Te tuku mā waho e whakahaere

Outsourcing business

Using this guidance

This guide explains your information and records management responsibilities when you outsource work. It is not a comprehensive guide to outsourcing. Before agreeing to an outsourcing contract or arrangement, seek legal and procurement advice.

Your responsibilities when outsourcing business

Outsourcing can cover many types of work, including core business activities. For example, your organisation may outsource a construction project or customer service operations.

Outsourcing does not remove your organisation's responsibility for the work. Your organisation remains responsible for ensuring the work is done properly.

You must also ensure the outsourced service provider creates and manages information and records of the outsourced business correctly. The Act does not cover private sector service providers or organisations. This means your outsourcing contract must include how the service provider will create and manage information and records.

Sometimes your organisation may outsource work to another public sector organisation. Even though the Act covers both organisations, it's important to clearly define who is responsible for managing information and records as part of these arrangements.

Risks of poor information and records management

Your organisation could be exposed to risks if your service provider does not correctly create or manage information and records of your outsourced business function or activity. These risks may include:

• failure to meet legal obligations — the administrative head of your organisation can be held accountable (section 17 of the Act)

• loss of, or incomplete information needed to make decisions, provide services or defend actions

• loss of public accountability and transparency.

Your outsourcing contract

The outsourcing contract is the formal agreement between your organisation and a service provider. When your organisation decides to outsource work, identify your information and records management requirements.

You should state your information and records management requirements in the:

• tender process, and

• contract itself.

Key recordkeeping responsibilities

Your organisation must ensure that:

• appropriate information and records of the outsourced functions or activities are created

• the information and records are stored and managed securely

• ownership of the information and records is clear and understood.

Your organisation must also ensure that the information and records:

• can be accessed by you when required

• are returned when the contract ends, and

• are disposed of lawfully.

See ‘Checklist: What to include in a contract’ at the end of this page.

Here are some important points to address in your contract.

Access and privacy

Contracts must clearly state who can access information and records and under what conditions. The contract should also address privacy, confidentiality and public access requirements.

Under the Act, your contract must state that your organisation has immediate access to all information and records held by the service provider.

This allows you to:

• monitor and check compliance with the contract

• meet other legal requirements.

Privacy

Some information and records may be confidential. This may be because they relate to individuals or are commercially valuable. This is particularly important when these are used, linked or analysed with other information or databases.

Outsource contracts should include measures to protect this information. Where appropriate, they should also refer to any relevant organisational policies.

Ensure your service provider is aware that they must meet the requirements of the:

• Privacy Act 2020, and

• Government Chief Privacy Officer.

Security and storage of information and records

You must consider information security in all your outsourcing contracts. This includes the use, transfer and storage of information and records.

The Act requires you to store and preserve information and records properly. Your organisation should address this in outsourcing contracts.

You must ensure service providers:

• store and manage information and records securely

• manage information and records through any migrations, system changes and upgrades

• protect information and records from loss or disasters

• transport and handle information and records safely and securely.

Disposal of information and records

Your organisation is responsible for ensuring information and records are disposed of according to the Act.

You must ensure service providers do not unlawfully dispose of any information and records during the outsourcing contract. This includes:

• unauthorised destruction

• transfer to a third party

• damage, alteration or loss.

The best way for your organisation to achieve this is to:

• understand the main methods for authorised disposal

• specify in the contract with your service provider which disposal processes they can and cannot use.

For long-term outsourcing contracts, you may want service providers to periodically:

• destroy information and records when authorised, or

• transfer information and records back to your organisation.

Disposal that is prohibited

Contracts exclude any disposal that:

• breaches the contract

• is fraudulent or corrupt

• hides wrongdoing

• is for any other improper purpose.

Returning information and records at the end of the contract

Some information and records documenting the outsourced business or activity will be essential for the ongoing conduct of that business.

If these aren't returned, it could seriously affect your organisation's business continuity and accountability. It would also breach the Act.

Your outsourcing contract should clearly state:

• which information and records must be returned

• when they must be returned

• the manner or format they must be returned in

• any restrictions on commercial use by the service provider (unless allowed in the contract)

• requirements to delete any copies after transfer.

Checklist: What to include in a contract

Make sure your contract includes statements about the following:

1. The information and records management requirements for the contracted business or activity. The service provider must create, manage, secure and store information and records according to the Act. They must also follow relevant standards, including the mandatory Information and Records Management Standard.

2. What information and records must be returned at the end of the contract or periodically. This should also include the format required.

3. What technical specifications are necessary so information and records can be exchanged between your organisation and the service provider.

4. Who owns the information and records, as well as the intellectual property.

5. The access rules and arrangements for information and records.

6. What basic information controls and metadata management the service provider must maintain so the information and records can be easily managed, accessed and retrieved.

7. The compliance of the service provider with your organisation's privacy requirements for information and records.

8. How the information and records must be classified or identified by the service provider.

9. What specific (lawful) disposal processes authorise the service provider to carry out for specified information and records.

10. What specified restrictions are on any use of information and records by the service provider for commercial or other purposes during the period of the contract.

11. What the processes are for any dispute resolution.

12. What the penalties are for breaches of contract, for example, if information and records aren't returned at the end of the contract.

13. How the service provider's compliance with these information and records requirements will be measured during and at the end of the contract.

We’ve removed the PDF for this page to keep information on this page up to date and easy to access.

You can easily print or save the page as a PDF using your browser’s print option. Press Ctrl (or Command) + P to preview. Another option is to click the 'Print page' link near the bottom of this page.

If you still need a separate PDF, we're happy to help. Email us at rkadvice@dia.govt.nz.