What belongs in an IT support contract?
Scope of services, response times, data processing, liability and the end of the contract: which points an IT support contract should settle and which questions to ask before you sign.
An IT support contract has to answer three questions above all: What is included? What happens when something fails? And how does the working relationship end? Here I set out which points should be settled before you sign and how to recognise vague wording. This is general guidance, not legal advice.
What an IT support contract consists of
It can be a single document or a package of several. What matters is that all the parts are there and fit together.
- Framework agreementcontracting parties, fees, term, liability, termination
- Service descriptionsystems supported, regular tasks, exclusions
- Service level agreement (SLA)service hours, priorities, response times
- Data processing agreement (DPA)handling of personal data under Art. 28 GDPRusually required
- Confidentialitytrade secrets and, where necessary, professional secrecy
With me, the contract package consists of a services agreement, a DPA and a confidentiality agreement.
Scope of services: what exactly is supported
“Support for your entire IT” sounds comprehensive, but is of little help in a dispute. A useful service description answers these questions:
- Systems: Which workstations, servers, network devices, cloud services and line-of-business applications are covered?
- Regular tasks: Are updates, monitoring, checking the backup and documentation mentioned?
- Exclusions: What counts as a project and is commissioned separately, such as a server replacement or a new site?
- Billing: How is work outside the scope charged, in what time increments and with whose approval?
- Changes: What happens when workstations or systems are added or removed?
- Your part: Who is the contact person at your company, and who may approve changes and costs?
With me, support includes monitoring, updates and patches, support by phone and remote access, licence management, IT documentation and the management of users and devices. In some cases an on-site slot per week, including travel, is agreed as well. It is built into the flat fee and not shown separately.
Charged separately are projects such as a server move or migration, hardware and the licences themselves. Depending on the client, I bill by time spent or as a mix of flat fee and time spent.
Which billing model suits you and how to compare offers is something I describe in the article What does IT support cost?
Response time, service hours and priorities
When something fails, unclear terms quickly lead to false expectations. The comparison shows what matters:
“Fast response to faults.”
For each priority it is set out by when the first qualified response will come and how the time is measured.
“Always there for you.”
The days and times are fixed, as is what applies outside those hours and what it costs.
“Urgent cases take precedence.”
It is described what counts as urgent, for example an outage affecting the whole company, and who makes that call.
Also check which reporting channel starts the clock: phone, email or ticket. By response time I mean the time until the first qualified response. I commit to this response time, but not to a resolution time, because how long a fix takes often depends on manufacturers and third parties. In my view, small companies do not automatically need expensive service levels. What matters is which response times their operations actually require. Anyone offering a fixed resolution time should explain what it applies to and what happens if it is not met. I can be reached Monday to Friday from 8 am to 6 pm.
Ask every provider, too, who takes over during holidays or illness.
Data protection, confidentiality and security
An IT provider can usually access mailboxes, files and user accounts. That is why an IT support contract usually comes with a data processing agreement under Art. 28 GDPR. Among other things, it provides that the provider processes data only on your instructions and engages subcontractors only with your specific or general authorisation. At the end of the working relationship, the provider must delete or return the data, as you choose, unless a statutory retention duty applies.
Beyond that, the contract should settle these points:
- Access: Through which accounts does the provider gain access, and how are they secured?
- Backup: Who checks it, how often is a restore tested, and how do you learn the result?
- Security incidents: Who informs whom, and what has to be done until then?
- Documentation: Is it kept up to date, and can you access it yourself at any time?
For some companies, special obligations apply as well. In Germany, professionals bound by statutory secrecy must ensure that the service providers who assist them are bound to confidentiality under section 203 of the German Criminal Code (StGB); there is more on this in the article IT for medical practices. If your company falls under NIS2, supply chain security is also among your duties, and your IT provider is part of that chain.
Liability, term and price changes in an IT support contract
These clauses are often far towards the back and easily skimmed over. Yet they decide what applies in a dispute and how free you are later on.
