What a dedicated developer contract should include

We are a software company, not a law firm. This checklist comes from a buyer’s point of view and is a way to prepare for a conversation with your lawyer, not a substitute for one. We have cited the official or published source wherever we mention the law, as read on 30 October 2026, but these summaries are simplified and may not fit your situation.

Many buyers assume that because they paid for the code, they own it. The law doesn’t necessarily work like that, and the supplier’s developers may be in another country, under another country’s law.

In the UK, the Intellectual Property Office’s guidance says the first owner of a commissioned work is the person or organisation that created it, and that the commissioner owns it only if the parties agree that in writing. Without that, a court may imply only a limited, non-exclusive licence. Employers are generally the first owners of what employees create, subject to agreement. Contractors usually keep copyright in what they produce.

If the assignment is governed by Indian law, look at section 19 of India’s Copyright Act 1957. It requires an assignment to be in writing and signed, and to identify the work, the rights, the duration and the territory. Two of its defaults are worth knowing: if the period isn’t stated, it’s deemed to be five years, and if the territory isn’t specified, it’s presumed to be India. Section 19(4) also says rights not exercised within a year can lapse unless the assignment provides otherwise. That text is on WIPO Lex, in a version that may not show later amendments, so have your lawyer check the current wording.

So look for wording that covers these points:

• an assignment of all rights in the work, stated to be worldwide and for the full term of copyright
• a statement that the lapse-for-non-use rule doesn’t apply, if Indian law is relevant
• the moment ownership transfers, such as on creation or on payment, and what happens to disputed invoices
• a chain of rights: the supplier must have secured these rights from its own employees and subcontractors
• open-source and third-party code: what may be included, and who keeps the list
• anything the supplier reuses from its own earlier work, and the licence you get to it

If the developers can reach personal data, even a copy of a production database, data protection applies. For UK organisations, the ICO says a written contract is required between a controller and a processor. It should set out the scope, purpose and duration of the processing and the types of data, and oblige the processor to act only on instructions, keep staff bound by confidentiality, apply suitable security, use sub-processors only with approval, help with individuals’ rights and breaches, delete or return data at the end, and allow audits.

The ICO’s international transfers guide uses a UK business giving an Indian service provider access to personal information as an example of a restricted transfer. Where no UK adequacy regulations cover the destination, you would normally rely on a safeguard such as the International Data Transfer Agreement or the Addendum, with a transfer risk assessment. EU buyers have their own equivalent rules. The simplest way to reduce this work is to keep real personal data away from development environments entirely.

The end of the contract is the part buyers think about least. Before you sign, imagine giving notice on a difficult day and walk through it. Who holds the repository? Who holds the cloud accounts, domain names and app store listings? What has been documented? How long will the outgoing team stay available, and at what rate? If the answers aren’t in the contract, they will be negotiated at the worst possible moment.

Two practical habits help more than any clause: keep source code, cloud accounts and domains in your own company’s name from day one, and ask for documentation as part of the work rather than as a final deliverable.

Make sure a dedicated team is the right model: our guide to dedicated teams and project outsourcing shows when a fixed scope is better. For budgeting, see the 2026 rates comparison, and for the day-to-day work once the contract is signed, see managing a remote team in India from the UK. To see what a long engagement looks like, read about the 14–15 developer team we ran for a Dubai technology company.