TRW & Co · Commercial contracts
Outsourcing Contracts: Key Terms and Risk Allocation
An outsourcing contract hands a business function to an external supplier for years, so the terms must define performance, control change, allocate risk and secure a clean exit. This guide explains the clauses that matter most under English law, including service levels and credits, step-in, data protection, TUPE and exit assistance, and the regulatory rules for financial services firms.
Key pointThe customer's leverage is highest before signing and lowest at exit. A detailed, priced exit plan and run-off obligation agreed at the start is often worth more than any service credit regime.
At a glance
Processor terms are mandatory
Where the supplier processes personal data for the customer, Article 28 of the UK GDPR requires a written contract containing prescribed processor obligations.
TUPE can move staff
Outsourcing, changing supplier or bringing services back in-house can be a service provision change, transferring dedicated employees automatically on existing terms.
Regulated firms have extra rules
FCA firms must follow SYSC 8 for critical or important functions, and PRA-regulated firms must also meet supervisory statement SS2/21 on outsourcing.
Credits are not damages
Service credits adjust the price for missed service levels; whether they are the sole remedy or sit alongside damages is a key negotiation point.
Exit needs a plan
Exit assistance should be documented in an exit plan with run-off services, data return, staff information and pre-agreed charges from the outset.
Swipe or scroll →
The short answer: what an outsourcing contract must do
An outsourcing contract transfers the performance of a business function, such as IT infrastructure, payroll, customer service, logistics or back-office processing, to an external supplier for a period of years. A well-drafted outsourcing contract does four things: it defines the services and how performance is measured, prices them and controls change, allocates risk if things go wrong, and makes sure the customer can leave and take the service back or move it to a new supplier.
The clauses that carry most of that weight are the service levels and service credits, change control, data protection, step-in rights, liability caps and exit assistance. Under English law, the courts will generally enforce what sophisticated parties agree, so gaps in these provisions are rarely filled in the customer's favour.
This guide explains each key term, the regulatory overlay for financial services firms and public bodies, the employment consequences under TUPE, and the mistakes we see most often.
The legal and regulatory framework
Outsourcing is mainly governed by contract law, but several regimes shape what the contract must contain:
- Data protection. Where the supplier processes personal data for the customer, Article 28 of the UK GDPR requires a written contract with prescribed processor terms, including acting only on documented instructions, confidentiality, security, sub-processor controls, assistance with data subject rights and deletion or return of data at the end.
- Employment. The Transfer of Undertakings (Protection of Employment) Regulations 2006 can apply to a "service provision change" when activities are outsourced, moved between suppliers or brought back in-house, so employees assigned to the activities may transfer automatically.
- Financial services regulation. FCA-regulated firms must comply with the outsourcing rules in SYSC 8 for critical or important functions. PRA-regulated firms must also meet the expectations in supervisory statement SS2/21 on outsourcing and third party risk management.
- Critical third parties. HM Treasury can designate technology and service providers as critical third parties, which are then overseen by the Bank of England, the PRA and the FCA.
- Exclusion clauses. The Unfair Contract Terms Act 1977 applies a reasonableness test to some limitations of liability on standard terms and prevents exclusion of liability for death or personal injury caused by negligence.
- Public sector. Public bodies procuring outsourced services must follow the public procurement rules, now principally the Procurement Act 2023 regime.
Key terms in an outsourcing contract
Service description and service levels
The service description should state what the supplier will do, to what standard, using what resources and from where. Service levels translate that into measurable targets, such as availability, response and resolution times, processing accuracy or customer satisfaction scores, with clear measurement methods and reporting.
A good outsourcing contract also includes "critical" service levels whose failure has stronger consequences, and a mechanism to add or reset service levels as the service matures.
Service credits
Service credits are pre-agreed reductions in the charges when service levels are missed. They give the supplier a financial incentive to perform without the customer having to prove loss. The contract should say whether credits are the customer's sole remedy for the failure or are without prejudice to damages; suppliers usually push for the former. Credits are typically capped at a percentage of the monthly charges at risk.
