What is an outsourcing or sub-contracting agreement?
Is an outsourcing agreement enforceable in South Africa, and does section 197 apply?
“The section achieves its purpose by preserving all contracts of employment between the workers and the owner of the business which is transferred as a going concern. In this way, on the one hand, the workers’ employment is safeguarded and, on the other, a new owner is guaranteed a workforce to continue with the operation of the business. … [Section 197] applies to any transaction that transfers a business as a going concern. It follows that the majority in the Supreme Court of Appeal erred in holding that the section does not apply to second generation outsourcing agreements.”
“What is meant by ‘going concern’ is ‘a business in operation’ and whether transfer has occurred is a factual matter, to be determined objectively by reference to all relevant factors considered cumulatively, the list not being exhaustive and none of the factors being individually decisive: Nehawu.”
“If a transfer of a business takes place, unless otherwise agreed in terms of subsection (6)—(a) the new employer is automatically substituted in the place of the old employer in respect of all contracts of employment in existence immediately before the date of transfer; (b) all the rights and obligations between the old employer and an employee at the time of the transfer continue in force as if they had been rights and obligations between the new employer and the employee.”
“A responsible party must, in terms of a written contract between the responsible party and the operator, ensure that the operator which processes personal information for the responsible party establishes and maintains the security measures referred to in section 19. … An operator or anyone processing personal information on behalf of a responsible party or an operator, must—(a) process such information only with the knowledge or authorisation of the responsible party; and (b) treat personal information which comes to their knowledge as confidential and must not disclose it, unless required by law or in the course of the proper performance of their duties.”
When you need a Outsourcing & Sub-Contracting
- When you hand an entire ongoing function to a specialist provider — payroll, IT, security, cleaning, facilities, logistics, debt collection, or a call-centre — and need clear service levels, price, and an orderly exit.
- When a main contractor sub-contracts a defined portion of a project to another contractor (construction, engineering, software development, professional services) and needs the sub-contract terms to dovetail with the head contract.
- When the function you are outsourcing is currently performed by your own staff, so section 197 of the LRA may transfer those employees to the provider — the agreement must allocate that risk, cost, and indemnities openly.
- When the provider will access or process personal information of your clients, staff, or suppliers, triggering POPIA’s requirement for a written operator agreement with security and breach-notification obligations.
- When you take over a function from an incumbent provider (a second-generation transfer) and need clarity on whether their staff, assets, and liabilities come with the work under section 197.
- When you want to protect confidential information, trade secrets, IP, and data while a third party works inside your business — and to fix who owns what the provider creates.
What a Outsourcing & Sub-Contracting should contain
Scope of services and statement of work
Define exactly what the provider must do, the deliverables, and what is excluded. Outsourcing disputes usually start at the boundary of scope, so spell out the function, any phases or schedules, and a change-control process for adding or varying work — vague scope makes both the price and the service levels impossible to enforce.
Service levels (SLA) and remedies
Set measurable performance standards — availability, response and resolution times, quality, reporting — and the consequences of missing them, such as service credits, step-in rights, or termination triggers. An SLA without measurable targets and a remedy is decoration; the value is in defined metrics tied to real consequences.
Section 197 / employee-transfer allocation
Address head-on whether section 197 of the LRA applies so that staff transfer automatically with the function. Record each party’s view, who bears transferring employees’ costs and accrued liabilities (leave, bonuses, retirement, severance), warranties about the workforce, and indemnities — because you cannot simply write the transfer away, and getting it wrong can mean inheriting employees or facing an automatically unfair dismissal claim under section 187(1)(g).
POPIA operator clause and data protection
Where the provider processes personal information, include the written operator terms POPIA sections 20–21 require: process only on documented instruction, confidentiality, the security safeguards in section 19, immediate breach notification, sub-processor controls, cross-border transfer limits, and return or deletion of data on exit. The responsible party stays liable to the Information Regulator, so these duties must be contractual, not assumed.
Independent-contractor status and no employment
State that the provider acts as an independent contractor, controls its own staff, and that no employment relationship is created with the customer. This matters for tax, vicarious liability, and labour exposure — but the label is not conclusive; if the customer in fact controls the personnel like employees, courts and the CCMA can look past it.
Confidentiality, intellectual property and ownership
Protect confidential information and trade secrets disclosed during the engagement, and decide who owns IP the provider creates — newly developed software, designs, processes, or materials. Default common-law and Copyright Act positions may not give the customer ownership, so assign or licence deliverables expressly and deal with any pre-existing (background) IP.
Liability, indemnities and insurance
Allocate risk for the provider’s defaults, third-party claims, data breaches, and personal injury or property damage on site. Cap liability where commercially appropriate, carve out POPIA, confidentiality and IP infringement where needed, and require the provider to hold suitable insurance — a one-sided or unlimited liability clause is a common source of unenforceable over-reach.
Term, termination and exit / transition assistance
Set the duration, renewal, and termination rights (for breach, insolvency, or convenience), and — critically for outsourcing — an exit plan: cooperation on hand-back or migration to a new provider, return of data, records and assets, knowledge transfer, and how section 197 is handled on the way out. Weak exit terms trap a customer with an underperforming provider.
Sub-contracting and assignment controls
Control whether the provider may sub-contract or assign the work, and on what conditions. Outsourced functions are often delivered through a chain of sub-contractors; without consent and flow-down obligations (confidentiality, POPIA, service standards), you lose visibility of who is actually performing — and processing your data — and your remedies become hard to trace.
