Outsourcing risks: the data security questions to ask first

Ask a finance director what worries them about outsourcing and they rarely say cost. They say: who exactly will be able to see our data, and what happens if something goes wrong.

Those are the right worries. Here are the outsourcing risks that actually materialise, and the questions that separate a provider who has thought about them from one who has not.

The 4 outsourcing risks that actually bite

Uncontrolled access. Someone you have never met holds a login to your accounting system on a personal laptop. Nothing has gone wrong yet, and you have no way to see whether it has.

Continuity. The person who knows your month-end process stops replying. There is no employer behind them, no notice period and no handover.

Accountability. When a mistake costs money, you discover the contract was with an individual overseas and there is nothing practical to enforce.

Quality drift. Work is accepted because nobody has time to check it, until a client or an auditor checks it for you.

Notice that only the first is a security risk in the technical sense. Most outsourcing failures are employment and management failures that look like security failures afterwards.

8 questions to ask any provider

• Who legally employs the person doing our work, and in which country?
• Where do they physically work, and is that location supervised?
• Whose device do they use, and who controls it?
• How will they reach our systems, and who grants and removes that access?
• What have they signed on confidentiality and intellectual property?
• What background checks were run before they joined?
• Who is accountable if data is mishandled, and what does the contract say?
• What happens to our data and accounts when the engagement ends?

A provider who answers all 8 in writing is describing a system. A provider who answers vaguely is describing a hope.

How the answers should look

Keep the data on your side

The single most effective control costs nothing: give access through your own systems. Create the user in your accounting software, your CRM, your helpdesk. Grant the permissions the role needs and no more. Review them quarterly, and revoke on the last day.

When access lives in your environment, the data never leaves it, you keep the audit trail, and offboarding takes 5 minutes rather than a series of emails.

The compliance layer

For Canadian businesses, PIPEDA expects you to protect personal information you are responsible for, including when a third party processes it on your behalf. Sending work offshore does not transfer that responsibility. It stays with you, which is why the contract and the controls matter.

India has its own framework in the Digital Personal Data Protection Act, 2023, with rules being phased in. A provider operating there should be able to tell you how they handle personal data, not simply assert that they do.

Bumsa is a Canadian-owned company headquartered in Toronto, so your commercial relationship sits in Canada even though delivery is in Chennai.

What good looks like day to day

• staff in a supervised office on company-managed devices
• confidentiality and IP assignment signed as part of employment, not bolted on later
• background checks completed before the first day
• least-privilege access in your systems, reviewed on a schedule
• a named point of contact in your own time zone when something needs escalating
• a written offboarding process covering accounts, devices and data

Who sees what: a worked example

Say you move accounts payable offshore. The team member needs to enter bills, match them to purchase orders and prepare a payment run. They do not need to release payments, change bank details or export your full customer list.

So you create them a user in your own accounting system with entry and matching rights, no payment release and no master-data edits. Bank detail changes route to someone in your office with a call-back check. The payment run is prepared offshore and approved by you.

Nothing in that arrangement depends on trusting an individual. It depends on the permissions you set, which is the point.

A 20-minute access review

Most access problems are not breaches. They are accounts nobody closed. Put 20 minutes in the calendar once a quarter and work through 4 lists:

• every system your offshore team can reach, and who exactly holds a login
• permissions inside each one: can they view, edit, export or delete?
• accounts belonging to people who have left, anywhere in the business
• shared logins, which should not exist and usually do

Fix what the review surfaces the same day. This single habit removes more real risk than any clause in a contract.

If something does go wrong

Decide now, in writing, what happens when it does. Who do you call, in which time zone, and how fast do they answer? Can access be cut immediately, or does it take an email to someone’s manager? Who tells your client, and who is liable under the contract?

Agreeing that in week 1 takes half an hour. Agreeing it during an incident takes days you will not have.

The risk of doing nothing

It is worth weighing the other side. Understaffed teams miss filings, delay invoicing and burn out the people you already have. Those are risks too, and they are more likely to show up this quarter than a data breach is.

The goal is not zero risk. It is a structure where the risks are visible and someone is accountable for them.

This article is general information, not legal advice.

FAQ’s