IT Outsourcing, Cloud and Hosting Lawyers Adelaide: Contracts, Data, Staff and Exit
IT outsourcing, cloud and hosting lawyers in Adelaide
Outsourcing hands the work to a provider, but the customer usually keeps the legal responsibility for the personal information, the marketing calls and the staff the arrangement touches. Talon Legal advises Adelaide businesses that outsource IT and business processes, and the providers that run them, on cloud, hosting, offshoring, call centre and managed services agreements. Book a same-day free 30-minute consultation or call (08) 7094 2021.
IT outsourcing law snapshot
| Issue | Position in South Australia |
|---|---|
| Governing law | The contract, overlaid by the Australian Consumer Law (Schedule 2 of the Competition and Consumer Act 2010 (Cth)), the Privacy Act 1988 (Cth), the Cyber Security Act 2024 (Cth), the Security of Critical Infrastructure Act 2018 (Cth), the Do Not Call Register Act 2006 (Cth) and Spam Act 2003 (Cth) for outbound marketing, and the Fair Work Act 2009 (Cth) for staff. |
| Data held by a provider | An entity holds personal information if it has possession or control of a record containing it (Privacy Act section 6(1)). It must take reasonable steps to protect that information (APP 11.1). Overreliance on third party providers counted against the company in the first civil penalty case ([52]). |
| Offshore providers | Before disclosing personal information overseas, an entity must take reasonable steps so the recipient does not breach the APPs (APP 8.1), and it can be liable for what the recipient does (section 16C). |
| Unfair contract terms | Void in standard form consumer and small business contracts (ACL section 23(1)). Making a contract that contains an unfair term the business proposed, or applying or relying on one, is a contravention (section 23(2A) and (2C)). |
| Small business contract | One party employs fewer than 100 persons or had turnover under $10,000,000 in its last income year (section 23(4)). |
| Service credits | A sum payable on a missed service level is a penalty only if out of all proportion to the interests it protects (Paciocco v ANZ, Kiefel J at [29]). |
| Suspension | Effective if the contract allows it and is followed. In AIBI v Virtual Technology Services, an IT provider was entitled to suspend its helpdesk when invoices were withheld outside the contract's dispute process ([137] to [140]). |
| Staff | Where outsourced employees are taken on by the provider within three months to do the same work, their enterprise agreement or other transferable instrument can follow them (Fair Work Act sections 311 and 313). A decision to dismiss 15 or more employees for economic, technological, structural or similar reasons must be notified to Centrelink before any dismissal (section 530). |
| Outsourced telemarketing | A business that contracts with a call centre is taken to cause the calls it makes (Do Not Call Register Act section 11(9)), and the contract must expressly require compliance (section 12(1)). |
| Critical infrastructure | A responsible entity for a critical infrastructure asset that learns a provider stores or processes its business critical data must take reasonable steps to tell the provider (SOCI Act section 12F(3)). |
| Data breaches | A suspected eligible data breach must be assessed within 30 days (section 26WH). Where the same breach affects the provider and the customer, notification by one relieves the other (section 26WM). |
| Time limits | Six years for a claim in contract or tort (Limitation of Actions Act 1936 (SA) section 35) and for ACL damages (section 236(2)). |
| First step | Same-day free 30-minute consultation. Call (08) 7094 2021. |
Need an IT outsourcing lawyer in Adelaide?
Our IT outsourcing lawyers in Adelaide act for businesses that buy outsourced services and for the providers that deliver them. The arrangements go by many names: cloud, hosting, colocation, managed services, offshoring, business process outsourcing and call centres. The legal questions repeat across all of them. The contract is overlaid by the Australian Consumer Law (ACL) in the Competition and Consumer Act 2010 (Cth) and by the Privacy Act 1988 (Cth). Depending on the arrangement, the Security of Critical Infrastructure Act 2018 (Cth), the Do Not Call Register Act 2006 (Cth) and the Fair Work Act 2009 (Cth) also apply. This page states the law current to 24 October 2026.
