Adam is a legal intern at Sprintlaw. He is currently completing his double degree in Law and Commerce at Macquarie University. With interests in contracts and accounting, he is looking to complete further study and gain experience in the area of commercial law.
If you’re paying an IT provider to build, maintain or secure your systems, you’re not just “getting tech support” - you’re entering a commercial relationship with real legal and financial risk on both sides.
An IT services agreement is the document that sets the ground rules: what you’re buying, what the provider must deliver, what happens if something goes wrong, and who wears the cost if a deadline is missed or data is exposed.
This guide has been updated to reflect the way New Zealand businesses typically buy IT services today (including managed services, cloud-based work, and increased focus on privacy and cybersecurity compliance). If you get the contract right upfront, you’ll save yourself a lot of stress later.
What Is An IT Services Agreement (And When Do You Need One)?
An IT services agreement is a contract between a service provider (the “supplier”) and a client (your business). It sets out the scope of services, fees, performance expectations, risk allocation and legal protections.
You’ll usually need an IT services agreement when you engage someone to do things like:
- Provide ongoing IT support (helpdesk, device management, troubleshooting)
- Monitor and maintain your systems (patching, backups, security monitoring)
- Manage cloud services (Microsoft 365, Google Workspace, AWS, Azure)
- Implement cybersecurity controls (MFA rollouts, incident response, training)
- Deliver a one-off project (network upgrade, migration, hardware rollout)
- Build or customise software (often paired with a separate software development agreement)
Some IT providers will call this a “managed services agreement”, “support agreement”, or “IT consultancy agreement”. The label matters less than the content - you want a document that clearly reflects how you’re actually working together.
As a practical rule: if the provider will access your systems, handle business-critical operations, or store / process your data, don’t rely on emails and goodwill. Get the agreement in writing and tailored to your setup.
IT Services Agreement vs SOW vs SLA (What’s The Difference)?
IT contracts often come as a “bundle” of documents. It helps to know what each one does:
- IT Services Agreement (Master Agreement): the legal backbone - core terms like liability, confidentiality, IP, payment, termination and dispute resolution.
- Statement of Work (SOW): the practical detail of what’s being delivered for a specific project (tasks, milestones, assumptions, deliverables, responsibilities). A good SOW often prevents most disputes before they start.
- Service Level Agreement (SLA): performance standards, usually for support/managed services (response times, uptime targets, escalation process, service credits).
It’s common to have one master agreement and multiple SOWs over time. That way you can add new projects without renegotiating the entire legal framework each time.
What Should Be Included In An IT Services Agreement?
A strong IT services agreement should be clear enough that a non-technical business owner can understand what’s being provided - and specific enough that it can be enforced if things go off track.
While every agreement should be tailored, there are some clauses that matter in almost every IT engagement in New Zealand.
1. Scope Of Services (And What’s Excluded)
This is where many IT agreements fall over. Vague scope leads to scope creep, surprise invoices, and frustration on both sides.
Your contract should spell out:
- What services are included (e.g. “remote helpdesk support for end users”) and the hours of coverage
- What systems are covered (devices, servers, networks, specific platforms)
- What’s not included (e.g. on-site support, third-party vendor coordination, after-hours work)
- Dependencies and assumptions (e.g. “client will provide timely access and approvals”)
If it’s a project (like a migration), you’ll usually want the operational detail in the SOW and keep the master agreement more general.
2. Fees, Invoicing And Cost Controls
IT pricing can be simple (fixed monthly fee) or complex (time-based, milestone-based, usage-based, plus pass-through costs). The agreement should remove guesswork.
Consider including:
- Fee model (fixed, hourly, retainer, per-user/per-device)
- When invoices are issued and when payment is due
- What happens if you dispute an invoice (and whether you must pay the undisputed portion)
- Approval requirements for additional work (for example, “no work over $X without written approval”)
- Pass-through expenses (licences, hardware, third-party tools) and whether mark-ups apply
Cost clarity is also a fairness issue - it protects both sides from misunderstandings.
3. Service Levels And Support Commitments
If you’re relying on the provider to keep your business operational, you need clear service standards.
SLAs often define:
- Response times (how quickly they acknowledge the issue)
- Resolution targets (how quickly they aim to fix it)
- Severity levels (critical vs high vs normal issues)
- Uptime commitments (if they’re hosting or managing infrastructure)
- Escalation procedures and who your key contacts are
Be careful with “best endeavours” style drafting if your business genuinely needs firm timelines. If downtime costs you money, your agreement should reflect that reality.
