TL;DR
- Four different arrangements get called outsourcing: business process outsourcing, where a supplier runs a process for you; shared services, which is internal centralisation and not outsourcing at all; employer of record, where the provider is the legal employer; and employee leasing, which in the UK is usually agency work.
- Data protection responsibility does not move with the work. The ICO states that controllers are primarily responsible for overall compliance with the UK GDPR, and a written contract with required terms has to be in place before a processor touches employee data.
- Outsourcing a service can be a TUPE transfer, which brings duties to inform and consult and carries employees' terms across. The test of a sound decision is whether you could bring the process back.
Four quite different arrangements arrive in the same sentence. A supplier offers to run your payroll. A consultant suggests consolidating HR administration into one internal team. A provider offers to employ your new engineer in Spain. An agency offers to supply twelve warehouse staff for the winter. Only the first is BPO outsourcing, and the duties that follow are different in each case.
This article separates the arrangements, sets out what actually transfers and what does not, and gives you a way of deciding. It is written for the employer making the decision rather than the supplier selling it.
Whatever you hand over, you still need to see each step's owner and due date. See how New Dynamics workflows keep that visible when part of a process sits outside the business.
Four arrangements that get called the same thing
Business process outsourcing
A supplier runs a defined process for you, to an agreed standard, usually under a contract lasting years. Payroll, benefits administration, invoice processing, contact centres and recruitment screening are the usual candidates. You remain the employer of your staff and the customer of a service. Our BPO meaning post covers the wider family and the types.
The distinguishing feature is that a whole process leaves, not a task. That is why the contract matters more than the price.
Shared services
Shared services is not outsourcing. One internal team runs a process for every part of the organisation, instead of each division running its own. Human resources shared services usually means a single HR administration team handling contracts, changes, absence records and first-line queries for the whole employer, often with a case system and a self-service portal.
Nothing leaves the organisation. No contract, no supplier, no transfer of employment. What changes is where the work sits internally, which still affects the people who did it locally and still needs consultation, but the legal picture is entirely different from buying a service. Many employers consider shared services first precisely because it captures some of the efficiency without the contractual exposure.
Employer of record, and the American PEO
An employer of record, or EOR, becomes the legal employer of the person concerned. You direct the work day to day; the provider holds the employment contract, runs the payroll, and carries the employer obligations in that jurisdiction. It is most often used to employ one or two people in a country where you have no entity. Our EOR meaning post explains the arrangement in detail.
A professional employer organisation, or PEO, is a different thing, and it is worth being plain about this. PEOs and the co-employment doctrine behind them are American constructions. In the United States, a PEO and its client share defined employer responsibilities under a co-employment relationship recognised in state law and in federal practice. There is no direct equivalent in UK law: employment status here is not split between two co-employers in that way, and a UK provider using the word "PEO" is normally offering either an EOR arrangement, where it is the employer, or outsourced HR and payroll administration, where you are. Ask which, in writing, before you sign. Our PEO meaning post describes the American model as it actually works, so you can tell the difference.
Employee leasing
Employee leasing is an older term, largely American, for an arrangement in which a provider employs staff and supplies them to work in your business for a fee, sometimes including people who previously worked for you directly.
In the UK, arrangements of that shape are usually agency work. An employment business employs or engages the worker, the worker works under your direction, and the agency worker rules apply. The term "leasing employees" survives in search and in sales material, but it is not a category in UK employment law, and treating it as one is how employers end up surprised by the twelve-week entitlement described below. Our post on employment status covers the categories that do exist here.
What transfers, and what does not
The useful question is not "who does the work" but "who is answerable when it goes wrong". In every arrangement except an EOR, the answer stays with you.
| What moves | What stays with you |
|---|---|
| Processing the work, day to day | Responsibility for personal data as controller |
| Systems, tooling and specialist capacity | Decisions about individuals, pay, discipline, exits |
| Headcount doing the task | The duty to inform and consult if TUPE applies |
| First-line queries and administration | Accountability to employees, HMRC and the regulator |
| Reporting, if you specify it in the contract | Knowing whether the service is actually any good |
Our HR outsourcing post sets out the statutory employer duties, from PAYE registration to employers' liability insurance, that no contract removes. Three legal frames do most of the work in a people-process decision, and they are covered next.
Data protection: the duty does not move with the file
This is the most commonly misunderstood point in the whole subject. An employer that hands payroll or HR administration to a supplier has not handed over its data protection responsibility. It has acquired a processor.
The Information Commissioner's Office defines a controller as "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data", and a processor as "a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller". Its guidance on controllers and processors is direct about what that means: "If you are a controller, you are responsible for complying with the UK GDPR."