This guide sits within our information technology law practice. The detailed guides cover cloud services agreements, web hosting and data centre agreements, IT offshoring agreements and BPO and call centre agreements.
Free Consultation. Send us the provider’s terms or your draft agreement before you sign. Book a same-day free 30-minute consultation or call (08) 7094 2021.
On this page
- Which outsourcing arrangement are you dealing with?
- What makes an outsourcing agreement different?
- Who is responsible for data the provider holds?
- What changes when the provider is offshore?
- Do the unfair contract terms laws apply?
- Do service levels and service credits work?
- Can a provider suspend the service?
- What happens to staff when work is outsourced?
- Who is liable for an outsourced call centre's calls?
- Do critical infrastructure laws apply?
- How should exit be planned?
- How similar matters tend to play out
- How we act on outsourcing agreements
- Case law
- Frequently asked questions
Which outsourcing arrangement are you dealing with?
Infrastructure and platforms
Cloud services agreements
Infrastructure and platform services on demand: data location, shared security, price and term changes, lock-in and data return.
Web hosting and data centre agreements
Managed hosting and colocation: uptime, suspension under acceptable use policies, liability caps, critical infrastructure duties and migration.
People and processes
IT offshoring agreements
Overseas development and support teams: cross-border personal information, governing law and arbitration, code ownership and Australian staff.
BPO and call centre agreements
Customer service and outbound campaigns: Do Not Call Register and spam liability, call recording, customer data and transfers of staff.
Managed IT services and support
Support desks and managed service providers: service levels, suspension for unpaid invoices, data security and exit.
What makes an outsourcing agreement different?
Dependence. In an ordinary supply contract the customer buys a thing and owns it. In an outsourcing agreement the customer relies on the provider, month after month, for something its business needs to operate. It usually also gives the provider access to its systems and its customers’ personal information.
Several consequences follow. The service has to be described precisely enough to measure, because a dispute about performance turns on what was promised. Legal obligations the customer carries do not move to the provider with the work, so the contract has to give the customer enough control and information to meet them. And the relationship will end one day, so the way out has to be agreed while the customer still has bargaining power.
An IT outsourcing lawyer reads the agreement for those consequences first. Providers read the same clauses from the other side, because terms that overreach can be void, and since 2023 can attract penalties.
Who is responsible for data the provider holds?
Usually the customer, as well as the provider. Under the Privacy Act an entity “holds” personal information if it has possession or control of a record that contains it (section 6(1)). A customer that can direct, retrieve and delete the records its provider stores will usually still control them. It must then take reasonable steps to protect the information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11.1). Those steps include technical and organisational measures (APP 11.3).
The first civil penalty case under the Privacy Act shows how that duty is applied to outsourced systems. In Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224, the company had not taken reasonable steps. One reason was its overreliance on third party service providers, without adequate procedures of its own to detect and respond to incidents ([52]). After a cyberattack it relied on an external provider’s assessment that monitored only 3 of at least 127 affected computers ([77]). Because it knew the assessment was limited, relying on it alone was unreasonable ([78]). The penalties totalled $5,800,000.
The agreement should therefore give the customer what its own obligations require: a stated security standard, prompt notice of incidents, access to logs and cooperation with a breach assessment. A suspected eligible data breach must be assessed within 30 days (section 26WH), and a confirmed one notified to the Information Commissioner and affected individuals as soon as practicable (sections 26WK and 26WL). The same breach can be an eligible data breach of both the provider and the customer. Notification by one of them then means those two obligations do not apply to the other (section 26WM), so the contract should say who notifies.
Smaller customers should check whether the Privacy Act applies to them at all. A business with annual turnover of $3,000,000 or less is generally exempt, unless it falls within a listed exception such as providing a health service or trading in personal information (section 6D). A provider may be bound even where its customer is not.
What changes when the provider is offshore?
