IT Services Agreement Spain (Contrato de Prestación de Servicios IT)

An IT Services Agreement Spain (Contrato de Prestación de Servicios de Tecnología de la Información) is a commercial services contract governed principally by Article 1544 of the Código Civil español (arrendamiento de servicios and arrendamiento de obra) and, for services delivered electronically, by Ley 34/2002, de 11 de julio, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE), by which an IT services provider (prestador de servicios IT) agrees to deliver defined technology services to a client (cliente) in exchange for a fee. The scope of IT services agreements in Spain covers: custom software development (desarrollo de software a medida); system integration (integración de sistemas); application maintenance and support (mantenimiento y soporte de aplicaciones); managed IT infrastructure services (servicios gestionados de infraestructura TI); cloud computing services (servicios cloud — SaaS, PaaS, IaaS); cybersecurity services (servicios de ciberseguridad); IT consulting and advisory services (consultoría y asesoramiento tecnológico); and technology project management (dirección de proyectos tecnológicos).

The Código Civil distinguishes the arrendamiento de servicios (service engagement) — where the provider commits to perform services with professional diligence (obligación de medios) without guaranteeing a specific outcome — from the arrendamiento de obra (works contract) — where the provider commits to deliver a specific result or deliverable (obligación de resultado). Custom software development typically constitutes an arrendamiento de obra under Article 1544 CC, since the provider is obligated to deliver a working software product meeting the agreed specifications. Ongoing managed services and support contracts are typically arrendamientos de servicios. This distinction is relevant to the remedies available for breach — under an obligación de resultado, the client has stronger rights to demand delivery or claim damages for non-delivery.

Intellectual property ownership of software and technology deliverables is governed by the Real Decreto Legislativo 1/1996, de 12 de abril, por el que se aprueba el Texto Refundido de la Ley de Propiedad Intelectual (LPI). Under Article 97 LPI, copyright in a computer program (programa de ordenador) created by an employee in the course of their employment vests automatically in the employer. For software developed under a services agreement by an independent provider, ownership depends on the contract terms — without an explicit assignment clause, the provider retains the intellectual property and merely licences the software to the client under Article 43 LPI. Clients commissioning bespoke software should insist on an explicit full assignment (cesión en exclusiva de todos los derechos patrimoniales) of the intellectual property in the deliverables under Articles 43 and 97 LPI, covering the rights of reproduction, distribution, public communication, and transformation.

Data protection obligations under Reglamento (UE) 2016/679 (RGPD) and Ley Orgánica 3/2018 (LOPDGDD) are central to Spanish IT services agreements. Where the provider processes personal data on behalf of the client in the course of delivering IT services — accessing databases, managing CRM systems, hosting applications processing personal data — the provider is an encargado del tratamiento (data processor) under Article 28 RGPD, and a mandatory Acuerdo de Encargo del Tratamiento (data processing agreement — DPA) must form part of the IT services contract. The Agencia Española de Protección de Datos (AEPD) has published specific guidance (Guías AEPD) on data processing in IT services and cloud computing contexts.

The Ley 34/2002 de Servicios de la Sociedad de la Información (LSSI-CE) governs IT providers who operate as online service providers — cloud platforms, SaaS applications, online marketplaces — imposing registration requirements, information transparency obligations (nombre, denominación social, NIF, domicilio), and contracting requirements for electronic service agreements. The Ley 6/2020, de 11 de noviembre, reguladora de determinados aspectos de los servicios electrónicos de confianza, implements eIDAS (Regulation (EU) 910/2014) in Spain for qualified electronic signatures (firmas electrónicas cualificadas) and trust services used in IT service delivery.

Cybersecurity obligations applicable to IT service providers in Spain include the Esquema Nacional de Seguridad (ENS — Real Decreto 311/2022) for providers serving public administrations, the NIS2 Directive (Directive (EU) 2022/2555) implemented through Royal Decree ..../2024 for providers of essential and important services, and sector-specific requirements from the Banco de España, CNMV, and DGSFP for IT providers serving financial institutions.

An IT Services Agreement Spain is needed whenever a company, public body, or individual engages a technology service provider to deliver software development, IT support, infrastructure management, or any other defined technology service with a commercial scope, ongoing obligations, or access to sensitive data.

A formal IT services contract is needed when a company commissions the development of bespoke software — a web application, mobile app, ERP system integration, or custom database solution. The agreement must address deliverables, acceptance testing procedures, intellectual property assignment, and liability for software defects and security vulnerabilities.

The contract is needed when a company engages an IT managed services provider (MSP) for ongoing infrastructure management — cloud hosting, server administration, network monitoring, backup and recovery — with defined service levels (SLAs) for availability, response time, and incident resolution.

An IT services agreement is needed when a company engages a cybersecurity firm for penetration testing (tests de penetración or pentesting), security audits, vulnerability assessments, or Security Operations Centre (SOC) monitoring services. The agreement must address the scope of testing authorisation, data confidentiality obligations, responsible disclosure procedures, and compliance with the Esquema Nacional de Seguridad (ENS).

The contract is needed when a SaaS (Software as a Service) provider delivers a subscription-based cloud application to Spanish business clients — the agreement must address data residency (within EU/EEA for RGPD compliance), data processing terms under Article 28 RGPD, SLAs for platform availability, and the client's data portability and deletion rights under Articles 20 and 17 RGPD.

An IT services agreement is needed when a company engages IT consultants for technology strategy, digital transformation advisory, ERP implementation (SAP, Oracle), or IT project management — the agreement must define the consultant's obligations (whether obligación de medios or obligación de resultado), the deliverables (informes, análisis, recomendaciones), and the ownership of any methodology or tools used.