- Liability: Limits are common, but liability for one’s own intent cannot be excluded in advance. If limits appear in pre-formulated terms, they can be invalid even between businesses. Check whether the cap matches what a longer outage would cost you.
- Insurance: Ask whether the provider has suitable liability insurance. I have IT liability insurance myself.
- Term: Clarify the minimum term, automatic renewal, notice period and the form notice must take. With me, a term of 12 months is usual. The right to terminate for good cause remains unaffected. If the cause is a breach of duty, a deadline to remedy it or a formal warning is usually required first.
- Price changes: When may the price rise, how is that announced, and can you terminate in that case?
- Contracts through the provider: Licences and cloud services often have their own terms set by the manufacturer. Ask for these to be listed separately.
Settling the end of the contract from the start
Nobody likes talking about the end when signing a contract. Later on it is usually too late. So set out now what the provider hands over at the end, and at what cost.
- Noticeperiod and form are observed
- Documentationthe current version is handed over
- Accessyou test the sign-in yourself
- Cooperationsupport for the successor, effort agreed
- Close-outaccess revoked, data deleted or returned
In takeovers I have seen these shortcomings: admin access held only by the provider, documentation missing or out of date, and an agreed backup that was never checked. Each of these points can be settled in the contract.
With my clients, the rule is: documentation and access belong to the client, not to me. Ask other providers to confirm this in writing too. Depending on the case, I bill the handover at the end of the contract by time spent. How to prepare a change once it is under way is covered in the article How to change IT provider.
Five questions before you sign
- Could you tell from the contract whether a particular piece of work is included or costs extra?
- Do you know when to expect the first response in an outage, and whom you will reach?
- Is the data processing agreement available, and are the subcontractors named?
- Do you know the next opportunity to terminate and the deadline for it?
- On the last day of the contract, could you get to all systems, data and documents yourself?
If an answer remains open, ask before you sign. With high risks or unusual clauses, it is best to have the contract reviewed by a lawyer.
Frequently asked questions
Is an IT support contract a contract for services or a contract for work?
That depends on the content, not the heading. Under German law, a contract for services (Dienstvertrag) owes the activity, a contract for work (Werkvertrag) a specific result. Ongoing support often has the features of a contract for services, while a clearly defined job such as a setup can be a contract for work. A contract often contains both. In an individual case, only a lawyer can classify it with binding effect.
Does an IT support contract have to be in writing?
In general, the law does not prescribe a particular form for it. Put it in writing anyway, otherwise it will be hard to prove later what was agreed. The data processing agreement must be in writing, and an electronic format is sufficient.
What is the difference between response time and resolution time?
The response time runs until the first qualified response to your report. The resolution time runs until the fault is fixed. So a contract that only mentions “response” does not yet say when the problem will be solved.
Sources
- Contract for services and contract for work: Section 611 of the German Civil Code (BGB), Section 631 BGB (in German)
- Liability for intent: Section 276 BGB (in German)
- Pre-formulated terms between businesses: Section 307 BGB, Section 310 BGB (in German)
- Termination for good cause: Section 314 BGB (in German)
- Data processing: General Data Protection Regulation, Art. 28
- Professional secrecy and assisting persons: Section 203 of the German Criminal Code (StGB) (in German)
When your IT provider leaves: what access and documents do you need?
Your IT provider is stopping or being replaced? This checklist shows which access and documents you need and what to secure first: admin accounts, domains, licences, firewall and backups.
Read article→
IT for a new company: preparing workstations, Microsoft 365 and telephony
What a new company's IT needs on the first working day, what can wait, which early decisions become expensive later and what to budget for laptops, licences and a domain.
Read article→
Reinforcing in-house IT: support for projects and ongoing work
When in-house IT needs external reinforcement, how I share the work with the team, and why responsibilities and access rights have to be settled from the start.
Read article→