IT outsourcing agreement: data security, ownership of the code, breach and termination

Service page: Commercial contracts lawyer: drafting, review and enforcement.

IT outsourcing is the transfer of technology tasks to an outside supplier: software development, systems operation, hosting, security or support. This guide explains which statutory provisions apply to such an agreement, and what is worth setting in it so that you do not have to fill in the gaps in court. When the agreement is mainly a cloud service for a periodic payment, see also SaaS agreements: what to check before you sign.

Is there a special law for IT outsourcing contracts?

No. The content of a contract can be whatever the parties agreed (section 24 of the Contracts (General Part) Law, 5733-1973), and it can be made orally, in writing or in another form, unless a particular form is a condition of its validity under a law or under an agreement between the parties (section 23). The practical questions, such as the service level, timetables, price and exit terms, are set in the contract. The law comes in at several points:

• Good faith: in negotiations toward a contract, the parties must act in an acceptable manner and in good faith (section 12(a)), and the same applies to performing the contract and exercising a right under it (section 39).
• A defect in the work: a contract to do work or to provide a service for payment, where the contractor is not an employee of the customer, is a contract for work (section 1 of the Contract for Work Law, 5734-1974 (חוק חוזה קבלנות, התשל״ד-1974)), and an agreement in which an outside supplier develops or operates systems for payment fits the definition. If the contract has no other provision, the customer gives notice of a defect within a reasonable time and gives a proper opportunity to fix it; if it was not fixed within a reasonable time, the customer may fix it and claim reasonable expenses, or deduct from the payment the amount by which the value of the service decreased (sections 3, 4 and 8(a)).
• Personal information: when the supplier accesses a database, the Protection of Privacy Law and the data security regulations apply.
• Intellectual property: ownership of the code the supplier develops is decided under the Copyright Act.
• Breach: the remedies are set in the Contracts (Remedies for Breach of Contract) Law, 5731-1970.

The supplier accesses personal information: what do the data security regulations require?

The Protection of Privacy Law, 5741-1981 defines a “holder” of a database as a party external to the controller of the database who processes information for it, and “processing” includes, among other things, storage, viewing and giving access (section 3). A supplier that stores personal information of the client’s customers or employees for the client, or accesses it in order to maintain a system, may fit the definition. The controller of the database and the holder are each responsible for the data security of the information in the database (section 17(a)).

Regulation 15 of the Protection of Privacy Regulations (Data Security), 5777-2017, deals with outsourcing. A database owner that engages an outside party to receive a service that involves giving access to the database:

1. examines, before the engagement, the data security risks it involves (regulation 15(a)(1));
2. sets expressly in the agreement, taking the risks into account: the information the supplier may process and the permitted purposes of use; the database systems it may access; the type of processing permitted; the duration of the engagement, the way the information is returned at its end, its destruction by the supplier and reporting on this; the way the data security duties are implemented; the supplier’s duty to have its authorized users sign an undertaking of confidentiality and of using the information only according to the agreement; where the supplier may provide the service through another party, its duty to include all these subjects in its agreement with that party; and the supplier’s duty to report at least once a year on carrying out its duties, and to give notice of a security incident (regulation 15(a)(2)(a)–(h));
3. also sets out in the database’s security procedure the subjects in sub-paragraphs (a) to (e), and refers in it expressly to the agreement and to the supplier’s security procedure (regulation 15(a)(3));
4. takes measures to control and supervise the supplier’s compliance with the agreement and the regulations, to the extent required in light of the risks (regulation 15(a)(4)).

Three comments. First, the regulation does not apply to an engagement of a database owner with an individual (regulation 15(c)), and it is not among the regulations that apply to a “database managed by an individual” as defined in regulation 1 (regulation 21(4)). Second, an organization that has several databases at the same security level may fulfill the agreement duty in one agreement (regulation 15(b)). Third, the regulations were made in 2017 and use the term “database owner”, while the Law as worded today speaks of the “controller of a database” (section 3).

And another duty that applies to the supplier’s own people: a person who received personal information by virtue of their position as an employee, a manager or a holder of a database must not disclose it, except for the purpose of doing their work, for carrying out the Law, or under a court order in connection with a legal proceeding (section 16). A supplier operating outside Israel also raises the question of transferring information outside the country’s borders: see transferring data abroad: duties and restrictions. On the duties after a leak, see a customer data leak from the company: what the law requires, and what the exposure is in practice.