4. Confidentiality And Access To Your Systems
IT providers often have privileged access to your systems, passwords, admin consoles and sometimes customer data. A confidentiality clause is essential, but it should do more than say “keep it secret”.
Good agreements address:
- How access is granted (named accounts, MFA, role-based access)
- Restrictions on using your information for other purposes
- Secure handling and storage of credentials and logs
- What happens when the relationship ends (return or destruction of confidential information)
In many cases, you’ll also want your own internal policies aligned (for example, how your team requests changes, who can approve access, and how incidents get escalated).
5. Data Protection And Privacy Obligations
If personal information is involved (customer details, employee records, contact databases, medical information, etc.), you need to think about your obligations under the Privacy Act 2020.
Even if the provider is “just the IT company”, they may still be handling personal information on your behalf, which can create real risk if something goes wrong.
Common contract points include:
- Security controls the provider must maintain (encryption, patching, backups, logging)
- Rules about subcontractors and offshore hosting
- Data breach response steps, including timeframes for notification and cooperation
- Whether the provider can use your data to improve tools or analytics (often a hidden clause worth negotiating)
If you collect personal information as part of your business, having a clear Privacy Policy is also part of building trust and setting expectations with customers and staff.
6. Intellectual Property (IP) And Who Owns What
IP issues pop up constantly in IT services - especially where the provider creates scripts, documentation, automations, configurations, or custom code.
Your agreement should clearly cover:
- What pre-existing IP each party keeps (e.g. the provider’s tools/templates)
- Who owns deliverables created specifically for you (and when ownership transfers)
- Whether you get an assignment of IP or a licence to use it
- Whether you can modify or share deliverables internally
Without clear drafting, you can end up paying for work you can’t legally use (or can’t hand to a new provider if you switch).
7. Warranties, Liability And Indemnities
This is the “who pays if it goes wrong?” section - and it matters more than most people think.
IT agreements often include:
- Warranties about professional services (e.g. skill and care, compliance with law)
- Exclusions for issues caused by third-party systems, your internal team, or legacy infrastructure
- Limits on liability (often capped to fees paid in a set period)
- Indemnities (for example, for IP infringement or third-party claims)
Liability clauses should reflect the real risk profile. A provider managing a mission-critical environment (or holding sensitive data) should not be treated the same as someone doing a small one-off troubleshooting job.
If you’re unsure, it’s worth getting advice before signing - caps and exclusions can make the contract effectively one-sided if they’re not negotiated properly.
What Laws In New Zealand Affect IT Services Agreements?
An IT services agreement is still a contract, so general contract law principles apply (offer/acceptance, clear terms, enforceability). But there are also specific legal areas that often come into play in IT services relationships.
Privacy Act 2020 (And Data Breach Expectations)
If your provider handles personal information, you should treat privacy compliance as a shared operational responsibility (even if the legal responsibility ultimately sits with your business in many cases).
Practically, this means your contract should require the IT provider to:
- Take reasonable steps to secure personal information
- Notify you promptly if there is a suspected breach
- Assist with investigation, containment and remediation
Where privacy risk is high, it may also be appropriate to pair your IT services agreement with a dedicated privacy-focused document, such as a Data Processing Agreement, especially where the provider acts like a “processor” handling data on your instructions.
Fair Trading Act 1986 (No Misleading Claims)
The Fair Trading Act 1986 can apply if representations are made in marketing materials or proposals (for example, “fully secure”, “guaranteed uptime”, or “compliant with all standards”) and those claims aren’t accurate.
This cuts both ways:
- Providers should be careful not to over-promise in sales materials.
- Clients should make sure the contract reflects what was promised, rather than relying on verbal assurances.
If a promise is business-critical, it should be written into the agreement as a deliverable or service level.
Consumer Guarantees Act 1993 (Sometimes Relevant)
The Consumer Guarantees Act 1993 generally applies where services are provided to consumers. Many IT services are provided business-to-business, so it may not apply.
However, if you’re a small operator or the service is being supplied to an individual for personal use, consumer protections might become relevant. This is one of those “it depends” areas where getting tailored advice can prevent incorrect assumptions.
Cybersecurity, Operational Risk And “Reasonable Steps”
New Zealand law doesn’t require every business to have enterprise-level cybersecurity - but if you collect personal information, take payments online, or rely heavily on digital systems, you’re expected to take reasonable steps to protect your environment.
This is why IT services agreements increasingly include obligations around:
- Patching and vulnerability management
- Multi-factor authentication (MFA)
- Backups and disaster recovery
- Security awareness training
The contract won’t “solve” cybersecurity on its own, but it can make responsibilities clear, so you’re not left arguing after an incident.
