It depends on the service and the type of institution. Bangladesh Bank expects banks and financial institutions to manage outsourcing risk properly, and its guidance on ICT security and related matters covers areas such as due diligence, contracts, data protection, audit access and business continuity. Some arrangements, particularly those involving core systems, customer data or offshore processing, may require notification to or approval from the regulator. Requirements are updated from time to time, so we check the current circulars and guidance for the specific arrangement before signing and help prepare any submissions. Late approvals can delay go-live.

Service levels should measure outcomes that matter to the business, such as availability, response and resolution times, accuracy and user satisfaction, with clear definitions, measurement methods and reporting. Service credits should be large enough to change behaviour but are usually not the customer's only remedy, so the contract should say how credits relate to damages and termination rights. Persistent failures should trigger remediation plans and, ultimately, termination. We help both customers and providers set targets that are realistic for Bangladesh conditions, including power and connectivity risks, and avoid disputes about measurement. Credits should be simple to calculate.

Where a provider processes personal data for the customer, the contract must allocate controller and processor responsibilities clearly, require appropriate security, limit use of the data to the agreed purposes, and address subprocessors, audits, breach notification and deletion or return at the end. Cross-border transfers need particular care, and implementing rules and guidance under the Act will shape requirements in practice. We draft data processing terms for outsourcing contracts, review existing agreements for gaps and help customers build an inventory of providers handling personal data. Gaps are common in older contracts. We can review your existing provider contracts quickly.

It depends on how the transfer is structured. Employees may remain with the customer, transfer to the provider by agreement, or be released and rehired, and each route carries different obligations on notice, benefits, gratuity and consultation. Where a contractor supplies workers on the customer's premises, labour law can impose responsibilities on the principal employer, and the rules on contract labour have attracted attention and amendment in recent years. We review the workforce plan with HR and the provider early, because poorly handled transfers can lead to disputes, labour unrest and regulator complaints. Communication plans help reduce tension.

Exit should be planned at signing. A good contract includes an exit plan, obligations to provide transition assistance at agreed rates, return of data in usable formats, transfer or licensing of tools and documentation, and cooperation with the replacement provider. Termination rights should cover convenience, persistent failure, insolvency and change of control. When exit is approaching, we review the contract, identify leverage and deadlines, and manage the handover so that services continue. Where the contract is silent, we negotiate a separate exit agreement before notice is served, if possible. Early planning keeps leverage with the customer.

Yes, many IT, cloud and business process services are delivered cross-border. The customer must, however, consider data protection and any sector data location rules, foreign exchange requirements for paying the provider, VAT on imported services and withholding tax on payments to non-residents. Some regulated customers must keep certain data or systems in Bangladesh or obtain approval for offshore processing. Providers with a significant local presence may need to register a branch, liaison office or company. We structure the arrangement and payment flows so that outsourcing can operate lawfully on both sides. Tax treatment should be confirmed early.

Unless the contract says otherwise, the provider may own software, documentation, processes and tools it creates, even when the customer pays for them. Customers should secure ownership of, or a broad licence to, bespoke deliverables and their own data, and a licence to the provider's background tools for as long as needed, including after exit. Providers will want to protect their pre-existing materials and reuse general know-how. We draft intellectual property clauses that balance these interests and reflect the Copyright Act 2023 and the realities of the services being delivered. Source code escrow can help.

Liability caps should reflect the value and risk of the services, often set by reference to charges paid over a period, with separate or higher caps for data breaches, confidentiality and intellectual property infringement. Exclusions for indirect loss need careful drafting, because the most likely losses from a service failure, such as lost revenue or regulatory fines, may be treated as indirect. Insurance should support the caps. Unlimited liability is usually reserved for fraud, wilful misconduct and similar matters. We negotiate positions that customers can defend to boards and regulators and providers can insure. Insurance certificates should be checked annually.