Checkpoints for Reviewing Subcontracting Clauses: Organizing the Risks for the Client and the Contractor

Hello, I'm Noriaki Asato, Representative Attorney at LegalAgent.

When reviewing service agreements and system development contracts, I often hear clients say, "We want to prohibit subcontracting across the board." The client's concerns are understandable, but simply writing a prohibition into the contract cannot in reality fully prevent the involvement of third parties. Few contractors can complete their work without relying on cloud infrastructure, external tools, specialist freelancers or group companies, and if the wording of the contract diverges from reality, it becomes a cause of contract breaches being routinely left unaddressed.

From the client's perspective, having work and data handled by third parties it knows nothing about is itself a potential threat. If management is lax as confidential information, personal information or source code passes to subcontractors, tracing what happened becomes difficult when an incident occurs. From the contractor's perspective, on the other hand, if subcontracting is excessively restricted in development or operations work that presupposes the use of outside personnel, this leads to delivery delays and lower quality. In a subcontracting clause, the parties consider terms that reconcile the client's control with the contractor's operating structure.

The Definition and Scope of Subcontracting

In subcontracting clauses, wording such as "the contractor shall not subcontract all or part of the services to a third party without the prior written consent of the other party" is widely used. What should be checked here is how far "entrustment to a third party" extends. The burden of operating the clause changes greatly depending on whether contractual subcontracting includes not only cases where the work is passed wholesale to a subcontractor, but also outsourcing part of specialist work, partial entrustment to group companies, and even the use of SaaS and cloud services.

Whether the use of the cloud constitutes subcontracting under the contract is determined from the definition and the actual use. The line is drawn according to the reality, such as whether the provider is actually involved in the work and whether it handles personal data. If the definition is too broad, even the use of everyday tools requires individual consent, and the consent procedure can become a burden on the work. Conversely, if the definition is too narrow, outside parties that the client should be aware of slip through the net of control.

Types of Consent Mechanisms and Control over Further Subcontracting

After clarifying the definition of subcontracting, the parties design the consent mechanism. For the appointment of a sub-mandatary in a quasi-mandate, the applicable laws and contract terms are checked, such as the requirement under Articles 644-2 and 656 of the Civil Code for permission or unavoidable circumstances. On that basis, it is practical to choose, according to the nature of the work and the sensitivity of the information, whether to require prior written consent each time, whether prior notice is sufficient, or whether to allow comprehensive consent for pre-designated partner companies and minor auxiliary work. However, it should be kept in mind that where the law prescribes the client's permission, contractual notice alone cannot substitute for that requirement. For example, in the subcontracting of individual number usage operations or individual number-related operations, the My Number Act requires the permission of the original client, including for further subcontracting at every level.

Control over "further subcontracting," where a subcontractor in turn entrusts work to an outside party, must not be overlooked either. The more layers of contractors there are, the harder it is for the client to keep watch. The parties should settle, using the same criteria as for the first level of subcontracting, whether to prohibit further subcontracting across the board, allow it subject to prior consent, or make an exception only for certain infrastructure cloud services.

Imposing Obligations on Subcontractors and Where Liability Lies

As a prerequisite for permitting subcontracting, the parties agree that the contractor will impose the necessary confidentiality obligations, personal information protection obligations and information security obligations on the subcontractor as well. Rather than simply writing that "the contractor shall impose equivalent obligations," effectiveness is increased, for work involving important systems or personal data, by requiring the contractor to enter into a contract with the subcontractor and to keep evidence of its management. The parties should also provide for the supply of information sufficient for the client to make a decision, such as the subcontractor's name and location, the work it handles and the scope of information it deals with.

The allocation of liability where a subcontractor causes loss should also be confirmed. The parties agree whether the contractor bears the same liability as for its own acts, and whether the liability cap on damages and the exclusion of indirect losses also apply to incidents caused by subcontractors. Whether the client can claim directly against the subcontractor is checked individually based on the contract and the legal basis. Claims against the contractor are distinguished from the contractor's recourse against the subcontractor. On the contractor's side, care is taken to ensure that the exceptions to the liability cap do not become excessively broad. Where the contractor takes on an indemnity that includes third-party claims, it also checks whether it can set out corresponding obligations and indemnities in its contract with the subcontractor.

Information Management and Legal Compliance in Practice

In work involving personal information or trade secrets, the parties check the subcontractor's access rights, device and account management, and log retention. The storage location and the deadline for reporting incidents should be specified. Where the subcontractor is located overseas or uses cloud infrastructure based overseas, it is also necessary to look at the local legal system, the cross-border transfer rules for data protection and the conditions in the terms of use. The parties should provide for regularly updating the list of contractors and for a procedure allowing the client to inspect the state of management. A cloud service that does not handle personal data may not constitute entrustment under the Act on the Protection of Personal Information (APPI), but the need to check security management remains. The requirements for provision where a business operator located in a foreign country handles personal data are also checked separately from the supervision of contractors.

In addition, attention must also be paid to the Act on Ensuring Proper Transactions with Small and Medium-sized Entrustees (commonly called the Torihiki Tekiseika Act), which came into force on January 1, 2026. It amends the previous framework, and amid growing awareness of practical measures to make entrustment transactions fairer, although not every subcontracting transaction is automatically covered, the parties check its application according to the capital or number of employees of the parties at each stage of the transaction and the type of transaction. The appropriateness of the transaction as a whole is assessed, including whether a clear document setting out the details of the order is delivered, the payment terms for compensation, and whether there is any unjust shifting of burdens.

On the contractor's side, the first step is to check whether its own development and operations structure contradicts the wording of the contract. If it continues to use outside resources that are prohibited under the contract without the necessary consent, it could be held liable for breach of obligations, so a realistic means of self-protection is to specify the necessary subcontractors when the contract is signed and obtain comprehensive consent. The scope of support when requesting ongoing contract review, including subcontracting clauses, is described in Legal Outsourcing.