The contract is required when an SME (pequeña y mediana empresa) engages an external IT support provider under a retainer arrangement (contrato de mantenimiento IT) for helpdesk services, hardware maintenance, software updates, and network support — defining response times, on-site support obligations, and exclusivity provisions if the provider is the sole IT support contact.

The agreement is also needed when a public body (Administración Pública) contracts IT services subject to Ley 9/2017 de Contratos del Sector Público (LCSP) procurement rules, requiring a formal service contract with defined technical specifications, service levels, and compliance with the Esquema Nacional de Seguridad (ENS) mandatory certification for systems handling public data.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.

A valid IT Services Agreement Spain under Código Civil Article 1544, Ley 34/2002 (LSSI), Real Decreto Legislativo 1/1996 (LPI), and RGPD must contain the following essential elements to protect both the client and the service provider and to comply with applicable intellectual property, data protection, and commercial obligations.

Identification of Parties: Full legal name, NIF/CIF, registered address, and Registro Mercantil entry details of both the cliente and the prestador de servicios IT. Both parties' contact details for formal communications and for RGPD data protection inquiries. The service provider's professional indemnity insurance (seguro de responsabilidad civil profesional) details should be stated.

Scope of Services: A precise description of all IT services to be delivered — including specific deliverables (entregables), milestones, functional specifications (especificaciones funcionales), technical requirements, excluded services, and any transition or onboarding services. For software development, a technical specification document (documento de especificaciones técnicas) or product requirements document (PRD) should be incorporated by reference. The agreement should specify whether the obligation is one of means (obligación de medios) or result (obligación de resultado) — this determines the standard of performance and the remedies for non-delivery.

Project Timeline and Milestones: For project-based services (software development, system implementation), agreed start dates, milestone delivery dates, and overall project completion date. A Gantt chart or project plan may be incorporated by reference. Provisions for change requests (gestión de cambios) — how scope changes are agreed, documented, and priced — are essential for software development projects.

Service Levels (SLA): For ongoing managed services and support agreements, measurable SLA parameters — system availability (% uptime), incident response times categorised by severity level, resolution times, and escalation procedures. SLA credits (créditos de servicio) for SLA breaches, calculated as a percentage of the monthly service fee. Measurement methodology, reporting frequency, and the parties' rights to audit SLA compliance.

Intellectual Property: An explicit and thorough intellectual property clause addressing ownership of all technology deliverables — software, code, documentation, databases, and works created in the execution of the agreement. For bespoke development: a full assignment (cesión plena y exclusiva de todos los derechos patrimoniales de propiedad intelectual) of copyright in the deliverables under Articles 43 and 97 of Real Decreto Legislativo 1/1996 (LPI), covering reproduction, distribution, transformation, and public communication rights. For off-the-shelf or SaaS products: the scope and terms of the licence granted to the client — exclusive or non-exclusive, territorial scope, duration, permitted uses, and sublicensing rights. The provider's obligations to warrant that the deliverables do not infringe third-party intellectual property rights under Ley 20/2003 de Protección Jurídica del Diseño Industrial or other IP laws.

Data Protection: A mandatory Acuerdo de Encargo del Tratamiento (Article 28 RGPD data processing agreement) if the provider processes personal data on behalf of the client — specifying: categories of data processed, processing purposes, security measures (Article 32 RGPD), sub-processor restrictions, data breach notification obligations (72-hour notification to the AEPD under Article 33 RGPD), and data deletion or return upon contract termination. For international data transfers outside the EEA, Standard Contractual Clauses (SCCs) adopted by the European Commission under Article 46 RGPD must be incorporated.

Confidentiality: Reciprocal confidentiality obligations for all proprietary information, business data, technical specifications, source code, and personal data accessed during the engagement — governed by Ley 1/2019 de Secretos Empresariales (implementing Directive (EU) 2016/943). Duration of post-termination confidentiality obligations.

Payment: The agreed fee structure — fixed price (precio fijo), time-and-materials (tiempo y materiales), monthly retainer (cuota mensual), or milestone-based payments — invoicing frequency, payment terms, and late payment provisions under Ley 3/2004 de lucha contra la morosidad. IVA at 21% applies to IT services under Ley 37/1992 del IVA.

Liability and Indemnification: The service provider's limitations of liability (limitación de responsabilidad) — typically capping total liability at 12 months' fees paid. Exclusions of consequential and indirect damages (daños indirectos, lucro cesante) under Article 1103 CC, subject to mandatory liability that cannot be excluded under Spanish law. The provider's indemnification obligations for intellectual property infringement and data breach events.

Forms-legal.com provides this IT Services Agreement Spain template as a starting framework for technology service engagements. Complex software development projects, AI system agreements, and managed services involving critical infrastructure or financial data require review by a qualified abogado especializado in derecho tecnológico, propiedad intelectual, and protección de datos to confirm full compliance with RGPD, Ley 1/2019 de Secretos Empresariales, LPI, and LSSI.

Under the Ley de Sociedades de Capital (LSC) RDL 1/2010, the Registro Mercantil maintains the register of Spanish companies. The Código de Comercio 1885 governs commercial obligations. The Agencia Estatal de Administración Tributaria (AEAT) administers Impuesto sobre Sociedades (IS) under Ley 27/2014. The Comisión Nacional de los Mercados y la Competencia (CNMC) enforces competition law. The Código Civil governs general contractual obligations under Article 1255.