Subcontracting clause review checklist

Hello, this is Legal Agent.

Clients reviewing service agreements often ask to ban subcontracting entirely. While understandable, flat prohibitions rarely match operational reality: most vendors rely on cloud providers, freelancers, or group companies to deliver work. Using services covered by an unadjusted prohibition without required consent can create ongoing defaults. Whether an external tool counts as subcontracting depends on the agreed contractual definition and actual use.

Scope and definitions of subcontracting

Standard clauses bar subcontracting work without prior written consent, but the exact scope needs clear definition: does it include routine cloud tools, group company support, or only delegating the core engagement? An overly broad definition forces everyday tools to require formal approval each time, while an overly narrow definition lets key participants operate without client visibility. Once defined, approval can be tiered: written consent for sensitive tasks, advance notice for routine matters, and blanket approval for established partners, subject to any mandatory statutory consent requirements.

Subcontractor commitments and liability allocation

Subcontracting arrangements should require the third party to undertake confidentiality, data-protection, and security duties equivalent to the vendor's own, with enough information for the client to assess the subcontractor. Contracts should specify whether the vendor answers for subcontractor breaches as its own acts, whether the client can claim directly against the subcontractor, and whether related liability sits within or outside liability caps. Subsequent tiers of sub-subcontracting require the same contractual controls.

Data protection, security vetting, and statutory compliance

Where personal data is involved, clients need clear rights to check subcontractor access controls, hosting locations, and incident-notification deadlines, especially when cross-border vendors or cloud services are used. The Toriteki Act took effect on 1 January 2026 through amendments to the former Subcontract Act. Its application must be checked at each contracting level, including the relevant transaction type and capital or employee thresholds. Where it applies, payment terms, order specifications, and cost allocation must comply with its requirements.