Who owns the code the supplier developed for you?

A computer program is a “literary work” for the purposes of the Copyright Act, 5768-2007 (section 1). Three rules decide who the first owner is:

• the author of a work is the first owner of the copyright in it (section 33(1));
• an employer is the first owner of a work that its employee created for the purpose of their work and in the course of it, unless agreed otherwise (section 34);
• in a work created on commission, the first owner is the author, unless agreed otherwise between the commissioning party and the author, expressly or by implication (section 35(a)).

What this means: the Copyright Act does not transfer ownership of the code to the commissioning party just because it paid for the development. If you want ownership, you need to set it. Copyright can be transferred by contract, and the owner of the right may grant an exclusive or a non-exclusive license for it (section 37(a)); the right can be transferred, or a license granted, for all or part of it, and limited to a particular place, period or act (section 37(b)); and a contract to transfer copyright or to grant an exclusive license for it requires a written document (section 37(c)). The author of a computer program has no moral right under the Act (section 45(a)).

In the agreement itself, it is worth distinguishing between code the supplier develops specially for you and components it had before or uses for other clients, and setting for each of them ownership or a license, delivery of the source code and documentation, and the use of open-source components. See also open source: legal aspects and compliance requirements.

The supplier does not meet its obligations: what remedies does the law give?

When a contract is breached, the injured party is entitled to claim its enforcement or to rescind it, and is entitled to damages in addition to either of these or instead of them (section 2 of the Contracts (Remedies) Law). Some rules that are especially important in IT agreements:

• Enforcement: the injured party is entitled to enforcement of the contract, unless, among other things, enforcement means compelling someone to do or accept personal work or a personal service, carrying out the order requires an unreasonable degree of supervision, or enforcement is unjust in the circumstances (section 3).
• Rescission: in a fundamental breach, the injured party is entitled to rescind the contract (section 7(a)). A “fundamental breach” is a breach where a reasonable person would not have entered into the contract had they foreseen it and its results, or a breach that the contract states will be regarded as fundamental; and a sweeping clause that makes breaches fundamental without distinguishing between them has no effect, unless it was reasonable when the contract was made (section 6). In a non-fundamental breach, you rescind after you give the party in breach extra time to perform and the contract is not performed within a reasonable time after that, unless rescission is unjust in the circumstances (section 7(b)). When the contract can be divided into parts and one of its parts was breached, only the breached part is rescinded, unless the breach was also a fundamental breach of the whole contract (section 7(c)). Rescission is made by notice to the party in breach within a reasonable time (section 8).
• Damages: for the damage that the party in breach foresaw, or should have foreseen, when the contract was made, as a probable result of the breach (section 10). There is no compensation for damage that the injured party could have prevented or reduced by reasonable means (section 14(a)).
• Liquidated damages: damages that the parties agreed on in advance are paid without proof of damage, but the court may reduce them if they were set without any reasonable relation to the damage that could have been foreseen (section 15(a)). Agreeing on them does not, in itself, take away the right to claim damages under sections 10 to 14 instead (section 15(b)).

Credits under an SLA, for example for low availability, are a contractual arrangement. So it is worth stating expressly whether they are the only remedy for failing to meet the service level or an additional remedy, and how they fit with the limitation of liability. See liquidated damages clauses: validity and enforcement and limitation of liability in a contract: what works, what does not, and how not to get it wrong.

The agreement ends: what happens to the data and the code?

When the supplier accesses a database of personal information, the agreement must set the duration of the engagement, the way the information is returned to the owner at its end, its destruction from the supplier’s possession, and reporting on this (regulation 15(a)(2)(d)). The regulation does not set a format, timetables or a duty to deliver source code, so these are set in the contract: what is delivered at the end (data, source code, documentation, permissions), in what format and within how long, and what the duty to cooperate with a replacement supplier is.

If the contract was rescinded because of a breach, the party in breach returns to the injured party what it received under the contract, and the injured party returns to the party in breach what it received, or each pays the value when restitution is impossible or unreasonable, or when the injured party chose this (section 9(a) of the Contracts (Remedies) Law). Ending the contract by notice, without a breach, is done according to what the contract sets, and in an acceptable manner and in good faith (section 39 of the Contracts (General Part) Law). On rescission of a contract in general, see rescission of a contract: when it is allowed and how to do it properly.

