The first is that many Bermuda businesses outsource their operations from Bermuda, and that demand is growing.

Even with more than 25 years drafting, negotiating and advising businesses on their important IT service and outsourcing contracts (back office, cloud, SaaS and ERP solutions), it was not possible to anticipate the demand that has been generated in Bermuda for onshore outsourcing transactions.

Indeed, numerous business conditions in recent years have combined to motivate Bermuda businesses to outsource aspects of their operations to onshore service providers.

The second converging circumstance that directly affects outsourcing agreements is the global reality of increased cyber risk, and the impact that is having on all cross-border service agreements.

Since the very nature of onshore outsourcing requires the transmission of data and communications across jurisdictions, outsourcing transactions are in the bull’s eye of every enterprise’s cyber security risk management oversight.

Accordingly, the management of cyber security risk for critical outsourcing is now at the forefront of best corporate governance practices by both boards of directors and C-suite executives. That oversight must focus on the primary tool for all operational risk management associated with outsourcing transactions: the outsourcing contract where all the duties, performance obligations and security requirements of the service provider (including incident reporting) are stipulated.

In addition to the growing demands of good corporate governance and diligent business practices to manage cross-border outsourcing risk, the third converging circumstance is the growth of outsourcing regulatory oversight.

Regulators around the world are stepping up their supervision of both outsourcing transactions and the IT and cyber security risks that are inherent to cross-border arrangements.

Bermuda is no exception. For example, the Bermuda Monetary Authority, the island’s financial services regulator, has recently issued numerous compliance directives concerning activities related to outsourcing transactions and agreements, IT services and operational cyber risk management, and business continuity and disaster recovery.

Bermuda enterprises that are also regulated by onshore authorities, such as the US Securities and Exchange Commission, must also address those additional governance demands for both their outsourcing arrangements and their accompanying cyber risks.

Finally, let’s add to those converging circumstances Bermuda’s soon to be implemented Personal Information Protection Act 2016. It is expected that Pipa’s additional outsourcing and cross-border security prescriptions for the use and protection of personal information will be brought into full force later this year, and perhaps phased in on a sector-by-sector basis and with a compliance grace period. When Pipa is fully implemented, it will add a completely new layer of required outsourcing contract compliance terms and conditions.

Given all of those rapidly converging circumstances, it is highly likely that existing outsourcing agreements, and the precedents that were used to draft and negotiate those service contracts, are no longer consistent with the governance duties, management responsibilities and compliance obligations that are now converging in Bermuda.

Those convergent circumstances have combined to render existing or proposed outsourcing agreements drastically out of date and no longer responsive to the current and growing demands of governance best practice, accepted commercial norms and the laws and regulations that Bermuda enterprises must now (or must in the near future) comply with.

That is why it has never been more timely for all Bermuda enterprises to revisit (if not audit), assess and upgrade all of their existing commercial and affiliated company outsourcing service agreements to ensure that they fully comply, and are consistent, with the increasing demands of the governance, commercial, legal and regulatory convergence that I have described.

First Published In The Royal Gazette, Legally Speaking, March 2023

Twitter LinkedIn Email Save as PDF
More Publications
23 Mar 2023

Digital Assets in Bermuda – Unpacking the Proportionality Principle

A digital asset business wishing to obtain a licence under the Digital Asset Business Act 2018 will ...

Contributors: Karim Creary
27 Feb 2023

Bermuda Businesses: Are You Ready to Comply with Our New Privacy Rules?

There have been recent indications from the Bermuda Government that Bermuda’s Personal Information...

24 Feb 2023

Home Transfers Within a Family Still Incur Taxes in Bermuda

Any home sale or transfer either by a live person or by inheritance typically attracts stamp duty.

20 Feb 2023

Bermuda: An Introduction to Dispute Resolution

This edition discusses Current Economic Conditions. 

Contributors: Khiyara Krige, James Batten
8 Feb 2023

Bermuda's Personal Information Protection Act - Are You Ready?

There have been recent indications from the Bermuda Government that Bermuda’s Personal Information...

1 Feb 2023

Starting a captive in Bermuda? What you need to know.

Bermuda has seen a steady increase in new captives being formed as well as new structures, risks and...

1 Feb 2023

Fund Finance Laws and Regulations 2023 – Bermuda

Bermuda is a major centre in the international offshore investment fund industry, with more than USD...

Contributors: Arielle DeSilva
25 Jan 2023

Chambers Insurance & Reinsurance Guide 2023: Bermuda

This guide provides the latest information on sources of insurance and reinsurance law, overseas-bas...

23 Jan 2023

Sponsored Dependants; How and Where Can They Work?

If a person arrives on the island under a work permit with their spouse or partner who is a sponsore...

19 Jan 2023

Applications expected under the Investment Business Act

Persons who must comply with the requirements of the amended Investment Business Act 2003 should con...