Terms and conditions for an IT support business

An IT support business is blamed for everything that stops working, whether or not it was ever asked to look after it. The terms have to define what is supported and to what service level, what response means as opposed to resolution, whose responsibility backups and security are, how third-party software and vendors are handled, and how a client leaves without a dispute over access. I draft those terms for a fixed fee of £995, delivered in five working days.

Who this is for

IT support companies, managed service providers and outsourced IT departments in England and Wales supporting small and medium businesses on monthly contracts, block hours and project work. These are business-to-business terms.

What matters in IT support terms

What is supported and what is not

The terms should define the supported environment by a schedule (sites, users, devices, systems), say that anything outside it is chargeable project or ad hoc work, and list the exclusions: hardware repair beyond diagnosis, software the client bought without consulting you, home equipment, and problems caused by the client's own changes. A schedule that is updated as the environment changes is what stops a support contract expanding without agreement.

Service levels, response and resolution

The terms should set response times by priority, make clear that a response target is a commitment to start work rather than a promise to fix, and say what happens when a target is missed: a service credit, not damages. Support hours, out-of-hours rates and how tickets are raised and prioritised should be stated. Resolution depends on the fault, the vendor and the client's cooperation, and the terms should say so.

Backups, security and the client's part

The terms should say who is responsible for backups, their testing and restoration, which security measures are included and which are the client's to buy, and that the client is responsible for its users' conduct, passwords and training. A security incident is not a breach of the terms unless it results from a failure to provide the services with reasonable care, and the terms should define what incident response is included and what is charged.

Third-party software, licences and vendors

Software, cloud services and hardware are supplied under their vendors' terms, and the terms should say that vendor outages, changes, end-of-life dates and licence conditions are outside your control, that licences are in the client's name where possible, and that you act as the client's agent in dealing with vendors. Where you resell subscriptions, the terms should say what happens to them on exit.

Fees, term, liability, data and exit

Monthly fees are invoiced in advance with interest and fixed compensation on late payment under the Late Payment of Commercial Debts (Interest) Act 1998 and a right to suspend. A minimum term and a notice period give the business stability. Liability should be capped at a figure matching your insurance, with data loss and consequential loss excluded save where caused by your negligence, tested for reasonableness under the Unfair Contract Terms Act 1977. You process personal data on the client's systems as a processor under the UK GDPR and the Data Protection Act 2018, and your access to those systems should be authorised in writing, since the Computer Misuse Act 1990 makes unauthorised access an offence. On exit, you hand over passwords, documentation and administrator access within a stated period and are paid for the handover.

What it costs

Customer or supplier terms and conditions, £995. One set of terms, customer-facing or supplier-facing, drafted for your business. Five working days.

Review of your existing terms, £495. You already have terms and want them checked and brought up to date. Returned marked up with my amendments and an explanation of the changes. Three working days.

Buying online forms the engagement on payment. The scope is what the terms and conditions drafting page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A full set of bespoke terms drafted for your business, reflecting the legal requirements that apply to your business and sector
• A note in plain English explaining the terms I have drafted for you
• Liability, payment, termination and IP provisions that protect your position and are drafted to withstand scrutiny from the other side
• Guidance on how to incorporate the terms properly
• Your questions and comments answered by email or phone
• One round of amendments to finalise the terms ready for use

What is not included

• Negotiating your terms with individual customers (I am happy to quote for this as an additional service if required)
• Sector-specific regulatory compliance beyond the contract terms themselves
• Website privacy notice and cookie compliance, which I quote separately
• Terms governed by the law of another country
• Tax advice

Questions I am often asked

The client was hit by ransomware and says it is our fault. Is it?

It depends on what the terms say you were responsible for. If backups and security were defined and the client declined the measures you recommended in writing, the loss falls on the client. If you were responsible for the backups and they were not taken, the exposure is yours, subject to the cap.

Can we refuse to release passwords until the final invoice is paid?

The terms should provide for handover on exit and for payment of a handover fee, and can make handover conditional on payment of undisputed invoices. Withholding access to a client's systems over a disputed invoice is a different matter and the terms should not try to authorise it.

The client keeps asking us to support software we did not recommend. Do we have to?

If the supported environment is defined in a schedule and the terms say that other software is supported on an ad hoc, chargeable basis at your discretion, you can decline or charge. Keep the schedule current.

Related guidance and services

• Terms and conditions drafting, £995, the service this page describes
• Contract review, £495
• Terms and conditions for a cybersecurity consultancy

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: September 2026. Email geoffrey@caesar.co.uk.