What does the law set, subject by subject?

What to check before you sign

In a contract made or renewed after Amendment No. 3 to the Contracts (General Part) Law, published on 7 January 2026, came into force, a new version of section 25(a) applies (section 2 of the amending Law). The parties may agree on how the contract will be interpreted and on the evidence that will be admissible to interpret it (section 25(a)(1)); a business contract that does not set provisions on how it is to be interpreted is interpreted according to its wording alone, unless the wording alone leads to an unreasonable result or to a contradiction between its provisions (section 25(a)(2)); a standard-form contract, even if it states otherwise, is interpreted according to the intention of the parties (section 25(a)(4)); and parties who were not represented by a lawyer in drafting the contract are regarded as not having agreed on how it will be interpreted (section 25(a)(5)(a)). Where a contract is open to different interpretations, and one of the parties had the upper hand in shaping its terms, an interpretation against that party is preferred to one in its favor (section 25(b1)), and an agreement that contradicts this rule has no effect (section 25(a)(5)(b)). See interpreting contracts: the rules the court applies.

Checklist:

• Definition of the service, SLA metrics, how they are measured and reported, and what happens when the target is not met.
• When there is access to personal information: all the subjects in regulation 15(a)(2), and an audit right that makes it possible to comply with regulation 15(a)(4).
• Ownership of and a license in the code, in a written document (section 37(c) of the Copyright Act), and delivery of source code and documentation.
• Which breaches will be regarded as fundamental, in a focused list and not in a sweeping clause (section 6 of the Contracts (Remedies) Law).
• Liquidated damages in reasonable relation to the expected damage (section 15(a)), and how they relate to SLA credits and to the limitation of liability.
• Subcontractors: whether they are allowed and on what terms, and for personal information also regulation 15(a)(2)(g).
• Termination and exit: advance notice, a transition period, return of data, destruction and reporting.
• A supplier abroad: the governing law and the place of jurisdiction or arbitration. See international contracts: governing law, jurisdiction, the CISG and what must be in writing and commercial arbitration: procedure, advantages and disadvantages.

On reviewing and drafting agreements with suppliers, see the commercial contracts page.

Do you want to check your case? Arrange a first call to look at your case.

Frequently asked questions

Our supplier accesses the customer database. What must the agreement say?

When regulation 15 of the Protection of Privacy Regulations (Data Security) applies, the agreement includes, among other things (regulation 15(a)(2)): the information the supplier may process and the purposes of use; the systems it may access; the type of processing; the duration of the engagement, the return of the information and its destruction at the end; how the security duties are implemented; having its authorized users sign a confidentiality undertaking; conditions for another party; and an annual report and notice of a security incident. Before the engagement, the risks are examined (regulation 15(a)(1)). The regulation does not apply to an engagement with an individual (regulation 15(c)).

We paid for the software development. Is it ours?

Not necessarily. In a work created on commission, the first owner of the copyright is the author, unless agreed otherwise between the commissioning party and the author, expressly or by implication (section 35(a) of the Copyright Act), and a computer program is a literary work (section 1). A contract to transfer copyright or to grant an exclusive license for it requires a written document (section 37(c)).

The supplier doesn’t meet the SLA. Can we cancel the contract?

It depends on whether the breach is fundamental. In a fundamental breach the injured party is entitled to rescind (section 7(a) of the Contracts (Remedies) Law), and in a non-fundamental breach only after extra time to perform that was not used within a reasonable time, unless rescission is unjust (section 7(b)). A fundamental breach is, among other things, a breach that the contract states will be regarded as fundamental (section 6). Rescission is made by notice to the party in breach within a reasonable time (section 8).

Is a liquidated damages clause for delay or downtime valid?

Liquidated damages are paid without proof of damage, but the court may reduce them if they were set without any reasonable relation to the damage that could have been foreseen, when the contract was made, as a probable result of the breach (section 15(a) of the Contracts (Remedies) Law). Agreeing on them does not, in itself, take away the right to claim damages according to the damage instead (section 15(b)).

The supplier wants to use a subcontractor. What about the personal data?

If the database owner allowed the supplier to provide the service through another party, the supplier must include in its agreement with that party all the subjects that regulation 15 lists (regulation 15(a)(2)(g) of the Protection of Privacy Regulations (Data Security)). In the agreement with the supplier, it is worth setting whether it may use subcontractors, and on what terms.