Although not a new trend in the Canadian market, organisations commonly gravitate away from on-premises technology environments and adopt cloud infrastructure-as-a-service, platform-as-a-service and software-as-a-service solutions (collectively, XaaS solutions), resulting in deep, business-critical outsourcing relationships with third-party service providers. Canadian organisations also continue to leverage offshore personnel – especially technical professionals from India – for technology implementation, maintenance and data transformation services, among other things. These professional service outsourcing arrangements are typically initiated through an on-shore service provider that leverages primarily off-shore resources to deliver services.

In Canada, BPO continues to be common, with organisations frequently relying on external entities to provide important business supports.

However, notable recent developments in BPO include the following:

• Fractional roles for professionals serving in key business and leadership functions are starting to take hold in Canada, especially for small and medium-sized organisations and technology start-ups. Fractional finance, marketing, human resources, privacy and technology officers are becoming increasingly common.
• Canada’s historical mistreatment of Indigenous Peoples has been getting increasing attention in recent years, which has prompted many public and private organisations to implement Indigenous procurement policies that drive outsourcing decisions. These procurement policies are supported in part by certain exemptions from the application of public procurement rules found in key international trade agreements.
• Organisations are increasingly adopting artificial intelligence (AI) technologies to augment internal resources and improve productivity. While not a traditional form of BPO, it is important to recognise that work activities previously performed exclusively by internal resources are increasingly being supported by external AI technologies that are unlike ordinary productivity tools.

AI technologies have been, and continue to be, a disruptive force in the Canadian marketplace and in the technology and outsourcing contexts in particular. Several discrete trends are emerging.

• First, most organisations have recognised that AI adoption is likely a strategic imperative, leading to increased purchasing and licensing activity for AI technologies.
• Second, although AI adoption is rapidly growing, it is not uncommon for organisations to adopt AI technologies without fully-formed AI governance strategies and procedures in place, which can create technology and outsourcing risks, particularly in respect of organisational confidentiality and intellectual property interests.
• Third, while Canadian organisations seem committed to AI adoption, there is a growing sense of discomfort with AI among the Canadian public stemming from concerns about long-term job security, and the growing prevalence of AI data centres and their impact on the environment and local infrastructure. This general discomfort can have downstream implications for organisational change management, labour and public relations.

Within the information technology industry, the most commonly outsourced services continue to be XaaS solutions and related professional services. Beyond XaaS, Canadian organisations also commonly outsource managed IT services, help desk and end-user support, data centre operations, cybersecurity monitoring and incident response services, and payroll and human resources administration. Contact centre operations and document management services are also frequently outsourced, particularly in the financial services and telecommunications sectors.

There are no Canadian legal or regulatory restrictions that apply categorically to all technology transactions or outsourcing arrangements. The regulatory environment is mainly comprised of laws and regulatory instruments of general application that apply to all transactions and business arrangements. For example, federal and provincial privacy legislation (which varies for public and private sector entities) applies to transactions and outsourcing arrangements involving personal information. Canada’s federal competition legislation applies across industries but can proscribe business strategies of technology companies that the legislation deems anti-competitive. Canada has a robust regulatory environment for securities transactions which would apply if a technology company is being sold or acquired. There are also import and export regulations that can apply to technology transactions, as well as restrictions to transactions involving certain sanctioned countries and individuals that can impact technology transactions with those entities.

There are several industry-specific restrictions on technology transactions and outsourcing. In the financial services sector, federally regulated financial institutions must comply with the Office of the Superintendent of Financial Institutions’ (OSFI) Guideline B-10 on Third-Party Risk Management, which imposes due diligence, contractual, monitoring and exit strategy requirements for material outsourcing arrangements. In the healthcare sector, provincial health information legislation (eg, Alberta’s Health Information Act and Ontario’s Personal Health Information Protection Act) imposes specific restrictions on the collection, use, disclosure and storage of personal health information that can significantly affect healthcare technology and outsourcing arrangements. In the energy sector, regulatory bodies may impose data residency and security requirements that affect outsourcing decisions. Foreign organisations are well-advised to conduct industry-specific regulatory analyses prior to engaging in technology and outsourcing transactions in Canada.