A border adds cross-border privacy rules, a foreign legal system and harder enforcement. Before an entity discloses personal information to an overseas recipient, it must take such steps as are reasonable in the circumstances so that the recipient does not breach the APPs (APP 8.1). If the recipient then does something that would breach the APPs, the act is treated as the Australian entity’s own breach (section 16C).
There are exceptions. APP 8.1 does not apply where the entity reasonably believes the recipient is bound by a law or binding scheme substantially similar to the APPs, which individuals can enforce (APP 8.2(a)). Nor does it apply where individuals are expressly told the protection will not apply and then consent (APP 8.2(b)). A further exception covers countries and binding schemes prescribed by regulation (APP 8.2(aa) and 8.3); the current regulations should be checked before relying on it.
Not every offshore arrangement is a disclosure. The Information Commissioner’s APP guidelines treat giving personal information to an overseas contractor as a disclosure in most cases. They also say that a cloud provider engaged only to store the information may be a “use” instead. That requires a binding contract that confines the provider to that purpose, binds its subcontractors the same way and leaves the customer in effective control. The drafting decides which side of the line the arrangement falls on.
An overseas provider may also be bound directly. The Privacy Act extends to acts done outside Australia by an organisation with an Australian link, which includes an organisation that carries on business in Australia (section 5B(1A) and (3)). Our IT offshoring agreements guide covers governing law, arbitration and enforcement against a foreign provider.
Do the unfair contract terms laws apply?
Yes, to standard form outsourcing contracts with consumers and small businesses. A term in such a contract is void if it is unfair (ACL section 23(1)). Since 9 November 2023, making a standard form contract that contains an unfair term the business proposed is a contravention, and so is applying or relying on one. Each term counts separately (section 23(2A) to (2C)). For a body corporate the maximum penalty is the greatest of $100,000,000, three times the benefit, or 30% of adjusted turnover (section 224).
A term is unfair if it would cause a significant imbalance in the parties’ rights and obligations, is not reasonably necessary to protect the advantaged party’s legitimate interests, and would cause detriment if relied on (section 24(1)). The provider carries the burden of proving a term is reasonably necessary (section 24(4)). The statutory examples include terms that let one party alone vary the terms, terminate, or vary the characteristics of the services (section 25(b), (d) and (g)).
The Federal Court has dealt with technology supply terms. ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 concerned small business contracts for office equipment, software and support ([1]). Unilateral variation, automatic renewal, liability limitation and termination payment terms were declared unfair and void by consent ([3] and orders). In ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224, a services supplier’s automatic renewal and unilateral price increase clauses were declared unfair ([56]).
A genuinely negotiated outsourcing agreement may not be standard form at all. In AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696, an IT provider proved its contract was not standard form because the customer had an effective, and successful, opportunity to negotiate it ([93], [96]). That case was decided before the 2023 amendments. Courts must now also weigh how often the same terms are used, and a contract can still be standard form despite negotiation of minor changes (section 27(2)(ba) and (3)).
Do service levels and service credits work?
They work when they are measurable and the consequence of missing them is stated. Availability, response and resolution times should be defined, measured from a fixed point and reported. A service level without a consequence gives the customer little to enforce.
Service credits are fixed sums triggered by a failure, so the penalties doctrine applies. In Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28, Kiefel J, with French CJ agreeing, framed the question. Is a sum payable on default out of all proportion to the interests the provision protects? Those interests may be business or financial ([29]). The appellants did not establish that the bank’s late payment fee was a penalty ([69]). Credits sized to the value of the service lost rarely raise the issue.
The agreement should say whether credits are the customer’s only remedy, and when repeated failure allows termination. A business paying $100,000 or less for the services is a consumer (ACL section 3 and regulation 77A). The services must then be rendered with due care and skill and be fit for a purpose made known (sections 60 and 61). Those guarantees cannot be excluded (section 64).
Can a provider suspend the service?
If the contract allows it and the provider follows the clause. In AIBI, the customer was dissatisfied with the service and withheld payment. The provider suspended its helpdesk and stopped processing tickets for 36 days ([2]). The contract allowed disputed amounts to be withheld only once its dispute mechanism had been activated. It had not been, so the invoices were payable and the suspension was not a breach ([137] to [140]).
