegotiation and disputes
Large IT projects run late or over budget more often than either side expects, and IT contract lawyers in London are frequently first called when a programme is already in difficulty. The first response is usually contractual: use change control, invoke governance and escalation, issue formal notices of delay or breach, and preserve the record. Many disputes are resolved through a revised plan, a commercial settlement or a managed exit.
Where they are not, disputes are typically resolved in the Technology and Construction Court or by arbitration, often after expert determination or mediation provided for in the contract. Claims commonly concern responsibility for delay, whether acceptance tests were met, the scope of change requests, the validity of termination and the effect of liability caps. IT contract lawyers in London work with our contract disputes team from the first sign of trouble, because notices and correspondence written during a project often decide the outcome of a later claim.
Cross-border outsourcing: Bangladesh, India, the EU and beyond
Offshore and nearshore delivery is central to many outsourcing deals. Bangladesh has a growing IT and IT-enabled services sector serving UK and European clients, and TRW & Co's Dhaka office can advise on local entity structures, employment, data and tax issues for delivery centres there, while our London team handles the English law contract.
- Data transfers. Offshore access to UK personal data is a restricted transfer requiring an approved mechanism and a transfer risk assessment, unless the destination benefits from UK adequacy regulations. Our guide to international data transfers explains the options.
- EU rules. Suppliers to EU financial entities must accommodate DORA contractual requirements, and the EU Data Act introduces cloud switching rights that may affect multinational contracts.
- The Gulf and Singapore. Data localisation, financial regulator approvals and local licensing can apply to services delivered to group companies in those jurisdictions.
- China. Data export controls and cybersecurity rules can restrict how data generated in China is shared with UK service providers.
Choice of law, dispute resolution and enforceability of judgments or arbitral awards in the supplier's home jurisdiction should be considered at the outset, not after a dispute arises.
How TRW & Co helps
TRW & Co's London office is authorised and regulated by the Solicitors Regulation Authority. As IT contract lawyers in London, we act for customers and suppliers, and we focus on contracts that operational teams can actually run.
Technology procurement
We prepare requirements, contract principles and RFP terms, and advise on supplier selection, due diligence and regulatory notifications.
Cloud and SaaS
We review and negotiate cloud and SaaS terms, assess non-negotiable risks and advise on data protection, security and exit arrangements.
Outsourcing transactions
We draft and negotiate master agreements and schedules for IT and business process outsourcing, including TUPE and transition planning.
Financial services compliance
We align outsourcing arrangements with SYSC 8, SS2/21, operational resilience rules and, where relevant, DORA and the critical third parties regime.
Renegotiation and exit
We advise on contract health checks, restructuring troubled projects, exercising termination rights and managing exit and re-procurement.
Technology disputes
We advise on notices, settlement and proceedings in the courts or arbitration, instructing specialist counsel where advocacy in the higher courts is required.
We work closely with our technology, data protection and cyber security teams. The full range of services is on our practices page.
Checklist for decision-makers
Before signing a major technology or outsourcing deal, or when reviewing one, IT contract lawyers London boards and CIOs instruct usually test these points.
- Is the service described precisely enough to prove breach and to price change?
- Do service levels measure what the business actually needs, with meaningful credits and termination triggers?
- Is the liability cap clear on whether it is aggregate or per claim, and are data and security losses properly addressed?
- Do the data protection terms meet Article 28 and cover international transfers?
- Are regulatory requirements, such as SYSC 8, SS2/21 and operational resilience, reflected in the contract?
- Has TUPE been assessed for the start of the contract and for exit?
- Is there a detailed, costed exit plan, and has data portability been tested?
- What happens if the supplier becomes insolvent or is acquired by a competitor?
- Which law and forum govern disputes, and can a judgment or award be enforced where the supplier's assets are?
To discuss a technology contract or outsourcing project, contact our London office or email info@trw.co.
Frequently asked questions
01Can we negotiate the terms of a major cloud provider?
Sometimes, but leverage depends on spend, sector and the provider. Hyperscale providers usually offer standard terms with limited negotiation, although large customers and regulated financial institutions often obtain addenda covering audit, access, security and exit. Specialist SaaS providers are usually more flexible. Where terms cannot be changed, the customer should document the risk assessment and manage residual risk through architecture, backups, multi-cloud strategies or insurance, rather than assuming the standard terms are adequate.
02What liability cap is normal in an IT contract?
There is no standard figure. Caps are usually linked to the charges paid or payable over a period, with separate or higher caps for data protection, confidentiality and security breaches, and uncapped liability for matters the law does not allow to be limited, such as death or personal injury caused by negligence and fraud. The key is clarity: state whether the cap is per claim, per year or aggregate, and how it interacts with service credits, liquidated damages and indemnities.
03Does TUPE apply when we outsource IT services?
It often does. Where an organised grouping of employees principally carries out the activities being outsourced, those employees will usually transfer to the supplier under the service provision change rules in the TUPE Regulations 2006. The same can apply when the service moves to a new supplier or back in house. Exceptions exist, for example for short-term tasks or the supply of goods, and the analysis depends on the facts. The contract should allocate TUPE costs and liabilities on entry and exit.
04What must a financial services firm include in an outsourcing contract?
FCA-regulated firms must comply with SYSC 8, and PRA-regulated banks and insurers must also meet SS2/21. Material outsourcing arrangements generally need clear service descriptions, access, audit and information rights for the firm and its regulators, data security and confidentiality terms, sub-outsourcing controls, business continuity and testing, termination rights and a documented exit strategy. Firms must also notify the regulator of certain material arrangements and map them into their operational resilience framework.
05How do we protect ourselves if a key software supplier fails?
Contractual termination rights alone will not keep a service running. Consider source code or SaaS escrow, step-in rights, data export in usable formats, documented exit assistance, business continuity plans and monitoring of the supplier's financial position. For critical services, a tested alternative supplier or in-house fallback may be justified. Remember that suppliers' own termination rights on a customer's insolvency are restricted by section 233B of the Insolvency Act 1986, but the reverse protection is not automatic.
06What is the difference between service credits and damages?
Service credits are pre-agreed reductions in charges when service levels are missed. They are usually intended as a price adjustment rather than full compensation, and the contract should say whether they are the customer's sole remedy for the failure or are without prejudice to a damages claim. Damages compensate for actual loss caused by breach, subject to the liability cap and exclusions. Liquidated damages for delay are a separate mechanism, and the Supreme Court's decision in Triple Point v PTT shows the importance of drafting how they operate on termination.
07Are AI tools covered by standard IT contract terms?
Often not adequately. Standard software and SaaS terms may not address whether the supplier can train its models on your data, who owns or can use outputs, how accuracy and bias are tested, what happens if outputs infringe third-party rights, or how automated decision-making rules under data protection law are met. AI-specific clauses or an addendum are usually needed, and the risk allocation should reflect how the tool will be used in your business.
Sources and official materials
- Supply of Goods and Services Act 1982 — Implied terms in service contracts
- Unfair Contract Terms Act 1977 — Controls on exclusion and limitation clauses
- FCA Handbook SYSC 8: Outsourcing — FCA outsourcing requirements
- PRA SS2/21: Outsourcing and third party risk management — PRA expectations for banks and insurers
- PS16/24: Critical third parties to the UK financial sector — Rules for designated critical third parties
- TUPE Regulations 2006 — Employee transfers on outsourcing
- Drax Energy Solutions v Wipro [2023] EWHC 1342 (TCC) — Interpretation of liability caps
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.