Service credits should be framed as a price adjustment reflecting the reduced value of the service. Following the Supreme Court's restatement of the penalty rule in Cavendish Square Holding BV v Makdessi [2015] UKSC 67, a clause that protects a legitimate interest and is not out of all proportion to it will generally be enforceable, but careful drafting still matters.
Change control
Long-term services inevitably change. A change control procedure sets out how either party can request a change, how the supplier prices it, who approves it and how the contract is updated. Without it, scope creep produces disputes about what is in the base charge and what is extra.
Data protection and security
Beyond the Article 28 terms, customers should require specific security standards, audit rights, breach notification within a short period so that the customer can meet its own reporting duties, controls on offshoring and sub-processors, and a mechanism for international data transfers where data leaves the UK.
Step-in rights
Step-in rights allow the customer, or a third party it appoints, to take over performance of the affected services temporarily when there is a serious failure, a regulatory requirement or an emergency. They are common in regulated and critical outsourcings. The contract should define the triggers, the supplier's obligation to cooperate, the charges payable during step-in and how control is handed back.
Liability and indemnities
Liability provisions usually set an annual or aggregate cap linked to the charges, exclude indirect and consequential loss and carve out certain heads of loss. Customers should consider whether the cap is sufficient for data loss, regulatory fines and the cost of replacement services. Our guide to limitation of liability clauses explains how English courts interpret these provisions.
Exit assistance
Exit provisions are often neglected and become critical at the end of the term or on early termination. They should require the supplier to maintain an exit plan, continue the services for a run-off period, transfer data in a usable format, provide information about staff and assets, and cooperate with any replacement supplier, all at pre-agreed charges.
| Term | Customer priority | Supplier priority |
|---|---|---|
| Service levels | Comprehensive, measurable, with critical levels | Limited number, realistic, with relief events |
| Service credits | Without prejudice to damages; meaningful amounts | Sole remedy; low cap on amount at risk |
| Change control | Fixed pricing method; customer approval | Right to price changes at current rates |
| Step-in | Broad triggers; supplier cooperation | Narrow triggers; relief from service levels |
| Liability cap | High cap; carve-outs for data and confidentiality | Cap linked to annual charges; broad exclusions |
| Termination | For convenience and on change of control | Termination fees; limited customer rights |
| Exit | Detailed plan; run-off at existing rates | Exit charges; time-limited assistance |
Charges, governance and term
Charging models
Outsourcing charges may be fixed, based on resource units consumed, linked to outcomes, or a mixture. Each model allocates volume risk differently. Fixed charges give the customer certainty but can leave it paying for capacity it no longer uses; unit-based charges track demand but need clear baselines and volume bands. The outsourcing contract should also deal with indexation, benchmarking rights to test whether charges remain competitive, and the treatment of transition costs if the contract ends early.
Governance
A governance schedule sets up the meetings, reports and escalation routes that keep a long-term relationship on track. It usually provides for operational, service and executive-level boards, monthly performance reports, a risk and issues log, and a dispute resolution procedure that escalates through management before mediation, expert determination or proceedings. Good governance resolves most problems before they become claims.
Term and renewal
Terms commonly run for several years, reflecting the supplier's investment in transition. Customers should seek extension options at their election rather than automatic renewal, and should align the term with technology refresh cycles so that the service does not become outdated half-way through.
Subcontracting and supplier insolvency
Customers should control subcontracting of material parts of the service, require flow-down of key obligations and retain approval rights over offshore delivery. Because a supplier failure can halt critical operations, the contract should include financial distress triggers, business continuity and disaster recovery obligations, and escrow or similar arrangements for critical software.
How an outsourcing contract is negotiated
- Define the requirement. Document the current service, volumes, costs and service levels, and decide what will be outsourced and why.
