The first is that many Bermuda businesses outsource their operations from Bermuda, and that demand is growing.

Even with more than 25 years drafting, negotiating and advising businesses on their important IT service and outsourcing contracts (back office, cloud, SaaS and ERP solutions), it was not possible to anticipate the demand that has been generated in Bermuda for onshore outsourcing transactions.

Indeed, numerous business conditions in recent years have combined to motivate Bermuda businesses to outsource aspects of their operations to onshore service providers.

The second converging circumstance that directly affects outsourcing agreements is the global reality of increased cyber risk, and the impact that is having on all cross-border service agreements.

Since the very nature of onshore outsourcing requires the transmission of data and communications across jurisdictions, outsourcing transactions are in the bull’s eye of every enterprise’s cyber security risk management oversight.

Accordingly, the management of cyber security risk for critical outsourcing is now at the forefront of best corporate governance practices by both boards of directors and C-suite executives. That oversight must focus on the primary tool for all operational risk management associated with outsourcing transactions: the outsourcing contract where all the duties, performance obligations and security requirements of the service provider (including incident reporting) are stipulated.

In addition to the growing demands of good corporate governance and diligent business practices to manage cross-border outsourcing risk, the third converging circumstance is the growth of outsourcing regulatory oversight.

Regulators around the world are stepping up their supervision of both outsourcing transactions and the IT and cyber security risks that are inherent to cross-border arrangements.

Bermuda is no exception. For example, the Bermuda Monetary Authority, the island’s financial services regulator, has recently issued numerous compliance directives concerning activities related to outsourcing transactions and agreements, IT services and operational cyber risk management, and business continuity and disaster recovery.

Bermuda enterprises that are also regulated by onshore authorities, such as the US Securities and Exchange Commission, must also address those additional governance demands for both their outsourcing arrangements and their accompanying cyber risks.

Finally, let’s add to those converging circumstances Bermuda’s soon to be implemented Personal Information Protection Act 2016. It is expected that Pipa’s additional outsourcing and cross-border security prescriptions for the use and protection of personal information will be brought into full force later this year, and perhaps phased in on a sector-by-sector basis and with a compliance grace period. When Pipa is fully implemented, it will add a completely new layer of required outsourcing contract compliance terms and conditions.

Given all of those rapidly converging circumstances, it is highly likely that existing outsourcing agreements, and the precedents that were used to draft and negotiate those service contracts, are no longer consistent with the governance duties, management responsibilities and compliance obligations that are now converging in Bermuda.

Those convergent circumstances have combined to render existing or proposed outsourcing agreements drastically out of date and no longer responsive to the current and growing demands of governance best practice, accepted commercial norms and the laws and regulations that Bermuda enterprises must now (or must in the near future) comply with.

That is why it has never been more timely for all Bermuda enterprises to revisit (if not audit), assess and upgrade all of their existing commercial and affiliated company outsourcing service agreements to ensure that they fully comply, and are consistent, with the increasing demands of the governance, commercial, legal and regulatory convergence that I have described.

First Published In The Royal Gazette, Legally Speaking, March 2023

Twitter LinkedIn Email Save as PDF
More Publications
30 Nov 2023

Uncertainty Over Control Test in Sanctions Relating to Russia

Bermuda-based companies undertaking business with Russian entities must comply with the island’s s...

9 Nov 2023

Navigating AI Service Contracts

Organisations are increasingly using and relying on the many commercial advantages of artificial int...

26 Oct 2023

Lay Offs: A practical analysis of the legislation for employers

The choice to make lay offs is never an easy one. It is also an area of business where the commercia...

26 Oct 2023

Bermuda: Economic Substance – Trends in Compliance and Enforcement

This article provides a brief summary of the legislative framework concerning the regulation of the ...

25 Oct 2023

The Insolvency Review: Bermuda

The Insolvency Review offers an in-depth review of the most consequential features of the insolvency...

23 Oct 2023

Bermuda: Investors still wary of sidecars despite upbeat outlook for 2023 returns

Sidecar vehicles are expected to return on average 20%-30% in 2023, assuming no major loss event in ...

12 Oct 2023

Bermuda: Privacy and the Private Sector

Bermuda’s Personal Information Protection Act 2016, which comes into full force on January 1, 2025...

5 Oct 2023

Board Governance: Caring for your Bermuda Captive

If there is one topic that always comes up in major captive conferences, it’s the best way to mana...

2 Oct 2023

Expect a Busy Year-End for Cat Bonds and Sidecars

History has shown that in both soft and hard markets, the final quarter of the year is always busy, ...

29 Sep 2023

Directors’ knowledge and the duty to creditors

In the intricate realm of corporate governance and insolvency law, directors hold a position of imme...