Short answer: A good IT outsourcing contract is measured not when delivery runs smoothly, but at three hard moments: when service misses its commitments, when the parties argue over who owns what was built, and when the contract ends while systems must keep running. Four clause blocks — scope and SLA, intellectual property, data protection, and exit handover — must be locked at signing, because renegotiating them mid-term always disadvantages the client.
SLA and sanctions: commitments must be measurable and priced
A service level agreement should define measurable indicators (availability, response and resolution times by severity), the measurement method and data source, and the financial consequence of missing them — usually service credits against fees plus termination rights for repeated failure. Under the Commercial Law 36/2005/QH11 frame, agreed breach penalties may not exceed 8% of the value of the breached obligation portion; damages beyond penalty rest on actual loss. The common drafting error is a qualitative SLA with no measurement method, unenforceable in dispute. For software development, the contract also needs phase acceptance milestones, product acceptance criteria and rights to reject substandard deliverables with cure duties in a set period.
IP and data: two assets never to leave to default
Rights in software the partner creates during outsourcing must be expressly agreed: assignment to the client of property rights in commissioned deliverables, the partner’s retained rights in its pre-existing tools and libraries, and handover of source code and technical documentation. Leaving commissioned software to general legal default is a classic dispute risk when the client wants to change provider. On data, the outsourcing partner is a data processor under the Personal Data Protection Law 91/2025/QH15 frame: the contract needs a data processing agreement fixing access scope, security standards, sub-processors and incident notification. The exit clause closes the lifecycle: transition support for a set period, data handover in open formats, source code and operating documents, and deletion of client data at the partner after transition — without this block, leaving a weak vendor becomes a crisis project.
Negotiation checklist
- An SLA with indicators, measurement method, service credits and a repeated-breach termination threshold.
- IP clauses: assignment of commissioned deliverables, partner’s background-tool rights, source-code handover.
- A data processing schedule in the processor role, with sub-processor control.
- Exit clauses: transition support, handover formats, post-transition data deletion.
Frequently asked questions
What makes SLA and penalty clauses sufficient in an outsourcing contract?
The SLA needs measurable indicators, a measurement method and data source, a service-credit scale against fees by shortfall level, and termination rights for repeated or serious breach. Agreed penalties sit within the 8% cap of the breached obligation’s value under the Commercial Law; for real teeth, the service-credit structure and termination rights matter more than a large, hard-to-collect penalty figure.
Who owns IP in outsourced deliverables?
Whomever the contract says — this clause must never be left blank. Correct practice assigns the client property rights in commissioned and delivered products, while the partner keeps rights in its pre-existing background tools and libraries, licensed as needed for the product. Source code and documentation belong in the handover list.
How is data protected when shared with a partner?
Through a data processing agreement attached to the contract: the partner accesses data only within the service scope, applies committed security standards, uses no sub-processors outside the approved list, notifies incidents within a short window and accepts client audit. The client as controller remains responsible before regulators under Law 91/2025.
What does system handover on termination include?
Transition support for an agreed period, data handover in usable formats, source code and operating documentation within the agreed scope, parallel-running support with the new provider and confirmed data deletion after transition. This clause must be signed at the start — negotiating it at termination means the client has already lost leverage.
This article has been quality-reviewed by the FLAW AI Legal Council