- Due diligence on suppliers. Assess financial standing, security, subcontracting, regulatory track record and the locations from which services will be delivered.
- Issue the contract with the tender. Including key contract terms in the request for proposal forces suppliers to price risk at the competitive stage.
- Negotiate the core terms. Focus on service levels, credits, liability, data protection, step-in, termination and exit, and align the schedules with the main terms.
- Plan the transition. Agree the transition plan, milestones, acceptance criteria and TUPE information exchange.
- Sign and notify. Regulated firms may need to notify their regulator before entering a material outsourcing arrangement.
- Govern the relationship. Operate the governance structure, review performance reports, and keep the exit plan and change log up to date.
Employees and TUPE
Where an organised group of employees is principally dedicated to the activities being outsourced, TUPE may transfer those employees to the supplier automatically on their existing terms. The same can happen when the contract moves to a new supplier or the activities come back in-house.
The outsourcing contract should allocate the resulting costs. Typical provisions cover pre-transfer liabilities, information about employees before transfer, indemnities for claims arising before and after the transfer, and the position at exit, when the supplier may want to transfer staff to the next provider. Our TUPE transfer guide explains the employer obligations, including information and consultation.
Negotiate the exit and TUPE provisions as hard at the start as you negotiate price. At the end of an outsourcing contract, the supplier has little commercial reason to cooperate, and the customer's leverage depends almost entirely on what the contract already requires.
Illustrative scenario: an exit nobody planned
This scenario is illustrative only. It does not describe a real client or matter.
A mid-sized insurer outsources its policy administration platform for seven years. The outsourcing contract has detailed service levels but a one-page exit clause that requires the supplier to "provide reasonable assistance" at its then-current rates.
When the insurer decides not to renew, the supplier quotes a high price for data extraction in a usable format, declines to share staff information until late in the process and argues that it owns key configuration documents. The insurer's regulator expects it to show that the transition will not harm customers.
The insurer eventually secures the assistance, but at significant cost and delay. An exit plan agreed at signing, priced exit services, clear ownership of documentation and a run-off obligation would have made the transition routine.
Risks and common mistakes
Service credits that are too low to matter
If the amount at risk is small, a supplier may find it cheaper to absorb credits than to fix underlying problems. If credits are the sole remedy, the customer may be left without a route to recover its real losses.
Customers should set credits at a level that changes behaviour, keep damages available for serious failures, and include termination rights for persistent or critical service level failures.
Unclear ownership of data and intellectual property
Disputes often arise over who owns process documents, configurations, software developed during the term and data derived from the customer's data. Without clear clauses, the supplier may claim ownership of material the customer needs to run the service.
The contract should state that customer data remains the customer's, give the customer ownership of or a licence to deliverables, and ensure that exit includes everything needed to continue the service.
Regulatory requirements left to a schedule
Regulated firms must be able to show that outsourcing does not impair internal control or the regulator's ability to supervise. Audit, access and information rights for the firm and its regulator, sub-outsourcing controls and business continuity requirements are essential.
Map the applicable regulatory requirements to specific clauses at the drafting stage, and keep a compliance matrix that internal audit can review.
Liability caps that do not reflect real exposure
A cap based on twelve months' charges may be adequate for service failures but far too low for a major data breach, a regulatory fine or the cost of urgently replacing the supplier.
Consider separate, higher caps for data protection and confidentiality breaches, and insurance requirements that match the risk.
The cross-border angle
Many outsourcing arrangements involve offshore delivery centres, including in South Asia. Bangladesh has a growing IT and business process outsourcing sector serving UK clients. Offshore delivery raises questions about transfers of personal data, local employment law, enforcement of English judgments or arbitral awards against the supplier, and regulators' access to premises and data.
Customers using offshore suppliers often choose arbitration in London for disputes, because awards are generally easier to enforce internationally. TRW & Co's London and Dhaka offices advise UK customers and Bangladeshi suppliers on contracts, data transfers and dispute resolution, and our Bangladesh supply chain team covers wider sourcing risk.
