SERVING A SMALL MARKET
Outsourcing the work does not outsource the responsibility
When a company outsources customer service, it may know the name of its immediate contractor without knowing who ultimately handles its customers’ enquiries.
Know who performs the work
Consider a hypothetical arrangement: a service provider in one European country subcontracts to another, which in turn engages a company outside Europe. Several contractual relationships later, the person answering a customer’s question may work for an organisation the original client has never dealt with directly.
This arrangement is not necessarily unlawful. But it raises important questions. Who employs the person handling the enquiry? Which employment protections apply? Who supervises their work? Who has access to customer information? And what happens when something goes wrong?
Different obligations have different scopes
EU rules on posted workers include subcontracting-liability provisions, particularly for construction. Iceland’s public procurement legislation also contains chain-liability rules protecting workers. These are specific legal contexts, not a single rule making every outsourcing client liable for every subcontractor’s employment obligations.
Data protection adds another dimension. Where the GDPR applies and a provider processes personal data on a client’s behalf, the controller must use processors offering sufficient guarantees. Engaging a subprocessor requires prior specific or general written authorisation. The initial processor remains liable to the controller for the subprocessor’s data-protection obligations. European Data Protection Board guidance says controllers should have the identities of processors and subprocessors readily available throughout the chain.
Make accountability visible
For businesses choosing an outsourcing partner, intermediaries can affect transparency, oversight and the ability to demonstrate compliance. A shorter chain may be easier to understand, but its length alone proves neither lawful employment nor sound data protection.
Our practical recommendation is to document who performs the work, how they are engaged, who supervises them and what information they can access. Agree how changes to that arrangement are disclosed and who takes responsibility when an enquiry, employment concern or data incident needs attention.
A PRACTICAL TAKEAWAY
The question is not simply who answers the customer. It is whether the business knows who stands behind that answer.
Context and limits
This is a general overview, not advice on a particular contract. The applicable duties depend on the work, jurisdiction and actual data-processing roles. International transfers may require additional safeguards; outsourcing does not automatically remove either party’s obligations.