IT Support Agreement (New Zealand)

A New Zealand IT Support Agreement should comprehensively define the scope of IT support services, the service level commitments, the pricing structure, and the parties' respective obligations. Key provisions include: the scope of covered services and equipment (help desk support, on-site support, server management, network monitoring, software support, hardware procurement); service level agreements (SLAs) specifying response times for different priority levels (e.g., P1 critical: 1 hour, P2 high: 4 hours, P3 medium: 8 hours); the hours of support coverage (business hours, 24/7, or hybrid); escalation procedures; patch management and software update obligations; data backup procedures and recovery time objectives; cybersecurity obligations including antivirus, firewall management, and security monitoring; the client's obligations (maintaining accurate hardware/software inventory, providing access, notifying the provider of incidents); and the fee structure (monthly managed services fee, hourly break-fix rates, travel charges). The agreement must comply with the Privacy Act 2020 because IT providers handle personal information about the client's staff and customers.

A Service Level Agreement (SLA) in a New Zealand IT Support Agreement defines the minimum performance standards the IT provider must meet, particularly in relation to response and resolution times for support requests. SLAs are important because they give the client certainty about how quickly issues will be addressed and provide a basis for remedies if the provider fails to meet the agreed standards. A typical New Zealand IT SLA defines: response time (how quickly the provider will acknowledge a support request, often measured from ticket creation); time to first response (how quickly a technician will begin working on the issue); resolution time (the target time by which the issue should be resolved); priority levels (categorising issues by business impact — critical system outage vs minor user issue); and the remedies for SLA breaches (service credits, price reductions, or in severe cases, termination rights). SLA credits are typically modest — for example, a percentage of the monthly fee for each hour of delay beyond the SLA target — and should be specified in the agreement. Clients should require that SLA provisions are commercially meaningful and not effectively nullified by broad force majeure or exclusion clauses.

IT support providers in New Zealand are typically 'agencies' under the Privacy Act 2020 because they collect and hold personal information about the client's staff and customers in the course of providing IT services. Key obligations include: collecting personal information only for a lawful purpose connected with the provider's IT support functions (IPP 1); not collecting more information than is necessary (IPP 1); storing personal information securely with appropriate technical safeguards (IPP 5); not disclosing personal information to third parties without authorisation (IPP 11); and notifying the client (and potentially the Privacy Commissioner) of a privacy breach that may cause serious harm. The IT Support Agreement should include a data processing addendum that: defines the categories of personal information to which the provider may have access; restricts the provider's use of personal information to providing the services; requires the provider to maintain appropriate security measures; specifies the provider's obligations on termination (returning or deleting personal data); and allocates liability for Privacy Act 2020 breaches. New Zealand businesses that receive IT services from offshore providers should also consider whether the Privacy Act 2020's cross-border transfer requirements apply.

Liability limitation is a critical issue in New Zealand IT Support Agreements because IT failures can cause significant business losses — a server outage, data loss, or security breach can have consequences far exceeding the value of the support contract. IT providers typically seek to limit their liability to the amount of fees paid in the preceding 12 months (or sometimes 3 months), and to exclude liability for consequential losses such as lost profits, lost data, and business interruption. Under the Contract and Commercial Law Act 2017 (CCLA), limitation and exclusion clauses are enforceable in B2B contracts if clearly expressed. However, under the Consumer Guarantees Act 1993, liability cannot be limited for services provided to consumers — this applies where a small business owner engages an IT provider as a consumer. Parties should also consider: professional indemnity insurance (the IT provider should hold adequate PI cover for negligent advice or errors); whether data loss is covered by the limitation clause (some agreements carve out liability for data loss caused by the provider's negligence); and whether cyber liability insurance is held to cover costs arising from security breaches. Clients should negotiate limitation clauses carefully and requires the IT provider's insurance coverage is adequate for the risks being managed.

A IT Support Agreement (New Zealand) does not legally require a lawyer in New Zealand, and individuals and businesses may draft and execute the document independently. The Companies Act 1993 does not mandate legal representation for the creation or signing of this type of document. However, seeking independent legal advice from a qualified New Zealand lawyer is recommended for transactions involving substantial financial value, complex regulatory requirements, or cross-border elements where multiple legal jurisdictions may apply. A lawyer can verify that the document complies with all applicable statutory requirements, identify potential risks specific to the transaction, and confirm that the terms adequately protect the interests of all parties involved. The High Court of New Zealand has jurisdiction over disputes arising from this type of document, and Companies Office may impose additional compliance obligations depending on the nature of the underlying transaction. Professional legal review is particularly advisable where the document will be submitted to government agencies or used as evidence in legal proceedings.