Outsourcing / sub-contracting vs employment vs a once-off supply contract
| Feature | Outsourcing / sub-contracting | Employment contract | Once-off supply / service contract |
|---|---|---|---|
| Relationship | Independent contractor performing an ongoing function or project slice | Employee under the employer’s control | Supplier delivering a defined product or single service |
| Who controls the work | Provider controls its own methods and staff | Employer directs how, when and where | Supplier delivers to spec; limited ongoing control |
| Section 197 LRA | May trigger automatic staff transfer if a going concern moves | Not applicable directly — the relationship being protected | Rarely — usually no business transfers |
| POPIA role | Often an operator → written operator agreement required | Employer is responsible party for staff data | Depends on whether personal information is processed |
| Typical use | IT, payroll, security, cleaning, logistics, construction sub-contracts | Hiring a person into your business | Buying goods or a discrete, finite service |
Common South African pitfalls
- Assuming you can “contract out” of section 197: writing “no employees transfer” does not decide the question. Whether a going concern transfers is judged objectively on the facts, so an unprepared customer can inherit a workforce — with accrued leave, service, and liabilities — or trigger an automatically unfair dismissal claim under section 187(1)(g) of the LRA.
- Ignoring second-generation transfers: section 197 can bite when an outsourcing contract ends and the function returns in-house or moves to a new provider, as Aviation Union v SAA confirmed. A business taking over from an incumbent must check whether the previous provider’s staff and obligations come with the work.
- No written POPIA operator agreement: if the provider processes personal information, POPIA sections 20–21 require a written contract with security and breach-notification duties. Skipping it leaves the responsible party exposed to the Information Regulator even though the breach happened on the provider’s side.
- Service levels with no teeth: an SLA that lists aspirations but no measurable targets or remedies (service credits, step-in, termination) gives you nothing to enforce when the provider underperforms. Vague performance language is one of the most common — and costly — drafting failures.
- Leaving IP and exit unaddressed: failing to assign ownership of what the provider creates, and failing to plan the hand-back of data, records, and know-how on termination, can trap a customer with an underperforming provider and leave the customer’s own deliverables owned by someone else.
- Uncontrolled sub-contracting: if the provider can freely sub-contract without flow-down confidentiality, POPIA, and service obligations, your data and your work end up with parties you have no contract with — and no practical remedy against.
Frequently asked questions
Is an outsourcing or sub-contracting agreement legally binding in South Africa?
Yes. It is enforceable as an ordinary contract once it meets the requirements of agreement, lawful purpose, certainty, and possibility of performance, and is not contrary to public policy. There is no dedicated outsourcing statute — but section 197 of the Labour Relations Act and POPIA can impose additional, mandatory obligations on top of the contract.
Does section 197 of the LRA automatically transfer staff when I outsource?
It can. Section 197 transfers employees automatically to the new employer when a business, or part of one, is transferred “as a going concern”. Whether your outsourcing amounts to a going-concern transfer is decided objectively on the facts — you cannot avoid it by simply stating in the contract that no employees transfer.
What is a “going concern” transfer for section 197?
It is the transfer of a discrete, recognisable business or part of a business — with its people, assets, or infrastructure — that in fact passes from one party to another and remains recognisable as that going concern afterwards. Outsourcing a whole function (even mainly people-based, like security or cleaning) can qualify; merely ending a service usually does not.
Does section 197 apply when I switch from one outsourcing provider to another?
It may. In Aviation Union of South Africa v SAA [2011] ZACC 31, the Constitutional Court held that section 197 can apply to “second-generation” transfers — where an outsourcing contract ends and the function returns in-house or moves to a new provider — provided what moves is a going concern. A business taking over from an incumbent should check whether staff and liabilities come with it.
Do I need a POPIA operator agreement with my service provider?
Yes, where the provider processes personal information on your behalf. POPIA sections 20–21 require a written contract obliging the operator to process data only on your instruction, keep it confidential, maintain security safeguards, and notify you of breaches. You remain the responsible party and stay liable to the Information Regulator for compliance.
What is the difference between outsourcing and sub-contracting?
Outsourcing usually means handing a whole function (such as IT or payroll) to an external specialist to run on an ongoing basis. Sub-contracting usually means a main contractor passing a defined slice of its own contracted work down to another contractor. Legally both create an independent-contractor relationship and raise similar section 197, POPIA, IP, and SLA issues.
Can I be sure my provider is treated as an independent contractor, not an employee?
Stating independent-contractor status helps, but the label is not conclusive. If the customer in fact controls the personnel like employees — dictating hours, methods, and supervision — the CCMA or a court can look past the label. Genuine outsourcing leaves the provider in control of how the work is done and of its own staff.
What happens to my data and deliverables when the contract ends?
Only what the agreement provides for — which is why exit terms matter. A well-drafted outsourcing agreement requires the provider to return or delete personal information (as POPIA requires), hand back records and assets, assist with transition to a new provider, and confirm who owns the IP created. Without these, a customer can be trapped or lose access to its own work.
Sources & authority
- Aviation Union of South Africa and Another v SAA (Pty) Ltd and Others (CCT 08/11) [2011] ZACC 31; 2012 (1) SA 321 (CC); [2012] 3 BLLR 211 (CC) (24 November 2011)
- South African Airways (Pty) Ltd v Aviation Union of South Africa and Others (123/2010) [2011] ZASCA 1; 2011 (3) SA 148 (SCA) (11 January 2011)
- Labour Relations Act 66 of 1995, s 197
- Protection of Personal Information Act 4 of 2013, ss 19–21
This guide is general information, not legal advice. It reflects the law as at June 2026.