Subcontracting consent: who is actually testing your product

You chose a testing vendor after checking its security, its people and its references. If part of the work then goes to another firm or to freelancers, the people handling your code and data are ones you never assessed. Subcontracting is common in testing, especially for peak capacity, device coverage and specialist skills, and proposals do not always mention it.

This post explains the subcontracting clause, what to insist on and how to respond to common vendor positions. It is not legal advice; ask your counsel to review the final wording.

Why it matters

The 2023 US interagency guidance on third-party relationships says subcontracting can create risk because there is no direct relationship between the buyer and the subcontractor, which lessens the buyer's direct control. It suggests that contracts address when and how the third party notifies the buyer of subcontractors, whether assignment or subcontracting needs the buyer's consent, the third party's liability for its subcontractors, and a right to terminate without penalty if subcontracting breaches the contract.

Personal data: GDPR Article 28

If testers process personal data on your behalf, GDPR Article 28 sets minimum rules. A processor may not engage another processor without the controller's prior specific or general written authorisation. Under general authorisation, the processor must tell the controller about intended additions or replacements so that the controller can object. The same data protection obligations must be imposed on the subprocessor by contract, and if the subprocessor fails to meet them, the original processor remains fully liable to the controller.

Testers can meet personal data in test environments, logs and screenshots even when the plan is to use synthetic data. Treat subcontracting consent and subprocessor approval as one question.

Financial services

For EU financial entities, Article 30 of the Digital Operational Resilience Act requires contracts for ICT services to state whether subcontracting of a service supporting a critical or important function is permitted and, if so, on what conditions, and to state the locations where services are provided and data processed, with advance notice of changes.

The EBA outsourcing guidelines go further for critical or important functions. They ask the contract to specify activities excluded from sub-outsourcing, the conditions that apply, the provider's duty to oversee its subcontractors, notice of planned sub-outsourcing early enough for the institution to assess and object, and a right to terminate for undue sub-outsourcing. They also say institutions should agree to sub-outsourcing only if the subcontractor grants the same access and audit rights as the provider.

Public contract models

The UK Model Services Contract requires the supplier to notify the buyer before subcontracting, with the proposed subcontractor's name, registration number and scope, and lets the buyer object on stated grounds. Key subcontracts need the buyer's prior written consent. The US FAR subcontracts clause, 52.244-2, requires specified information before consent and states that consent does not relieve the contractor of responsibility for performing the contract.

What to insist on

• Prior written consent for any subcontracting, including individual freelancers.
• Disclosure of each subcontractor's legal name, registration, role on your account and location.
• Flow-down of confidentiality, security, data processing, audit and IP assignment terms, in writing, before the subcontractor starts.
• Full liability of the vendor for the acts and omissions of its subcontractors.
• Notice of changes early enough for you to assess and object.
• Termination if the vendor subcontracts without consent.
• IP assignment that covers work done by subcontractors, so test code they write belongs to you.

Common vendor positions and how to respond

"We use a vetted network of specialists." Ask for names, roles and locations. A network you cannot see is a network you cannot assess.

"Our freelancers are under the same terms as employees." Ask to see the flow-down terms, and confirm that IP created by freelancers is assigned to the vendor so that it can be assigned to you.

"Consent for every freelancer is impractical." Offer general authorisation for a pre-approved list, with notice and a right to object for additions, which mirrors the GDPR mechanism.

"We accept responsibility only for our own staff." Decline. Full responsibility for subcontractors is standard in public models and in GDPR for subprocessors.

What this means for your selection

Ask about subcontractors and freelancers in the questionnaire and record the answers in the due diligence checklist. The contract clause builder includes subcontracting and subprocessor approval clauses. For more detail, read crowdtesting vs managed QA, how QA vendors staff projects and test data and GDPR.