Canada does not have legal or regulatory instruments of general application that place restrictions on data processing. Canada’s federal and provincial privacy legislation is mainly responsible for defining the obligations of data processors, but this legislation only applies in respect of processing personal information and not other categories of data. With that said, it is common market practice for organisations to use contracts to impose information security standards (eg, ISO/IEC 27001 and 27002) and to restrict cross-border data flows.

Also, as indicated above, there are industry-specific restrictions that implicate data processing and require attention. For example, federally regulated financial institutions must comply with guidelines for third-party risk management and technology and cyber risk management. As a further example, for the nuclear industry there are federal laws and regulations that restrict the import and export of certain prescribed information and export controlled information, compliance with which can become complex in the prevailing environment of XaaS solutions and outsourcing IT functions. As noted in 2.2 Industry-Specific Restrictions, a thorough regulatory analysis is advisable before entering into technology and outsourcing transactions in Canada.

The contract model for outsourcing depends considerably on the nature of the arrangement, but service contracts are the most prevalent.

For example, when outsourcing components of an IT environment by means of XaaS solutions, it is common for organisations to contract directly with the XaaS provider. These service providers largely dictate contract terms through standard form service contract regimes which often leverage online contract documents that can be changed unilaterally by the service provider. Negotiating changes to these service contracts can be challenging but is often possible by means of overriding contract addendums. For outsourced professional services supporting the implementation and maintenance of XaaS solutions, the contracts are often entered into directly with the professional services firm. These contracts are often constructed as master services agreements, with the work organised under discrete statements of work or service schedules. As alluded to above, where outsourcing professional services involves offshore resources, it is common to contract with an onshore service provider that subcontracts with its own offshore affiliate to facilitate service performance by lower-cost offshore resources.

Managed services arrangements are a common means of outsourcing services. For example, an organisation might contract with an entity that purchases an XaaS solution and resells it to the organisation, while also providing value-added services to the organisation such as XaaS solution administration or managing the relationship with the XaaS solution provider. Managed services providers may also aggregate multiple technology solutions and deliver them as a unified service offering, which can reduce the administrative burden on the customer of managing multiple vendor relationships.

Multi-sourcing is another contract model that is commonly used in Canada, particularly for large-scale technology implementations. Under a multi-sourcing approach, an organisation contracts with multiple service providers, each responsible for a discrete component of the technology environment or project. This model requires robust governance frameworks and clear delineation of responsibilities among the service providers, and often involves a systems integrator or prime contractor that co-ordinates the work of the other providers.

Joint ventures, while less common than the above models for technology outsourcing, are used in certain sectors – particularly where organisations wish to co-develop technology solutions or share the costs and risks of a significant technology initiative. Joint ventures in the technology context raise important considerations around intellectual property ownership, licensing rights, exclusivity and the allocation of commercialisation rights upon termination of the venture.

The widespread adoption of cloud computing and XaaS solutions has affected outsourcing contract models in several important ways. First, the shift from on-premises technology to cloud-based delivery has moved the market away from perpetual licence models towards subscription-based service contracts, fundamentally changing how technology is procured and paid for. Second, the dominance of large XaaS providers has led to an increase in standard form, non-negotiable contract terms, which has driven the use of supplemental addendums as the primary mechanism for customers to negotiate deviations from the provider’s standard terms. Third, the complexity of cloud environments has given rise to multi-layered contract structures, where customers may have a primary XaaS contract with the cloud provider, a separate master services agreement with a professional services firm for implementation and customisation, and additional agreements with managed services providers for ongoing administration and support. Fourth, the ease with which cloud solutions can be adopted has also created challenges around shadow IT – where business units procure cloud services without the involvement of procurement or legal teams – which has prompted many organisations to implement technology governance frameworks and centralised procurement processes to maintain oversight and contractual consistency.