Suspension clauses are read for what they say. Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 came to the High Court from South Australia. Exclusion and limitation clauses are construed according to their natural and ordinary meaning, read in light of the contract as a whole. Where appropriate, an ambiguous clause is read against the party relying on it ([16]). In a small business standard form contract, a suspension or termination right for the provider alone may also be unfair. So may a right for the provider alone to decide whether the customer is in breach (section 25(a), (b) and (h)).
What happens to staff when work is outsourced?
It depends on whether the provider takes them on. A transfer of business occurs where an employee’s employment with the old employer ends and, within three months, the employee is employed by the new employer. The work must be the same or substantially the same, and there must be a connection between the employers (Fair Work Act section 311(1)). Outsourcing the work to the new employer is one such connection (section 311(4)), and so is bringing outsourced work back in house (section 311(5)).
When a transfer occurs, an enterprise agreement or other transferable instrument that covered the old employer and the transferring employee covers the new employer and that employee for the transferring work (section 313(1)). Providers price outsourcing deals on their own labour costs, so the instrument that will follow any transferring staff is a commercial point to settle before signing.
Staff who are not taken on may be made redundant. A dismissal is a genuine redundancy only if the employer no longer requires the job to be performed by anyone because of operational changes, and it has met any award or enterprise agreement obligation to consult (section 389(1)). It is not genuine if redeployment within the enterprise, or an associated entity, would have been reasonable (section 389(2)). An employer that decides to dismiss 15 or more employees for economic, technological, structural or similar reasons must notify Centrelink in writing before any dismissal (section 530). It may also have to notify and consult the relevant registered employee associations, the unions (section 531).
Who is liable for an outsourced call centre’s calls?
The business that engaged it, as well as the call centre. Making, or causing to be made, a telemarketing call to an Australian number on the Do Not Call Register is prohibited unless an exception applies (Do Not Call Register Act section 11(1)). A person who enters into a contract or arrangement with another person, who gives effect to it by making a telemarketing call, is taken to have caused the call (section 11(9)). A contract for telemarketing to numbers eligible for the Register must also contain an express provision about compliance. The provider must agree to comply with the Act and to take all reasonable steps so its employees and agents comply (section 12(1)).
The Federal Court applied those provisions to a small business in 2025. In ACMA v V Marketing Australia Pty Ltd (In Liq) (No 4) [2025] FCA 287, a solar installer had engaged a telemarketing company that made 553,630 calls to registered numbers on its behalf ([30], [31]). By force of section 11(9) the installer caused those calls and contravened section 11(1) ([32], [34]). The contraventions were of strict liability ([64]). No penalty was imposed on the installer, because it did not know of the telemarketer’s inadequate washing procedures and had responded reasonably to the regulator’s warnings ([64], [80]). Logan J warned that contracting out telemarketing does not contract out the exposure to penalties ([69]). A business receiving repeated compliance warnings may reach the point where the only reasonable response is to end the contract ([70]).
Emails and text messages follow the same pattern. Sending, or causing to be sent, a commercial electronic message with an Australian link is prohibited unless the recipient consented or another exception applies (Spam Act 2003 section 16). Our BPO and call centre agreements guide sets out the clauses that deal with both.
Do critical infrastructure laws apply?
To some providers and some customers. Under the Security of Critical Infrastructure Act, business critical data includes personal information relating to at least 20,000 individuals (section 5). A data storage or processing service includes a commercial service that lets end users store or back up data, or that processes data (section 5).
A provider’s asset can itself become a critical data storage or processing asset. That happens where it is used wholly or primarily to store or process business critical data for a government end user, or for the responsible entity for a critical infrastructure asset, and the provider knows it (section 12F(1) and (2)). A responsible entity that becomes aware a provider is storing or processing its business critical data on a commercial basis must take reasonable steps to tell the provider as soon as practicable (section 12F(3)). Where the cyber incident reporting rules apply to an asset, a critical incident must be reported within 12 hours and other incidents within 72 hours (sections 30BC and 30BD).
