Bermuda Companies with Outsourced Services Should Review Contracts

The first is that many Bermuda businesses outsource their operations from Bermuda, and that demand is growing.

Even with more than 25 years drafting, negotiating and advising businesses on their important IT service and outsourcing contracts (back office, cloud, SaaS and ERP solutions), it was not possible to anticipate the demand that has been generated in Bermuda for onshore outsourcing transactions.

Indeed, numerous business conditions in recent years have combined to motivate Bermuda businesses to outsource aspects of their operations to onshore service providers.

The second converging circumstance that directly affects outsourcing agreements is the global reality of increased cyber risk, and the impact that is having on all cross-border service agreements.

Since the very nature of onshore outsourcing requires the transmission of data and communications across jurisdictions, outsourcing transactions are in the bull’s eye of every enterprise’s cyber security risk management oversight.

Accordingly, the management of cyber security risk for critical outsourcing is now at the forefront of best corporate governance practices by both boards of directors and C-suite executives. That oversight must focus on the primary tool for all operational risk management associated with outsourcing transactions: the outsourcing contract where all the duties, performance obligations and security requirements of the service provider (including incident reporting) are stipulated.

In addition to the growing demands of good corporate governance and diligent business practices to manage cross-border outsourcing risk, the third converging circumstance is the growth of outsourcing regulatory oversight.

Regulators around the world are stepping up their supervision of both outsourcing transactions and the IT and cyber security risks that are inherent to cross-border arrangements.

Bermuda is no exception. For example, the Bermuda Monetary Authority, the island’s financial services regulator, has recently issued numerous compliance directives concerning activities related to outsourcing transactions and agreements, IT services and operational cyber risk management, and business continuity and disaster recovery.

Bermuda enterprises that are also regulated by onshore authorities, such as the US Securities and Exchange Commission, must also address those additional governance demands for both their outsourcing arrangements and their accompanying cyber risks.

Finally, let’s add to those converging circumstances Bermuda’s soon to be implemented Personal Information Protection Act 2016. It is expected that Pipa’s additional outsourcing and cross-border security prescriptions for the use and protection of personal information will be brought into full force later this year, and perhaps phased in on a sector-by-sector basis and with a compliance grace period. When Pipa is fully implemented, it will add a completely new layer of required outsourcing contract compliance terms and conditions.

Given all of those rapidly converging circumstances, it is highly likely that existing outsourcing agreements, and the precedents that were used to draft and negotiate those service contracts, are no longer consistent with the governance duties, management responsibilities and compliance obligations that are now converging in Bermuda.

Those convergent circumstances have combined to render existing or proposed outsourcing agreements drastically out of date and no longer responsive to the current and growing demands of governance best practice, accepted commercial norms and the laws and regulations that Bermuda enterprises must now (or must in the near future) comply with.

That is why it has never been more timely for all Bermuda enterprises to revisit (if not audit), assess and upgrade all of their existing commercial and affiliated company outsourcing service agreements to ensure that they fully comply, and are consistent, with the increasing demands of the governance, commercial, legal and regulatory convergence that I have described.

First Published In The Royal Gazette, Legally Speaking, March 2023