Unproductive downtime can have negative financial and reputational risks for
your business, yet it's an easy consequence that flows
from making a bad choice on IT outsourcing - whether it's just an element
of your IT outsourcing or the whole piece. Whether you're looking at software
licensing, hardware leases, managed service provisions, telecoms or hosted
solutions, the jargon can be confusing. Combine this with the legal
technicalities and it's easy to see why many businesses struggle to stay on
track, follow these top 10 tips to help make
sure you stay on track.
With a cloud solution the provider is supplying you with a service not with
the software, these solutions are often cheaper, have a lower drain on your
infrastructure, have more frequent updates and patching, and can be very
secure, it can however be very difficult to control data and to ensure GDPR
compliance when using cloud suppliers. On the flip side installed services give
you much more control but have a bigger drain on your infrastructure and
generally come at a greater cost.
Before signing on the dotted line ensure that the solution you're looking at
works with your existing infrastructure, both hardware and software. Create a list
of all of the solutions that you currently use, provide this to the person
that you're speaking to on outsourced IT and get them to warrant that their
system will work with yours, and that it won't require further changes down the line.
Software pricing mechanisms can be complicated; be upfront with the
outsourced company, let them know how much data you expect to use and how many users will
be using the system at any one time, ask if there any hidden prices if you go
over usage limits both in users or data terms, have a look also at the band's
many of them have big hikes between different pricing bands depending on the
number of users that you have, as a result adding just one or two users can
sometimes results in unexpected price hikes - check this out now have a look
whether you'd be better off paying for more users than you need at the moment
rather than trying to bolt them on later if you anticipate a future need.
Many businesses are surprised to find that these services are not included as
standard in many contracts, if you need to take advantage of these services
discuss it with the supplier at the outset, make sure you have a service
level agreement and that costs and so on are built into the contract. If you
intend to do these things yourself make sure you have the tools to do so, make
sure the supplier is obliged to provide you with any information you need so
that you have everything to hand to make updates and maintenance, remember also
that your obligations around cybersecurity will require you to
maintain, update and patch the software.
Suppliers are often reluctant to take responsibility for backups so check
what's included. If they are going to backup make sure that they're going to
do so frequently enough and to the right level to meet your needs.
Check that the pricing is suitable. If you're going to backup make sure that
you have everything you need in order to do so, you may need to outsource this
element. Remember also that GDPR has a role to play here if you're storing data
you'll need to make sure that you have appropriate GDPR compliant contracts
in place, you may even need consents from data subjects depending on what and how you're storing.
Check the limitation of liability provisions carefully, subtle differences
in the wording can make a big difference. Many suppliers will carve out liability
for things that you might expect them to take responsibility for, for example it's
not uncommon in a data storage contract for the supplier to carve out liability
for data losses. Make sure that any cap set in the limitation of liability
provisions are realistic and meet the sort of losses that you might suffer.
Check your insurance policies, they may come in useful, consider also backing up
data with third parties - have a disaster recovery plan, don't just have it in
place though make sure you test it.
Whether the contract expires naturally or terminates because somebody did
something wrong, it's never too soon to start thinking about what's going to
happen when the contract ends. In particular you may want to move the
services across to another supplier, this is called migration, you should check the
agreement to make sure that you're allowed to do this as some suppliers
restrict it. If you are allowed to do it will the existing supplier help you? If
they will will they charge you for that? Are there time limits? Many suppliers
place strict time limits to say that they'll only help you migrate to another
supplier within a certain period of time following termination. You'll find it
much easier to negotiate with the developer now on what's going to
happen at the end of the contract than you will further down the road, so don't
be afraid to address that issue at the beginning.
It's important to understand firstly what constitutes a breach as this will be
different for all contracts. Also not all breaches are treated equally,
different breaches will have different levels of severity with different
consequences flowing from all of them. Check the agreement to make sure you're
happy with what constitutes a breach and your rights of remedy in the event of
each type. Think in particular about which ones you're most likely to face
and which would cause you the most damage. Don't take it for granted that
you'll be able to force the supplier to remedy any breach many suppliers will
try to carve out this liability in the agreement, if you want them to remedy a
breach make sure that this is dealt with in the agreement from the outset. Think
also again about your rights to migrate if things really go wrong, will you want
to be able to walk away without paying them?
If the software is being tweaked specifically for your needs check what's
included, a developer will only invest so many hours for the price and if you need
more you'll have to pay for it. Be particularly careful with aesthetic
tweaks where what works and what doesn't can be so subjective. Make sure you give
the developer very clear instructions and if possible build in acceptance
tests so that you can ensure that what you're getting is exactly what you want.
Check where your data is going to be stored, think also about any help lines
or remote support assistance, if the supplier can access the system chances
are they'll also be able to access your data. Make sure the contract restricts
them so that they can't send that data or supply that support from outside the
European Economic Area. If they do this can cause you a major headache from a
GDPR point of view. Hopefully this video will give you a useful start in
reviewing your existing contracts and negotiating your next one. Our specialist
IT legal team understands both the technology and the law helping you to
navigate your way through this tricky area. If you would like more support please do
get in touch, if you'd like more information on similar topics please subscribe below.