Outsourcing Is it right for my business and if so, what legal issues do I need to consider?

Size: px

Start display at page:

Download "Outsourcing Is it right for my business and if so, what legal issues do I need to consider?"

Jayson Basil Daniel
8 years ago
Views:

1 Outsourcing Is it right for my business and if so, what legal issues do I need to consider? Tim Lyons DLA Piper 18 March 2015 Is your organisation outsourcing? 46% Outsourcing Intentions Insource More Outsource More Infrastructure No Change Insource More Not sure 5% Outsource More No Change 3% Not sure 38% 57% 51% Applications "AUSTRALIA and New Zealand s top 250 IT shops will spend about $42 billion on technology and related services in the 2015 financial year, new research shows. In an ominous sign for in-house IT departments, more than 50 per cent of participants plan to outsource more infrastructure and applications services this year." Source: the Australian (17/02/15) citing ITNewcom which surveyed 200 organisations from Australia and 50 from New - Zealand each with a IT spend of at least $20 million a year. In-House Counsel Day

2 Why do organisations outsource? Reduce operating costs Transfer assets from the balance sheet Convert expenditure Engage "best-practice" services Allow internal resources to focus skills on other areas Reallocate business and regulatory risks In-House Counsel Day Types of outsourcing 1. Facilities Management 2. Call/Contact Centre Services 3. Network Services 4. Infrastructure Outsourcing 5. Application management/maintenance In-House Counsel Day

3 Session Summary 1. What you need to think about before going to market 2. Preliminary questions regarding how the outsourced solution will work 3. Constraints that exist from a privacy perspective 4. Provisions you should consider to protect you in relation to security In-House Counsel Day Due Diligence What is due diligence in outsourcing transactions? the investigation into a customer's IT environment, business processes, assets, contracts and employees that occurs prior to signing an agreement for the provision of outsourced services In-House Counsel Day

4 Due Diligence areas of investigation Full scope of the services Assets Third party contracts Employees Regulatory issues Physical premises requirements "In-flight" projects In-House Counsel Day Due Diligence In an outsourcing arrangement: A customer will want a service provider to conduct due diligence to understand the services and the infrastructure currently in place. A service provider will want to satisfy itself that: (1) it will be able to provide the services to the level required (2) it has properly priced the services (3) it understands the scope of the services / infrastructure in place In-House Counsel Day

5 The "Expectations Gap"? In-House Counsel Day Interesting feature of outsourcing agreements Outsourcing contracts are 'long term contracts of varying levels of interdependence' As a result, effective management of change is critical In-House Counsel Day

6 Not all change should be managed equally Changes must be mutually agreed Scenario 1 Effective Supplier veto Customerrequested change Supplier must implement change - AND - Scenario 2 IF adverse cost impact, variation in charges to be agreed If agreed, implement through change control If not agreed, pre-determined interim pricing implemented until agreed In-House Counsel Day Possible principles for dealing with costs? The Supplier must use its reasonable endeavours to comply with the requirement at no additional cost through the use of existing resources. If the Supplier is unable to comply with the requirement without incurring additional cost, Supplier must provide: an explanation of why compliance with the requirement is not possible without incurring additional cost a reasonably accurate estimate of the additional cost likely to be incurred. The Customer will have the right to adjust, reprioritise or waive the requirement to perform specific services or other activities. To the extent additional effort is required, the charges for such additional effort will be calculated using [discounted time and materials rates] To the extent additional materials are required, the Customer will be liable for the cost of such additional materials with no margin (provided as well that where the Customer has paid for such additional materials it will own such materials). In-House Counsel Day

7 Possible principles cont. The Supplier will: ensure that any additional charges or costs are reasonably and equitably determined, including by ensuring that where other customers of the Supplier are similarly impacted, any allocation of charges or costs is fair and equitable at all times use its reasonable efforts to mitigate the amount payable by the Customer provide information reasonably necessary to validate any amounts claimed from the Customer under this clause (for example, through the provision of timesheets or receipts for discrete items of material) In-House Counsel Day The key legal considerations 1. Privacy constraints 2. Security of your systems In-House Counsel Day

8 Privacy constraints new privacy laws While cost pressures are pushing organisation's to outsource - privacy is a major concern. More and more data is being collected. all companies are "data processing companies" In-House Counsel Day Is privacy relevant? Legal privacy constraints will be relevant in most outsourcing arrangements. Preliminary question: What part of the business is to be outsourced and what is the particular outsourcing arrangement? In-House Counsel Day

9 How the proposed solution will work? Packaged (off-the-shelf- Software) Infrastructure (as-a-service) Platform (as-a-service) Software (as-a-service) Application Application Application Application Managed by the client Data Runtime Middleware O/S Virtualisation Servers Storage Networking Managed by the client Managed by the supplier Data Runtime Middleware O/S Virtualisation Servers Storage Networking Managed by the client Managed by the supplier Data Runtime Middleware O/S Virtualisation Servers Storage Networking Managed by the supplier Data Runtime Middleware O/S Virtualisation Servers Storage Networking In-House Counsel Day A new privacy regime in Australia Effective from 12 March 2014 Personal Information Liable for actions of a supplier Key Australian Privacy Principles: APP 1; APP 5; APP 8; APP 11 In-House Counsel Day

10 Key security provisions Security requirements will be relevant in most outsourcing arrangements As with privacy - this often depends on what part of the business is to be outsourced In-House Counsel Day Key security provisions Warranties & indemnities Unlimited liability for breaches of security Notification of breaches of security Protocols for breaches of security Compliance with specific security policies Insurance for breaches of security In-House Counsel Day

11 Key security provisions Government Government outsourcing Federal Dep. of Finance draft cyber security clauses Model clauses (draft form) Requirements: Overarching obligations to protect the customer data The Commonwealth Data Protection Plan (CDPP) Notification requirements for breach incidents Insurance requirements In-House Counsel Day Summary & Questions Takeaway points: Outsourcing is increasing rapidly organisation's battling to stay competitive Proper due diligence is vital Privacy issues must be considered Security obligations under the agreement are key Questions? In-House Counsel Day

12 Key Contacts Tim Lyons Partner T: E: Tim.Lyons@dlapiper.com In-House Counsel Day

CONTRACTOR AND SUPPLIER INSURANCE REQUIREMENTS

CONTRACTOR AND SUPPLIER INSURANCE REQUIREMENTS SCOPE This Policy applies to all staff globally. POLICY (Note: Relevant guidelines and procedures are incorporated within or attached as appendices) Comcover