How can you retain control of data when outsourcing IT services?

Retaining control of data when outsourcing IT services requires more than choosing a trustworthy provider. The business must remain able to decide how data is used, demonstrate that those decisions are being followed, and continue operating if the relationship, technology or provider changes. This is achieved through clear governance, documented processes, technical safeguards and regular evidence-based checks.

Define what control means for the business. Control should be translated into measurable requirements rather than left as a general contractual intention. These may include deciding which data can be processed, approving changes to systems, determining retention periods, authorising disclosures, and requiring records of significant administrative activity. Documenting these decisions gives the business a reference point against which the provider’s work can be assessed.

A useful starting point is a data register covering the main categories of information handled by outsourced systems. It should identify, for example:

• Customer, employee, financial and operational information;
• The systems and locations in which each category is used;
• Who is responsible for deciding how the information is processed;
• Which suppliers or subcontractors may handle it;
• Retention, deletion and legal or regulatory requirements; and
• The consequences if the information is lost, altered, disclosed or made unavailable.

This classification helps the business apply stronger controls to sensitive or commercially important information without imposing the same process on every file and system.

Keep decision-making inside the business. An outsourced provider may administer infrastructure, but it should not become the sole source of knowledge about how critical information is handled. The business should retain suitable internal owners for important systems and data sets. Those owners can approve material changes, review proposed processing activities and confirm whether the technology continues to support business requirements.

Maintain current system diagrams, data-flow descriptions, configuration records and operating procedures in a format the business can access independently. Documentation should explain how information enters a system, where it is transferred, which applications depend on it and how it can be recovered or exported. This reduces dependence on individual technicians and makes informed oversight possible.

Separate administration from unrestricted data access. Technical administration and the ability to view or use business content are not always the same thing. Where practical, systems should be designed so that routine maintenance does not require broad access to the underlying information. Privileged actions can be approved for a defined purpose, recorded, and withdrawn when the task is complete. Separate administrative accounts, controlled elevation of privileges and independent approval for sensitive actions can help preserve this distinction.

Encryption also needs to be considered as part of control, not simply as a security feature. Establish who manages encryption keys, who can authorise their use, how key changes are recorded and what happens if a key is lost or compromised. If the provider controls every technical mechanism needed to access encrypted data, the business may have less practical control than its written agreement suggests.

Make processing instructions precise. The provider should receive written instructions for permitted processing, prohibited uses, data sharing, retention and deletion. These instructions should cover ordinary service activity as well as less common situations, such as troubleshooting, system testing, support investigations and the use of copied data in development environments. Test or training environments should use appropriately sanitised information where genuine business data is not necessary.

Any subcontractors should be identified and subject to equivalent obligations. The business should understand what each subcontractor does, what information it can access and how changes to that supply chain are notified and assessed. This prevents control from weakening beyond the primary provider’s direct operations.

Require evidence, not only assurances. A provider’s claims about its controls should be supported by appropriate records. Depending on the service, useful evidence may include access reports, change records, vulnerability and patching reports, incident records, backup test results, data deletion confirmations and summaries of supplier reviews. The purpose is not to collect paperwork for its own sake; it is to confirm that agreed processes are operating in practice.

Set a proportionate review cycle based on the sensitivity and importance of the data. A review should consider whether processing has changed, whether new systems or suppliers have been introduced, whether permissions remain appropriate, and whether incidents or near misses indicate a weakness. Significant changes should trigger a review rather than waiting for the next scheduled assessment.

Plan for incidents without surrendering control. The business should know how it will be informed about suspected loss, unauthorised disclosure, corruption or misuse of data. The agreed process should identify who investigates, who makes business and regulatory decisions, how evidence is preserved, and who approves communications to affected parties. Providers can support technical investigation, but accountability for the organisation’s response should remain clearly assigned within the business.

It is also important to distinguish between a security incident and an operational problem. A service interruption may not involve disclosure, while a configuration error could expose information even if systems remain available. Different events may therefore require different escalation, investigation and reporting steps.

Protect portability and independence. Data control is difficult to maintain if information can only be understood or extracted through provider-specific tools. Before outsourcing, identify the formats and supporting metadata needed to use the information elsewhere. Consider how applications, configurations, licences, credentials, logs and documentation would be transferred, not just the primary data files. Carrying out an occasional export or recovery exercise can reveal practical barriers that a written plan may miss.

Control should also extend to the provider’s use of business information for analytics, service improvement or testing. Such uses should be expressly permitted, restricted or prohibited according to the organisation’s requirements. The provider should not infer permission from possession of the data.

For a small or medium-sized organisation, the most workable approach is usually a documented data-control framework that assigns internal owners, records processing decisions, limits administrative access, preserves independent knowledge and tests the provider’s evidence. S2 Technology Group can advise businesses around Stourbridge, Kinver, Wordsley, Kingswinford, Kidderminster, Halesowen, Dudley and neighbouring areas on the IT governance, infrastructure and security arrangements that support this framework.