Customer protections vary widely depending on the nature of the transaction. However, there are commonalities in customer protections found across XaaS contracts and related professional services contracts that warrant discussion. Note the examples below are focused on customer protections that are typically the most relevant from a business perspective. These contracts commonly include other protective provisions covering subjects such as compliance with laws, intellectual property rights, confidentiality, data security, privacy and limitations of liability, among others.

In an XaaS contract, the customer protections and remedies most relevant from a business perspective will typically include:

• fee protections, such as protections against uncapped annual subscription fee increases, limits on the service provider’s ability to pass through expenses to the customer, and protections against fee gross-ups triggered to account for withholding taxes that the customer is required to remit;
• indemnification from third-party intellectual property infringement claims related to the XaaS solution, which are often accompanied by commitments from the service provider to procure the rights for the customer to continue using the solution, or to modify the solution to make it non-infringing; there are often other indemnities covering service provider-caused gross negligence, wilful misconduct, death, bodily injury and property damage;
• representations and warranties to the effect that the XaaS solution will conform with the service provider’s documentation, and a corresponding commitment that the service provider will remediate services that do not conform with that documentation;
• service level agreements for XaaS solution availability and incident response times, which often have corresponding commitments to issue service credits if the service provider fails to achieve the agreed upon service level;
• disaster recovery commitments defined with reference to recovery point objectives and recovery time objectives;
• transition service commitments that ensure the continued availability of the XaaS solution and co-operation of the XaaS provider if the customer elects to move to a new service provider or repatriate the subject services;
• continuous improvement and quality assurance provisions that require the service provider to proactively develop the XaaS solution to maintain currency and competitiveness; and
• fee dispute mechanisms that permit the customer to withhold disputed fees and expenses until the dispute can be resolved.

In a professional services contract the customer protections and remedies will typically include:

• fee protections, fee dispute mechanisms, transition services provisions, quality assurance provisions and indemnities similar to those found in XaaS contracts;
• fixed-price project contracts under which the service provider commits to delivering a defined scope of work (and not merely a fixed level of service capacity);
• change management regimes that protect customers against persistent service provider-driven change requests, cost escalation and delays;
• acceptance procedures that promote customer review and evaluation of deliverables, and protect against deemed acceptance of deliverables;
• representations and warranties relating to the quality of services and deliverables, and conformance with customer specifications; these representations and warranties typically include corresponding remedies requiring re-performance of services to remediate defective work product at no additional cost to the customer;
• financial protections and remedies such as fee hold-backs and liquidated damages to incentivise timely completion of the services and delivery of stable technology solutions; and
• reporting obligations on the service provider that give the customer visibility into service delivery and schedule adherence.

It should be highlighted that customer protections and remedies are often heavily negotiated and there is a significant range of outcomes. Customers will frequently negotiate for, and obtain, protections and remedies not discussed above. However, the above protections and remedies are common facets of customers’ risk management discussions.

Most XaaS and professional services contracts will include mutual termination rights that allow a party to terminate in the following circumstances:

• the other party commits a material breach of contract that cannot be cured, or is not cured within a prescribed cure period;
• the other party becomes bankrupt or insolvent;
• the other party assigns the contract or undergoes a change of control without the other party’s required consent; or
• a force majeure event persists for a prescribed period.

Customers occasionally seek additional termination rights as well, particularly when the customer is a public entity. Public entities will typically seek a termination for convenience right, or a similar right that permits termination in the event that the entity’s mandate changes, the entity is subject to a change in applicable laws that makes the continuation of the service engagement impossible, or the funds to pay for the services are not appropriated by the relevant legislative body.

