5,0/5 Google · 167 reviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.Period: October 2016 to date · As of: 28 October 2026
Review IT outsourcing contracts
Outsourcing with clear boundaries
Are IT functions or operational responsibility to move to a provider? We check whether the service cut, governance, transition, subcontractors, security, reporting and exit fit your operating model.
Please enter a short description first.
Initial contact is free of charge. Before any costs arise, we will expressly point this out to you.
Response within 24 hours on working days
As of: 23 October 2026
Outsourcing contract2 of 5
- Service cutPresent
- Governance and reportingCheck
- Subcontractors and accessCheck
- Transition and exitPresent
- Provider consentProvider decidesMissing
Point of review: Who is responsible for which function?
- 1Send contract setContract and model
- 2Prioritise pointsScope to exit
- 3DecideSign-off or switch
Schematic illustration. Simplified example.
We review outsourcing arrangements for
- IT operations
- Data centres
- Managed services
- Service desks
- Groups
Key points at a glance
- A framework agreement that sounds clean is not enough for IT outsourcing.
- Service cut, governance, transition, subcontractors, security, reporting and exit must fit the actual operating model.
- ITMR reviews and negotiates IT outsourcing contracts before sign-off, transition, renegotiation and provider change.
- Whether the provider accepts changes is its own decision.
- Your contact is Jean Paul Bohne and his team. He is a specialist lawyer for IT law and for copyright and media law. Response on working days within 24 hours.
- SLA
- Service level agreement. It sets out availability, response times and customer service.
- AVV
- Data processing agreement under Art. 28 GDPR. It governs how a service provider processes data on your behalf.
- DSGVO
- The EU General Data Protection Regulation (GDPR). It governs how companies may process personal data.
Starting position
When does the outsourcing contract become critical?
When the model is operationally in place but the contract does not yet reflect it.
An outsourcing contract is robust when start, operation and exit are governed.
The framework agreement is on the table. Scope, governance and boundaries of responsibility are not yet ready for sign-off.
The transition is governed too loosely. Takeover, knowledge build-up, interfaces and start of operations are open.
The provider works with subcontractors, remote access or teams abroad. Control and responsibility are unclear.
A provider change or insourcing should remain possible. Exit services, data access and knowledge transfer are missing.
- For whom
- Procurement, IT, security, management
- Trigger
- Sign-off, transition, exit
- Core
- Scope, governance, exit
- Consent
- by the provider
The price and service structure also shifts during operation. Base services, additional call-offs, change requests and price adjustments must reflect the real model.
If ongoing maintenance and service obligations without larger-scale outsourcing are the focus, the maintenance contract and SLA page is a better fit. If data access shapes the case, having your DPA reviewed leads more directly to the goal.
Send the contract and operating model using the form. We will get back to you on working days within 24 hours.
Process
How do we review your outsourcing contract?
In three steps from contract set to a clear line.
01
Send contract set The framework agreement, service description, SLA, transition plan, price sheet, security annex, DPA or exit provisions are enough.
02
Prioritise points We reduce scope, governance, subcontractors, service levels, security, reporting, transition, liability and exit to the essentials.
03
Decide You go into sign-off, negotiation, readjustment, provider change or insourcing with clear redlines.
Four review questions for your outsourcing contract
- 1
What is being outsourced? Scope, service cut, responsibilities, cooperation, interfaces and excluded services must be governed specifically.
- 2
Does governance work? Steering committees, reports, decision paths, approvals, escalations and change processes must work together.
- 3
Is the provider chain governed? Many risks lie in subcontractor chains, remote access, role models, security requirements and audit rights.
- 4
What applies to transition and exit? Insourcing, provider change, access to data and documentation, knowledge transfer and orderly termination belong in the contract.
How long does it take? We complete most work steps within a few working days. How quickly it goes depends on the scope and your feedback. Do you have a fixed date, such as a launch? Tell us right away in your enquiry and we will plan for it.
Service
What does the review include?
Service package: IT outsourcing contract
Before sign-off Sharpen scope, governance, transition, subcontractors, security, SLA, pricing structure and exit.
Before transition Review takeover, knowledge build-up, parallel operation and start of operations.
In the running model Put governance, escalation, reports, additional services and deviations in order.
Before exit or insourcing Govern exit services, data access, knowledge transfer and provider change.
- For whom
- Customers and providers of IT outsourcing
- First response
- within 24 hours on working days
- Costs
- We tell you the costs transparently before you instruct us.
- Not included
- Technical transition planning. IT consultants handle this separately.
Who delivers what and who decides
- Framework agreement and service description
- SLA and transition plan
- Price sheet and security annex
- DPA and reports, if available
- Review of the contract set
- Redlines and priorities
- Negotiation with the provider
- Line for transition and exit
- You decide on the line and residual risks
- The provider decides on changes
How does the engagement work?
- 1
First assessment You send the contract and operating model using the form. We assess which scope fits. The first contact is free of charge.
- 2
Offer Before we start, we tell you the scope and costs transparently.
- 3
Court steps separately We agree court proceedings and representation separately.
Review focus
What do we review in the outsourcing contract?