Common Pitfalls We See With IT Services Agreements
Most contract problems aren’t caused by bad intentions - they’re caused by assumptions. Here are the issues that commonly trip up New Zealand business owners.
Relying On A Quote Or Proposal As The Contract
Quotes are great for pricing, but they usually don’t cover the hard parts:
- What happens if the project runs late?
- What if your data is exposed?
- Who owns the deliverables?
- How do you exit cleanly and move to another provider?
If you’re investing real money into IT (or trusting them with critical systems), a proper agreement is worth it.
Unclear Responsibilities Between You And The Provider
In IT, “shared responsibility” is everywhere. For example, your provider might configure security tools, but your staff still need to use strong passwords and approve access changes.
A good contract (and SOW) should spell out:
- What you must provide (access, approvals, timely responses, accurate information)
- What the provider will manage (monitoring, patching, change requests)
- What is explicitly outside their responsibility
Lock-In Clauses That Make It Hard To Switch Providers
Sometimes “lock-in” is commercial (long minimum terms). Sometimes it’s practical (the provider holds all documentation, admin access, and system knowledge).
Your agreement should deal with offboarding, including:
- Return of credentials and access
- Handover documentation
- Cooperation with a new provider (within reason)
- Data return/export and deletion procedures
If your business can’t function without your IT environment, a messy exit can be incredibly expensive.
Liability Caps That Don’t Match The Risk
It’s common for providers to cap liability to a small amount (sometimes just one month of fees), even where the potential damage is much higher.
That doesn’t mean every cap is “wrong” - but it should be considered carefully. You might negotiate different caps for:
- General service failures
- Privacy breaches or security incidents
- IP infringement claims
- Deliberate misconduct or gross negligence
This is where having a lawyer review the agreement can be a smart investment, especially if you’re signing a provider’s template.
How Do You Negotiate An IT Services Agreement Without It Getting Awkward?
A lot of business owners worry that negotiating a contract will damage the relationship. In reality, good providers are used to these conversations.
If you want to keep things smooth, focus on clarity and risk management, not blame.
Start With The Commercial “Must-Haves”
Before you get into legal clauses, clarify the operational deal:
- What outcomes you’re paying for
- Response times that match your business needs
- Pricing and approval rules for extra work
- Who your key contacts are and how escalation works
Once those are agreed, the legal drafting becomes much more straightforward.
Ask For A SOW That’s Detailed Enough To Run The Project
A well-written SOW can prevent arguments later because it makes the “work” concrete.
For example, instead of “migrate to Microsoft 365”, you might want milestones like:
- Audit current environment and confirm migration approach
- Create test tenant and run pilot migration
- Migrate mailboxes in batches with agreed downtime windows
- Confirm post-migration testing and sign-off steps
If you already have a master agreement, adding a new SOW as your needs change is often the easiest way to keep things current.
Make Termination And Transition Practical (Not Just Legal)
Termination clauses shouldn’t just say “either party may terminate with X days’ notice”. They should also address what happens next, such as:
- final invoices and prepaid amounts
- handover support
- access removal
- return/deletion of data
If you’re engaging staff or contractors internally to work alongside the provider, it’s also worth aligning expectations in your own paperwork, like an Employment Contract or contractor agreement, so everyone understands confidentiality and IP ownership from day one.
Don’t DIY The Legal Terms If The Risk Is High
Templates can be a starting point, but IT services agreements often need tailoring to match:
- your industry (especially if you handle sensitive information)
- your reliance on uptime
- whether the provider will host data offshore
- your need to own deliverables or avoid vendor lock-in
If you’re signing a provider’s contract, a legal review can also flag terms that are unusual or overly one-sided. In many cases, it’s worth having a lawyer draft or review the core IT Service Agreement so you know it fits how you actually operate.
Key Takeaways
- An IT services agreement is the foundation document that sets expectations around scope, fees, service levels, security, and what happens if things go wrong.
- Most IT arrangements work best with a master agreement plus separate documents like a SOW and (where relevant) an SLA.
- If the provider will handle personal information, your agreement should address Privacy Act 2020 obligations, security controls, and data breach response processes, often supported by a Data Processing Agreement.
- Common problem areas include unclear scope, surprise costs, difficult offboarding, and liability clauses that don’t match the real risk to your business.
- If a claim or promise is business-critical (like uptime or security), make sure it’s written into the contract, not just discussed in sales calls or emails.
- Getting the agreement drafted or reviewed professionally can protect you from day one and make the relationship smoother as your business grows.
If you’d like help drafting or reviewing an IT services agreement (or related documents like a Privacy Policy), you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.