Service providers will also seek additional termination rights. For example, service providers frequently seek the right to terminate the contract in whole or in part in the event their technology becomes subject to a third-party intellectual property infringement claim, and the service provider unilaterally decides to stop providing the affected service.

In Canada, the common law analysis for damages flowing from breach of contract does not revolve around the categories of “direct” and “indirect” loss. Determining whether damages are recoverable for breach of contract in a given circumstance generally involves asking:

• whether the damages arise naturally from the breach of contract; and
• whether the non-defaulting party communicated any special circumstances at the time the contract was made that would inform the defaulting party’s understanding of the damages that may naturally arise from its breach of that particular contract.

The contractual damages analysis at common law therefore tends to focus on whether the defaulting party caused the damages in question, and whether those damages were reasonably foreseeable. This is a fact-driven analysis and does not hinge on whether the damages in question are “direct” or “indirect”.

Despite the above, it is common practice in Canada to include the concepts of “direct damages” and “indirect damages” in technology and outsourcing contracts, usually for the purpose of excluding recovery of “indirect damages”, which are often described as including consequential damages and special damages (and at times, aggravated and punitive damages).

In Canada, it is possible to recover damages for loss of profits as damages that arise naturally from a breach of contract. In fact, technology and outsourcing contracts often tacitly acknowledge that loss of profits could be realistically characterised as “direct damages”. For this reason, contracts will often expressly exclude recovery of lost profits, lost savings and categories of damage and will do so without characterising those damages as falling into the category of “direct damages” or “indirect damages”.

There are certain common law and statutory principles that can operate to undermine the operation of contractual limitations and exclusions of liability. For example, there are common law principles that guard against unconscionable bargains and limitations of liability that would be contrary to public policy (eg, limitations of liability for conduct approaching criminal fraud). There are also provincial consumer protection statutes that can override contract terms in technology and outsourcing agreements (provided the legislation applies in favour of the customer in the circumstances).

It is common practice for technology and outsourcing contracts in Canada to include specific exemptions from limitations and exclusions of liability. In other words, it is common for contracting parties to accept unlimited liability for certain categories of conduct, which usually include theft, fraud and other wilful misconduct, as well as gross negligence. Parties will often have unlimited liability for claims relating to property damage, bodily injury or death that they cause.

In Canada, technology and outsourcing contracts can have implied terms by operation of the common law and certain statutes.

One of the most broadly applicable implied terms in Canada is referred to as the “duty of honest performance”, which is treated as a contractual duty for each party to conduct itself in accordance with a minimum standard of honesty in contractual performance.

Outside of the duty of honest performance, other common law and statutory principles can apply depending on the circumstances. In the service context, a court may find that the common law implies that services will be performed in accordance with reasonable care and skill. Further, as noted in4.3 Liability, provincial consumer protection legislation can also apply to certain technology and outsourcing agreements and imply terms into consumer contracts. In the sale of goods context, provincial sale of goods legislation imposing implied warranties of fitness for purpose, merchantable quality, conformance with product descriptions, and title could apply if the transaction involves the purchase of hardware, for instance. It is common practice in technology and outsourcing contracts to include broad disclaimers of implied representations, warranties and conditions to avoid the operation of these common law and statutory implied terms to the extent possible.

In technology and outsourcing contracts, provisions relating to confidentiality, privacy and data security are often intertwined and together form a data protection regime that protects the customer from information security risks.

Confidentiality frameworks typically require the service provider to:

• use the customer’s confidential information only as strictly necessary to perform the services;
• disclose the customer’s confidential information to third parties only as strictly necessary to perform the services or as required by applicable laws;
• disclose the customer’s confidential information to the service provider’s personnel on a need-to-know basis, and to the minimum extent necessary;
• ensure all permitted disclosures of the customer’s confidential information are subject to contractual protections that are substantially similar to those of the technology or outsourcing agreement;
• take full responsibility for all of its permitted disclosures of the customer’s confidential information;
• protect the customer’s confidential information in accordance with at least the same standard of protection that the service provider uses to protect its own confidential information, and in any event a reasonable standard of protection;
• return or destroy the customer’s confidential information at the end of the contract, subject to allowances for copies of confidential information stored in system back-ups that are systematically erased; and
• agree that the customer can apply for equitable relief in the event the service provider breaches or threatens to breach its confidentiality obligations.