Four fields that make the difference in practice.
| Review area | Typical provisions | What we look for |
|---|---|---|
| Scope and responsibility | Outsourced functions, service areas, cooperation duties | Clear boundaries and handling of changes and special call-offs |
| Governance and SLA | Steering committees, reporting duties, service levels | Measurability, escalation and consequences of deviations |
| Subcontractors and security | Multi-tier provider chains, remote access, permissions | Audit rights and interlocking with data protection |
| Transition and exit | Takeover, parallel operation, exit services, termination | Data access, documentation and knowledge transfer |
Misconceptions
Which assumptions are misleading?
Four sentences we often hear about outsourcing.
We see outsourcing fail more often on scope, governance, subcontractors, security or exit than on response times.
Without rules on knowledge transfer, access and tests, you negotiate the most critical phase under time pressure.
Multi-tier chains change control, security, data protection and verifiability.
Anyone who does not govern insourcing and data access early negotiates the exit from the weaker position.
Under pressure
What to do when transition or exit are pressing?
Then a robust operations and handover trail counts.
We put the framework agreement, SLA, governance documents, transition plan, security annex, DPA and reports into a reviewable order.
We clarify whether the problem lies in scope, governance, subcontractor chains, security or exit.
Depending on the situation, sharpened governance, an additional annex, a transition restart, an exit plan or an orderly switch fits.
Procurement, IT, security and management continue working along the same line.
Legal framework
Which rules apply to IT outsourcing?
Depending on the services owed, an outsourcing contract is classified as a contract for services under Section 611 BGB, a contract for work under Section 631 BGB or a mixed form.
Pre-formulated terms of the provider are subject to content review under Sections 307 and 310 BGB, even between businesses.
If the provider processes personal data on behalf, an agreement under Art. 28 GDPR is required. Sub-processors may only be used with authorisation.
For financial entities, Art. 30 DORA sets out mandatory content for contracts with ICT third-party service providers.
- Section 611 BGB Contract for services.
- Section 631 BGB Contract for work.
- Section 307 BGB Review of content.
- Art. 28 GDPR Processor.
- Art. 30 DORA Key contractual provisions.
Limits
What does the review not cover?
Clear limits protect your planning.
- 1
No transition planning IT consultants handle technical planning and steering separately.
- 2
No promise of outcome Whether the provider accepts changes is its own decision.
- 3
No supervisory review Whether a supervisory authority objects to the outsourcing is the authority's decision.
- 4
The decision remains yours Which line you choose is your decision.
What you can expect as a result
- A prioritised list of redlines.
- Clarity on scope, governance and exit.
- A line for negotiation, transition or switch.
Your contact
Lawyer and mediator · Partner · Specialist lawyer for IT law · Specialist lawyer for copyright and media law
View profile Düsseldorf, Schirmerstraße 80 · Hamburg, Palmaille 124
TOP lawyer 2027 · Business lawyers · Intellectual property
F.A.Z.-Institut and QuantiQuest. Based on recommendations from peers and assessments by in-house counsel. Source (opens in a new tab)
ReviewsWe do not check reviews of us on other platforms that we do not quote verbatim for authenticity. They may therefore also come from people who are not our clients. The rules of the respective platform apply. Reviews that we quote verbatim on our website, by contrast, have been checked for authenticity within the meaning of Section 5b(3) UWG (German Act against Unfair Competition): we compared the reviewers’ names with our client register. We also asked the respective platform to check the reviews for authenticity.
What clients say
5,0 von 5 · 71 Bewertungen auf anwalt.dePeriod: October 2018 to date · As of: 28 October 2026
“Mr Bohne has provided outstanding legal advice to my company for years. He is honest, friendly and very competent. Questions always receive a fast and remarkably thoughtful answer. …” (translated from German)
“Many thanks again for your commitment and for securing the best possible outcome on my behalf. Your services are highly appreciated and recommended. I can warmly recommend ITMR Rechtsanwälte GbR and Mr Bohne in particular.” (translated from German)
“We have been working with ITMR, and Mr Bohne in particular, for several years. From the start we found the cooperation very professional and pleasant. …” (translated from German)
FAQ
What do companies ask about IT outsourcing?
How does outsourcing differ from a maintenance contract?
A maintenance contract centres on a narrower service. The outsourcing contract organises the transfer of functions with governance, provider chain, transition and exit.
Are managed services the same?
Not entirely. Managed services usually concern narrower operating components. Outsourcing describes the larger model with more control and responsibility.
When should the contract be reviewed?
Ideally before sign-off or before the transition starts. The review is also worthwhile in the running model if governance or exit no longer fit.
Why is the transition so important?
The transition decides knowledge build-up, access, tests, interfaces and parallel operation. Without clear rules, the introduction becomes an operational risk.
What is tricky about subcontractors?
It gets tricky when service chains, remote access, boundaries of responsibility, security requirements and audit rights are not documented.
Do you help with a provider change?
Yes. We then organise handover, exit services, access to data and documentation, open services and the negotiation line for the switch.
Next step
Does your contract fit the outsourcing model?
Before sign-off, before transition, during operation or before a switch, we check whether the contract reflects your model.
Helpful for your enquiry
- Framework agreement
- Service description and SLA
- Transition plan or exit provisions
- DPA, if available
To get started, the contract with a short description is enough.
Classify your outsourcing contract
For companies before sign-off, transition, renegotiation or provider change.
Briefly describe the outsourcing model and occasion.
Related services
IT-Recht Fundamental questions on IT contracts.Maintenance contract & SLA Narrower service obligations.Review a SaaS contract Negotiate SaaS contracts.Data processing agreement Review your DPA.Service packages All packages.
From our blog: CrowdStrike outage