Separately, a business with annual turnover over $3,000,000 that pays a ransom after a cyber incident must report the payment within 72 hours (Cyber Security Act 2024 section 27). If a provider might pay on a customer’s behalf, the contract should say who reports. Our web hosting and data centre agreements guide covers the provider’s side.
How should exit be planned?
At the start, while the customer has leverage. The exit clause should cover the notice period and a transition period during which the provider keeps the service running. It should also deal with handover of data in a usable format, credentials and documentation, the cost of transition work, and deletion once the handover is confirmed.
Deletion has a statutory basis. An APP entity that no longer needs personal information for any permitted purpose, and is not required by law to keep it, must take reasonable steps to destroy or de-identify it (APP 11.2). A provider holding a former customer’s records after the relationship ends is a risk to both of them.
Disproportionate termination terms and termination payment terms were among the terms declared unfair in Fujifilm (orders). A term penalising one party alone for termination is a statutory example of a term that may be unfair (section 25(c)). From 1 July 2027, suppliers of subscription contracts to consumers and small businesses must also provide an easy way to end them. Where the customer signed up online, one way must be online (new ACL section 48F, inserted by the Unfair Trading Practices Act 2026).
How similar matters tend to play out
Three illustrations of how the law on this page combines on ordinary facts. They are not predictions. Outcome depends on the contract, the evidence and the court.
Lower range. An Adelaide retailer with 60 staff signs a platform provider’s standard terms. They let the provider change the service on notice and suspend the account for any breach of its acceptable use policy. Because the retailer employs fewer than 100 people, the contract is a small business contract (section 23(4)), and one-sided variation and suspension rights can be tested as unfair (section 25(a), (d) and (g)). Negotiating notice before suspension and a data export right is usually achievable before signing.
Middle range. A home energy business engages a call centre to generate leads by phone, under a short contract with no Do Not Call Register clause. Signing that contract contravenes section 12(1), and every call the call centre makes to a registered number is treated as caused by the business (section 11(9)). V Marketing shows that exposure exists even without knowledge, and that a prompt, reasonable response to regulator warnings can matter to penalty.
Upper range. A company outsources its customer service to a provider, which hires 20 of its employees within a month to do the same work. Their enterprise agreement covers the provider for that work (sections 311(4) and 313(1)). Another 15 roles go. The company must notify Centrelink before dismissing (section 530), consult as its enterprise agreement requires, and consider redeployment, or the dismissals may not be genuine redundancies (section 389).
How we act on outsourcing agreements
We act for customers and for providers. For a customer, the aim is a service it can measure, the information and control its own legal obligations need, and an exit it can use. For a provider, it is terms that survive the unfair contract terms test, a suspension right it can rely on, and a clear line around what it is responsible for.
| Stage | What happens | What we do |
|---|---|---|
| Scoping | The business decides what to outsource and to whom. | Identify the data, staff, marketing and critical infrastructure issues the arrangement will raise. |
| Due diligence | The provider's terms, security and sub-providers are reviewed. | Check data location, offshore access, unfair terms, liability caps and suspension rights. |
| Drafting | The agreement and schedules are prepared or negotiated. | Draft service levels, credits, security, breach cooperation, staff transfer and exit terms. |
| Transition | Work, staff and data move to the provider. | Advise on transfer of business, redundancy and Centrelink notice, and data migration. |
| Operation | Disputes arise about performance, charges or compliance. | Advise on service credits, withholding, suspension and regulator correspondence. |
| Exit | The agreement ends or is terminated. | Enforce the transition, data return and deletion terms, or resolve the final account. |
We cannot promise an outcome, and no lawyer can. We can give the business an agreement that holds up on the worst day of the relationship.
Every hour matters. Book a same-day free 30-minute consultation, or call (08) 7094 2021 now.