Checklist before signing an outsourcing contract
- Is the service description complete, including dependencies on the customer?
- Are service levels measurable, with critical levels and meaningful credits?
- Is there a workable change control procedure with a fixed pricing method?
- Do the data protection terms meet Article 28 and cover security, breaches and transfers?
- Are step-in rights, audit rights and regulator access included where needed?
- Do the liability caps reflect the real exposure, including data loss?
- Are TUPE risks allocated at entry and exit?
- Is there a detailed, priced exit plan with run-off services?
Our IT and outsourcing team advises customers and suppliers on outsourcing contract drafting, negotiation and disputes, working with our data protection and commercial contracts teams. For software-as-a-service arrangements, see our guide to the SaaS agreement. To discuss an outsourcing project, contact our London office.
Frequently asked questions
01What is the difference between outsourcing and a normal services contract?
Outsourcing usually involves transferring an existing business function, often with staff, assets, data and third-party contracts, to a supplier for a long term. A normal services contract may simply buy a defined service. Because outsourcing replaces an internal capability, the contract needs more detailed provisions on service levels, governance, change control, TUPE, data protection, step-in and exit than an ordinary supply agreement.
02Are service credits enforceable under English law?
Generally yes, where they are drafted as a price adjustment reflecting the reduced value of the service or otherwise protect a legitimate interest without being out of all proportion to it. The Supreme Court in Cavendish Square Holding v Makdessi restated the penalty rule in these terms. The bigger practical question is usually whether credits are the sole remedy for a failure, which depends on the wording agreed.
03Does TUPE always apply when a service is outsourced?
Not always. TUPE applies to a service provision change where there is an organised grouping of employees in Great Britain whose principal purpose is carrying out the activities for the client, and the activities are not a single specific event or short-term task. It does not apply to the wholly or mainly supply of goods. Whether the conditions are met depends on the facts, so the parties should analyse it early and allocate the risk in the contract.
04What should an exit plan include?
An exit plan should describe the steps to transfer services to the customer or a new supplier, the run-off period during which the supplier continues to perform, the format and timing of data return, transfer of documentation and know-how, information about staff who may transfer under TUPE, assignment or novation of third-party contracts, and the charges for exit services. It should be prepared early in the term and updated regularly.
05Do FCA-regulated firms need to notify the regulator before outsourcing?
Regulated firms should consider their notification obligations before entering into material outsourcing arrangements, particularly for critical or important functions. The FCA's SYSC rules and the PRA's supervisory statement SS2/21 set out expectations on due diligence, contractual terms, access and audit rights, and business continuity. The specific obligations depend on the firm's type and permissions, so the regulatory requirements should be mapped at the planning stage.
06Can a customer terminate an outsourcing contract early?
Only if the contract allows it or the supplier commits a repudiatory breach. Customers usually negotiate termination for material or persistent breach, insolvency, change of control and regulatory direction, and often a right to terminate for convenience on payment of a termination fee. The fee usually reflects the supplier's unrecovered investment. Exit assistance should apply on every type of termination, not only at expiry.
Sources and official materials
- UK GDPR, Article 28 — Mandatory controller-processor contract terms
- TUPE Regulations 2006, regulation 3 — Service provision changes
- FCA Handbook, SYSC 8 — Outsourcing rules for FCA-regulated firms
- PRA SS2/21: Outsourcing and third party risk management — PRA expectations for regulated firms
- Critical third parties (Bank of England) — Oversight of designated critical service providers
- Unfair Contract Terms Act 1977 — Controls on exclusion and limitation clauses
General information only, current as at 21 October 2026. It is not legal advice and does not create a solicitor–client relationship. It reflects the law of England and Wales unless stated otherwise; Scotland and Northern Ireland have separate legal systems, and the law changes frequently. Check current official sources and take advice on the facts of your matter.