The first is that many Bermuda businesses outsource their operations from Bermuda, and that demand is growing.

Even with more than 25 years drafting, negotiating and advising businesses on their important IT service and outsourcing contracts (back office, cloud, SaaS and ERP solutions), it was not possible to anticipate the demand that has been generated in Bermuda for onshore outsourcing transactions.

Indeed, numerous business conditions in recent years have combined to motivate Bermuda businesses to outsource aspects of their operations to onshore service providers.

The second converging circumstance that directly affects outsourcing agreements is the global reality of increased cyber risk, and the impact that is having on all cross-border service agreements.

Since the very nature of onshore outsourcing requires the transmission of data and communications across jurisdictions, outsourcing transactions are in the bull’s eye of every enterprise’s cyber security risk management oversight.

Accordingly, the management of cyber security risk for critical outsourcing is now at the forefront of best corporate governance practices by both boards of directors and C-suite executives. That oversight must focus on the primary tool for all operational risk management associated with outsourcing transactions: the outsourcing contract where all the duties, performance obligations and security requirements of the service provider (including incident reporting) are stipulated.

In addition to the growing demands of good corporate governance and diligent business practices to manage cross-border outsourcing risk, the third converging circumstance is the growth of outsourcing regulatory oversight.

Regulators around the world are stepping up their supervision of both outsourcing transactions and the IT and cyber security risks that are inherent to cross-border arrangements.

Bermuda is no exception. For example, the Bermuda Monetary Authority, the island’s financial services regulator, has recently issued numerous compliance directives concerning activities related to outsourcing transactions and agreements, IT services and operational cyber risk management, and business continuity and disaster recovery.

Bermuda enterprises that are also regulated by onshore authorities, such as the US Securities and Exchange Commission, must also address those additional governance demands for both their outsourcing arrangements and their accompanying cyber risks.

Finally, let’s add to those converging circumstances Bermuda’s soon to be implemented Personal Information Protection Act 2016. It is expected that Pipa’s additional outsourcing and cross-border security prescriptions for the use and protection of personal information will be brought into full force later this year, and perhaps phased in on a sector-by-sector basis and with a compliance grace period. When Pipa is fully implemented, it will add a completely new layer of required outsourcing contract compliance terms and conditions.

Given all of those rapidly converging circumstances, it is highly likely that existing outsourcing agreements, and the precedents that were used to draft and negotiate those service contracts, are no longer consistent with the governance duties, management responsibilities and compliance obligations that are now converging in Bermuda.

Those convergent circumstances have combined to render existing or proposed outsourcing agreements drastically out of date and no longer responsive to the current and growing demands of governance best practice, accepted commercial norms and the laws and regulations that Bermuda enterprises must now (or must in the near future) comply with.

That is why it has never been more timely for all Bermuda enterprises to revisit (if not audit), assess and upgrade all of their existing commercial and affiliated company outsourcing service agreements to ensure that they fully comply, and are consistent, with the increasing demands of the governance, commercial, legal and regulatory convergence that I have described.

First Published In The Royal Gazette, Legally Speaking, March 2023

Twitter LinkedIn Email Save as PDF
More Publications
23 May 2024

Regulatory oversight is key for Bermuda’s insurance sector

Bermuda’s thriving insurance and reinsurance sector requires effective regulatory oversight if it ...

9 May 2024

It is all about the data

All successful enterprises have a voracious appetite for data. The advanced abilities of IT systems ...

3 May 2024

Best Practices for Conducting Investigations into Employee Grievances

Grievance procedures are very important, but often overlooked, procedures that all employers should ...

25 Apr 2024

Trusts, and how they came to be

What traces its history through Ancient Rome and the Crusades, can have many de facto owners, none a...

8 Apr 2024

Electronic dissemination of corporate communications by Hong Kong listed issuers from an offshore perspective

In June 2023, The Stock Exchange of Hong Kong Limited published consultation conclusions to its cons...

3 Apr 2024

Bermuda: Lack of New Players Is Supporting Strong Interest in ILS

All signs point to another very strong year for the catastrophe bond and related insurance-linked se...

2 Apr 2024

Choosing the right structure for your business in Bermuda

Anyone seeking to set up a business in Bermuda has a variety of options, depending on the nature of ...

25 Mar 2024

PIPA Compliance is Not Just a Domestic Affair

As organizations in Bermuda prepare for the full application of the Personal Information Protection ...

25 Mar 2024

How Bermuda trusts can help with worldwide estate planning

Trusts still have an important role to play in onshore tax planning, as acknowledged by the British ...

14 Mar 2024

Privacy Rights Extend Outside Bermuda

As Bermuda prepares for the full application of the Personal Information Protection Act 2016 on Janu...