Privacy frameworks typically require the service provider to:

• confirm the customer’s ownership and control of personal information;
• comply with privacy laws applicable to the service provider;
• assist the customer in complying with applicable privacy laws, which is important if the customer and service provider are subject to different privacy laws; this can involve:
1. assistance managing third-party access, amendment and correction requests; and
2. participating in regulatory audits;
• comply with supplemental restrictions on the collection, use, disclosure and processing of personal information that may be more restrictive of the more general confidentiality terms of the contract; for example, the service provider may be specifically prohibited from anonymising and aggregating personal information.

Security frameworks typically require the service provider to:

• agree to maintain an information security programme consistent with an industry standard prescribed by the contract (eg, ISO/IEC 27001 and 27002);
• submit to third-party audits and provide audit certifications (eg, SOC 2 Type 2);
• maintain administrative, physical and technical safeguards as well as specific security measures, including:
1. site access restrictions and business device/media use restrictions;
2. prescribed encryption protocols;

1. multi-factor authentication and password protection;
2. logical controls and access control methodologies;
3. credential review policies to deactivate stale credentials;
4. network intrusion and malware detection;
5. protocols for secure destruction of data;
6. protocols for keeping software and firmware current; and
7. protocols for keeping system logs;
• maintain an incident response plan, and perform certain incident response and remediation obligations;
• maintain a disaster recovery and business continuity plan; and
• comply with specific security protocols when accessing the customer’s IT environment.

Performance measurement and management approaches vary depending on the nature of the technology or outsourcing transaction.

In an XaaS contract, performance measurement and management are mainly addressed in service level agreements and audit provisions.

• Service level agreements frequently include:
1. a defined measurement period and reporting protocol;
2. a commitment from the service provider that the XaaS solution will be available for a prescribed percentage of the measurement period;
3. a commitment from the service provider to prioritise and respond to incidents within a fixed response time, which may vary depending on the severity of the incident; and
4. consequences for the service provider’s failure to achieve service level commitments, which typically include service credits and termination rights for persistent failures; however, service credits are usually reserved for availability failures and not response time failures.
• Audit provisions for XaaS contracts are typically more limited than they are in other service contracts, and frequently restrict audit co-operation to regulatory audits and the sharing of third-party reports produced in connection with security audits.

In a professional services contract, performance measurement and management can be addressed in several different ways, including:

• organising project work into milestones, and connecting payment to the completion of milestones;
• reserving the right for the customer to issue additional instructions to the service provider without triggering change orders;
• requiring the service provider to work with third parties at the direction of the customer, where the work with the third party is incidental to the service provider’s services;
• requiring the service provider to report on its performance at regular intervals, or as performance issues arise;
• contracting for liquidated damages that are payable by the service provider when they are late delivering a work product; and
• contracting for fee holdbacks, where a percentage of fees is withheld until after a project is complete and, if applicable, the technology is stabilised.

As discussed in 3.3 Digital Transformation, the widespread adoption of cloud computing and XaaS solutions has effectively reset the market standard contract models for technology and outsourcing arrangements. Consequently, the common terms described above are consistent with what customers can expect when entering into cloud-based technology and outsourcing agreements.

With that said, it should also be noted that where a cloud solution is implicated, another common consideration is the location of data storage and processing. Although Canada does not have general restrictions on where public or private entities can store or process data, it is common for Canadian entities to impose location restrictions when contracting for cloud technologies. There is a general inclination to restrict data storage and processing to Canada where possible.

Canadian law does not provide for an automatic transfer of employees from customer to supplier in an outsourcing. The rules are shaped by common law, employment standards legislation, and labour relations statutes.

