The nature and critical importance of intellectual property vary across industries and types of businesses. Software development outsourcing requires a high level of knowledge sharing between the customer organization and the provider. Consequently, the intellectual property rights of the interested parties are involved in one way or another. Therefore, intellectual property management and data protection issues have become increasingly important for companies using offshore or offshore outsourcing.

Intellectual property that may be transferred to Supplier may include software, data, business and technological processes, trade secrets, inventions, know-how, as well as other confidential information and works of authorship. In addition, some of them may belong to third parties and require a license.

Both the client and the provider must properly manage their intellectual property and adhere to the general objectives of the business to effectively manage the exchange of information. The benefits of sharing intellectual property assets must outweigh the risks associated with outsourcing.

The World Intellectual Property Organization (WIPO) emphasizes two critical IP-related concerns in offshore outsourcing: ownership of IP and the “inadvertent, accidental or deliberate disclosure of confidential information and trade secrets” (loss of of commercial knowledge). But in most cases, these concerns can be overcome by performing proper IP due diligence, thoroughly evaluating the vendor, and taking appropriate IP protection measures.

IP due diligence

Prior to concluding any outsourcing initiative, the client organization must conduct IP risk assessment and due diligence. As a result, the company will be able to safeguard its intellectual property and clearly define which functions should be kept in-house and which can be outsourced.

IP due diligence may include the following indicative steps:

Identify the areas of critical importance to your business

· Carefully assess business knowledge and determine whether transferring it outside the company or to a foreign location will compromise company practices

Identify and document all IP assets associated with the outsourced task

Determine ownership rights in the identified IP

• Please review third party or jointly owned intellectual property carefully

Identify existing or suspected breaches of contract, infringements, disclosure of confidential information, and trade secrets.

Assess how well the legal infrastructure in the foreign country will protect IP rights

Determine jurisdiction and compliance (applicable laws, their enforceability, dispute resolution mechanisms)

Define the termination, expiration or exit clause of the agreement

· Determine other responsibilities related to intellectual property, if applicable: ongoing maintenance and updates of intellectual property; payment of transfer fees; product liability, IP insurance, etc.

After performing the IP due diligence, the organization can proceed to the evaluation of the potential outsourcing partner. The results can be used during the negotiation of subcontracting agreements to solve any IP related problems that may arise.

Practical business negotiations should be started only after being satisfied with the vendor’s reputation, resources, and business culture compatibility. They should focus on the necessary steps to be taken by both parties to safeguard and ensure the proper use, sharing, licensing, development and enhancement of IP during and after the relationship. You must also include any relevant third-party IP assets.

Selection of the third-party provider in the context of IP-related issues

When outsourcing, the client organization should consider the potential partner’s ability to safeguard confidential information of business value against misappropriation, misuse, sabotage, loss or theft.

• Verify that the provider has a documented and enforceable information security management policy.
• Review the outsourcing provider’s data security and IP protection practices, as well as the processes they have in place to protect sensitive customer information.
• Check if additional security policies can be implemented to protect your sensitive data
• Provide the supplier with only the proprietary technology or the minimum data necessary to complete the project
• Insist on clear documentation of all your project source code as it becomes the property of your company and is legally protected
• Review physical security and personnel practices, policies, and procedures.
• Require a strict evaluation of human resources, look for employee retention figures
• Find out if the supplier does business with its competitors; if so, make sure there is no contact between the respective equipment
• Choose an established partner that complements your business strategy and understands how to implement the required level of security

Practical measures for the protection of intellectual property

Intellectual property is one of the company’s most valuable assets. This is especially true for SMEs and startups, where they may be the only tangible assets. The risks of failing to protect intellectual property are further increased when outsourcing comes into play. That is why client organizations must effectively deal with related issues and use all types of intellectual property protection: physical, electronic and legal.

Physical and electronic protection of intellectual property

• Treat data security as a requirement
• Limit the number of people who have access to complete information
• Make sure the third-party provider has a physically secure facility (mechanical and electronic access control, intrusion detection, video monitoring, etc.)
• Check if the offshore team uses computers without removable media to reduce the risk of unauthorized access to your IP
• Make sure internal employees understand what information can and cannot be shared
• Use firewalls, VPNs, encryption, and other measures to prevent security breaches in the electronic environment, which can lead to disruptions in supply chains.
• Protect important information, such as source code, with passwords and access codes, and ensure they are not widely available (both onsite and abroad)
• Always keep an original copy of the source code
• Make sure that the test data that is used does not reveal real information

Legal protection of intellectual property

Determine which country’s legal system will govern and have jurisdiction over contractual disputes

Work to understand the legal system and culture of both countries.

Find out how IP rights enforcement works in the provider’s country

Negotiate a clearly stated contract that specifically addresses business knowledge and IP related issues and hold the vendor accountable for the actions of their employees. This will ensure adequate protection, avoid disagreements and prevent litigation.

Clearly define compliance audit procedures before engaging in outsourcing relationships

Clarify licenses and ownership of source code

Consider open source software issues

• Enforcing individual privacy in the context of database protection obligations (if applicable)

Rely on non-disclosure and non-compete agreements with the vendor or their team members to keep vital business information confidential.

Define mechanism for possible dispute resolution and arbitration