IT outsourcing case law
AIBI concerned an IT services contract, Fujifilm technology supply contracts, and V Marketing an outsourced telemarketing arrangement. The other decisions deal with the data security, guarantee, penalty and construction points that every outsourcing agreement raises.
| Case | Court | Principle | Pinpoint |
|---|---|---|---|
| Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224 | Federal Court | Overreliance on providers; inadequate provider assessment | [52], [77], [78] |
| ACMA v V Marketing Australia Pty Ltd (In Liq) (No 4) [2025] FCA 287 | Federal Court | Client taken to cause its telemarketer's calls; no penalty given its reasonable conduct | [30] to [34], [64], [69], [70], [80] |
| AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696 | Federal Court | Suspension for unpaid invoices; negotiated contract not standard form | [2], [93], [96], [137] to [140] |
| ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928 | Federal Court | Unfair terms in equipment, software and support contracts | [1] to [3] |
| ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224 | Federal Court | Automatic renewal and price variation terms unfair | [56] to [58] |
| Valve Corporation v ACCC [2017] FCAFC 224 | Full Federal Court | Guarantees apply despite a foreign proper law; no contracting out | [103], [107] |
| Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28 | High Court | When a sum payable on default is a penalty | [29], [69] |
| Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82 | High Court | How exclusion and limitation clauses are construed | [16] |
Case notes
Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224
The company had not taken reasonable steps to protect personal information, in part because of its overreliance on third party service providers ([52]). Its reliance on an external provider’s assessment that monitored 3 of at least 127 affected computers was unreasonable, because it knew the assessment was limited ([77] to [78]). Penalties of $5,800,000 were ordered by consent (orders).
ACMA v V Marketing Australia Pty Ltd (In Liq) (No 4) [2025] FCA 287
A solar installer engaged a telemarketer that made 553,630 calls to numbers on the Do Not Call Register on its behalf ([30], [31]). Section 11(9) made the installer the cause of the calls, and it admitted contravening section 11(1) ([32], [34]). Logan J declared the contraventions but imposed no penalty on the installer, given its lack of knowledge and its reasonable response to the regulator’s warnings ([64], [80] and orders), and warned that outsourcing telemarketing does not outsource the exposure ([69], [70]). The telemarketer was ordered to pay $750,000 (orders).
AIBI Holdings Pty Ltd v Virtual Technology Services Pty Ltd [2022] FCA 696
An IT provider suspended its helpdesk for 36 days after its customer withheld payment ([2]). The customer had not activated the dispute process the contract required, so the invoices were payable ([137] to [139]) and the suspension was not a breach ([140]). The contract was not standard form, because the customer had an effective and successful opportunity to negotiate it ([93], [96]).
ACCC v Fujifilm Business Innovation Australia Pty Ltd [2022] FCA 928
The respondents supplied office equipment with associated software and ongoing support services ([1]). After mediation, Stewart J made consent declarations that ten categories of terms in their small business contracts were unfair and void ([3] and orders).
ACCC v JJ Richards & Sons Pty Ltd [2017] FCA 1224
A services supplier’s automatic renewal and unilateral price variation clauses created a significant imbalance in its small business standard form contracts ([56]). The supplier did not show the terms were reasonably necessary to protect its legitimate interests ([57] to [58]).
Valve Corporation v ACCC [2017] FCAFC 224
The Full Court rejected the argument that the consumer guarantees did not apply because the contract’s proper law was foreign ([103]), and said the evident purpose of section 64 is that parties cannot contract out of the guarantees ([107]).
Paciocco v Australia and New Zealand Banking Group Ltd [2016] HCA 28
Kiefel J, with French CJ agreeing, asked whether a sum payable on default is out of all proportion to the interests the provision protects ([29]). The appellants did not establish that the bank’s late payment fee was a penalty ([69]).
Darlington Futures Ltd v Delco Australia Pty Ltd [1986] HCA 82
On appeal from South Australia, the High Court held that exclusion and limitation clauses are construed according to their natural and ordinary meaning, in light of the contract as a whole, and where appropriate against the party relying on them in case of ambiguity ([16]).