An outsourcing involving the transfer of customer assets to the supplier generally constitutes a constructive dismissal of the customer’s non-unionised employees. Where no assets are transferred, employment may still terminate by constructive dismissal (eg, removal of duties) or express dismissal. Termination costs for non-unionised employees include statutory notice, group/mass termination notice, statutory severance, and common law reasonable notice. Unionised employee termination costs are governed by the applicable collective bargaining agreement (CBA).

At common law, employment contracts cannot be assigned. The supplier is not required to hire any of the customer’s employees and may selectively offer new contracts to targeted non-unionised employees.

Successor employer rules may nonetheless impose obligations on the supplier. At common law, if the supplier operates the customer’s business as a “going concern” (considering continuity of operations, employees, and work type), it is a successor employer, which affects reasonable notice liability for any subsequent terminations. Under employment standards legislation, “sale of business” provisions are interpreted to include outsourcing; if the employee is hired by the supplier and employment is continuous, service is deemed continuous – eliminating the customer’s statutory notice and severance obligations, but requiring the supplier to credit prior service on any future termination. Under labour relations legislation, where the outsourcing constitutes a transfer of business activities to which bargaining rights attach, the supplier is bound by the existing CBA, related arbitration decisions, labour board orders, and pre-transaction liabilities.

Customers typically seek to transfer employees simultaneously with the business to preserve employment continuity, eliminate statutory termination costs, and reduce common law damages through mitigation. Quebec is a notable exception: certain employee transfer obligations may arise automatically under Quebec law.

Whether trade unions need to be engaged for outsourcing discussions is generally dictated by the terms of CBAs. CBAs may contain provisions that require the employer to provide advance notice of outsourcing decisions, to consult or bargain with the union before subcontracting work covered by the agreement, or that restrict the employer’s ability to contract out bargaining unit work altogether. Outside of CBA obligations, Canadian labour relations legislation does not impose a general statutory obligation to consult with trade unions in connection with outsourcing. However, as discussed in 5.1 Employee Transfers, where an outsourcing constitutes a transfer of business activities to which bargaining rights attach, successor employer provisions may apply to bind the new employer to the existing CBA.

Canadian organisations continue to use both on-shore and off-shore resources in outsourcing transactions. There has not been a significant shift on this front over the past year, although Canadian organisations are increasingly evaluating a broader range of global service providers and giving greater consideration to geopolitical and trade dynamics when making outsourcing decisions.

There are legal issues that arise in the context of remote work.

• For one thing, a remote worker is still a worker; labour and human rights legislation, and the terms of employment agreements still apply when remote workers are employees. Failing to follow the relevant legislation or to have clear policies in place that dictate the rules and expectations for employees’ remote work can create employment-related risks.
• Compliance with occupational health and safety legislation can also become an issue, although the prospect of applying that legislation to remote workers and their working environment is somewhat recent and unsettled.
• Certain remote work activities could potentially implicate compliance with building codes, municipal zoning by-laws and condominium by-laws.

Outside of compliance with statutory obligations, organisations also need to consider how remote work can have implications for compliance with contracts and internal policies. For example, remote work can have significant implications for information security, whether because paper documents left in a home office or living room could be easily obtained by other occupants of the home, or because other occupants of the home may overhear business phone calls. If confidential information finds its way into the hands of an unauthorised individual, that may represent a breach of contract or an internal policy.

Although many Canadian organisations either specifically recruit for or are permissive of remote work and hybrid working arrangements, the general trend in Canada is towards a return to in-office working arrangements. This is manifest in organisations steadily decreasing the number of permitted work-from-home days, and reported increases in office-only job postings. Commonly cited rationales for asking workers to return to the office include:

• in-person work strengthens workplace culture and promotes human connections;
• in-person work fosters collaboration and creativity; and
• in-person work is more conducive to oversight and mentorship of workers.