Many outsourcing or offshoring arrangements involve the processing of large volumes of personal information about a company's customers or employees. This information may include sensitive information, such as financial data, medical data, payroll and benefits information, social security numbers and purchasing histories. Safeguards need to be put in place in the outsourcing contracts, and precautions need to be taken even before entering into the deal. As information privacy and security experts, we can help companies navigate the treacherous waters of outsourcing relationships.

Beyond saving money or shifting operations, companies must think about the protection of their personal information databases, intellectual property, and other valuable assets that are transferred or made available to the outsourcing company. Companies frequently underestimate the extra elements of risk introduced into outsourcing or offshoring by poor infrastructure, political instability and legal systems that do not offer protections similar to those in the United States or Western Europe.

Numerous countries that receive the lion share of outsourcing dollars -- and euros -- while aware of Western companies' privacy and security concerns, do not have data protection and privacy laws that provide a data protection regime consistent with that of the United States and Europe. Even though they may have laws that punish certain forms of corporate crimes, intellectual property and data protection lag behind the West. Further, even when there are laws, relying on the legal system of certain countries to protect a company's assets is often misguided. In many countries, legal systems are notoriously slow, enforcement authorities are overwhelmed by requests. There are many reports of corruption of judges and other enforcement agencies.

The success of an outsourcing relationship depends in great parts on the nature of companies’ relationship. Conducting adequate due diligence before entering into a contract, building frequent audit and reporting structures, supplementing the contract with specific policies and procedures to abide by will tremendously help set the tone, and organize the relationship.

We are experienced in the wide range of issues involved in outsourcing and offshoring, from structuring and negotiating contracts, to advising on risk management and compliance issues, to privacy and data protection regulations. We have handled all aspects of outsourcing, ITO, BPO, ASP and similar services agreements, representing vendors and users on how to structure outsourcing relationships, identify strategic objectives, and evaluate the benefits of specific transactions. We have negotiated numerous high stakes transactions from short term arrangements to long term high risk billion dollar outsourcing to or BPO transactions, in markets such as hardware manufacturing, financial services, benefits and HR services.

We can assist clients in performing due diligence before entering into the contract, installing proper safeguards around the use of the infrastructures, arranging for regular audits of processes and facilities, clarifying the numerous aspects of the services to be performed, and their effect on the protection of personal data, and keeping control over the relationship and over who will actually do the work. For example, we can:

• Help the company understand the impact of laws of the country from which the data originate and those of the country where the data will be processed
• Assist in performing due diligence about the vendor and the receiving countries’ legal systems
• Counsel on privacy, data protection and security risk management
• Structure and draft service-levels agreements, data use agreements, data transfer agreements
• Ensure that appropriate protections are built in the contracts to ensure appropriate data protection and security, including provisions related to confidentiality, appropriate use, data security, audit rights, insurance and remedies.
• Draft specific safeguards schedule in order to provide sufficient detail on the security expectations.
• Provide for ongoing vendor monitoring and management
• Develop a formal plan for responding to “worst case scenario” type events, such as misappropriation of personal data
• Structure procedures to safeguard the company's databases and IP assets upon termination of the relationship
• Advise on appropriate deal structures
• Draft and negotiate the definite agreements and subsidiary schedules