Frequently asked questions
What does an IT outsourcing lawyer do?
An IT outsourcing lawyer drafts, reviews and negotiates cloud, hosting, offshoring, call centre and managed services agreements, and advises on the privacy, marketing, critical infrastructure and employment laws that sit on top of them. When a relationship fails, the same lawyer advises on suspension, withholding, termination and exit.
Who is responsible for personal information an outsourced provider holds?
Usually both. A customer holds personal information if it has possession or control of the record (Privacy Act section 6(1)), and it must take reasonable steps to protect it (APP 11.1). Overreliance on third party providers was one reason those steps were found lacking in the Australian Clinical Labs case ([52]).
Is storing data with an overseas cloud provider a disclosure?
Often, but not always. The Information Commissioner’s APP guidelines say that engaging an overseas contractor is a disclosure in most cases, but storage-only arrangements may be a use where a binding contract confines the provider and leaves the customer in effective control. Where it is a disclosure, APP 8.1 applies.
Can an Australian business be liable for an offshore provider's privacy breach?
Yes. Where APP 8.1 applies to the disclosure and the overseas recipient does something that would breach the APPs, the act is treated as a breach by the Australian entity (section 16C).
Do the unfair contract terms laws apply to outsourcing contracts?
Yes, where the contract is standard form and the customer is a consumer or a small business, meaning a party with fewer than 100 employees or turnover under $10,000,000 (ACL section 23(4)). Unfair terms are void, and proposing, applying or relying on them is a contravention (section 23(2A) and (2C)).
Are service credits enforceable?
Generally, if they are not out of all proportion to the interests they protect (Paciocco v ANZ, Kiefel J at [29]). Credits sized to the value of the service lost rarely raise the issue.
Can a provider suspend services over a disputed invoice?
If the contract allows it and the customer has not used the contract’s dispute process. In AIBI v Virtual Technology Services, a provider was entitled to suspend its helpdesk because disputed invoices were withheld without activating the dispute mechanism ([137] to [140]).
What happens to staff when their work is outsourced?
If the provider employs them within three months to do the same or substantially the same work, there is a transfer of business (Fair Work Act section 311), and their enterprise agreement or other transferable instrument can cover the provider for that work (section 313). Staff who are not taken on may be made redundant.
Must Centrelink be told if outsourcing leads to redundancies?
Yes, if the business decides to dismiss 15 or more employees for economic, technological, structural or similar reasons. Written notice must be given as soon as practicable after the decision and before any dismissal (Fair Work Act section 530).
Is a business liable if its call centre calls numbers on the Do Not Call Register?
Yes. A business that contracts with a call centre is taken to have caused the calls it makes (Do Not Call Register Act section 11(9)). In V Marketing the client admitted contravening section 11(1), although no penalty was imposed because it had acted reasonably ([34], [64], [80]).
What must a telemarketing contract say?
It must contain an express provision that the provider will comply with the Do Not Call Register Act and, where its employees or agents make calls, take all reasonable steps so that they comply. Entering into a telemarketing contract without that provision is itself a contravention (section 12(1)).
Who notifies a data breach when the provider and the customer both hold the data?
Either can. Where the breach is an eligible data breach of both, and one of them prepares the statement for the Commissioner and notifies individuals, those obligations do not apply to the other (Privacy Act section 26WM). The agreement should say which of them does it.
Does a foreign governing law clause remove the consumer guarantees?
No. The consumer guarantees apply despite a term that substitutes foreign law (ACL section 67), and the Full Federal Court rejected an argument that they did not apply because the contract’s proper law was foreign (Valve v ACCC at [103]).
Do I need an IT outsourcing lawyer?
For an arrangement the business depends on, yes. An IT outsourcing lawyer can settle data, staff, marketing and exit terms before they are tested, when the business still has leverage. A free 30-minute consultation will tell you where you stand.