A processor is not without duties. The ICO notes that a processor "should only process personal data in line with a controller's instructions, unless it is required to do otherwise by law", and that a processor may itself "be liable to pay damages in legal proceedings or be subject to fines or other penalties". But on overall compliance the ICO is unambiguous: "Controllers are primarily responsible for overall compliance with the UK GDPR, and for demonstrating that compliance."
That obligation is given teeth by the contract. The ICO's guidance on contracts states: "Whenever a controller uses a processor to process personal data on their behalf, a written contract needs to be in place between the parties." The contract must set out "the subject matter and duration of the processing", "the nature and purpose of the processing", "the type of personal data and categories of data subject" and "the controller's obligations and rights". It must also include terms covering "processing only on the controller's documented instructions", "the duty of confidence", "appropriate security measures", "using sub-processors", "data subjects' rights", "assisting the controller", "end-of-contract provisions" and "audits and inspections".
Read that list as a procurement checklist, because it is one. Two items in it are the ones employers most often discover too late: sub-processors, which is where your employees' data actually ends up, and end-of-contract provisions, which decide whether you can leave. Our employee data protection guide covers the wider duty.
TUPE: outsourcing a service can be a transfer
If the process you are outsourcing is currently done by your own employees, the decision is not only commercial.
GOV.UK's guide to business transfers and takeovers sets out two kinds of transfer protected by the Transfer of Undertakings (Protection of Employment) regulations, known as TUPE: "business transfers" and "service provision changes". A service provision change includes the case where "a service provided in-house (for example cleaning, workplace catering) is awarded to a contractor". The same framework covers a contract moving from one contractor to another, and work brought back in-house.
Where TUPE applies, GOV.UK says "the employees' jobs usually transfer over to the new company", "their employment terms and conditions transfer" and "continuity of employment is maintained".
There are duties before the date as well as on it. GOV.UK's page on consulting and informing says employers must tell affected employees or their representatives "that the transfer is happening, when it's happening and why", "how the transfer will affect them" and "whether there'll be any reorganisation", and must also give "how many agency workers they're using and what types of work they are doing". Employers "must consult employee representatives about anything to do with the transfer that would affect the employees" and "should try to gain agreement about these changes". GOV.UK adds plainly: "Employers can be penalised if they do not do this."
This is general information about the law in the United Kingdom as GOV.UK publishes it, not legal advice. Whether TUPE applies to a particular arrangement turns on the facts, including how clearly an organised grouping of employees can be identified as providing the service. Take advice on your specific facts, and take it before you go to market, because the consultation duty starts long before the go-live date.
Agency workers, and the rights that apply
If the arrangement supplies people rather than running a process, the agency worker rules are the relevant frame.
GOV.UK's guidance on rights as a temporary agency worker states: "From the day you start work you have a worker's employment rights." From day one that includes "the same rights as your permanent colleagues to use any shared facilities and services provided by your employer", such as a canteen or car parking.
Then the point that catches employers out: "After 12 weeks in the job you qualify for the same rights as someone employed directly." GOV.UK lists among those "'equal pay' - the same pay as a permanent colleague doing the same job", "automatic pension enrolment" and "paid annual leave".
Two practical consequences for the hirer. Budget for the twelve-week position, not the day-one rate, on any arrangement you expect to run through a season. And make sure somebody in the business is counting the weeks, because the agency is not deciding what a comparable permanent colleague is paid. Our zero hours contract post covers a neighbouring arrangement that is often confused with agency supply.
Deciding: what is sensible to outsource
Four tests, in order.
- Is the process well defined and measurable? If you cannot describe it and say how well it currently runs, you are not buying a service, you are buying someone else's version of your process.
- Does it depend on knowing your people? Payroll calculation does not. Deciding a grievance outcome does. Rule-governed, high-volume, verifiable work outsources well; judgement about individuals does not.
- Would shared services get you most of the benefit? If the inefficiency is five divisions doing the same administration five ways, centralising internally may solve it without a contract.
- Could you bring it back? This is the test that matters most and is asked least. If the answer depends on data you cannot extract, knowledge nobody internal holds, or a notice period measured in years, you are not outsourcing a process. You are transferring control of it.
What is not sensible to outsource: the decisions. Pay changes, disciplinary outcomes, dismissals, promotion, and the criteria used in hiring. A provider can prepare, administer and advise. The employer decides, and signs.
What goes wrong
Three failures account for most unhappy outsourcing arrangements, and all three are decided at the start.
A contract with no exit. No data extract in a usable format, no transition assistance, no defined notice, no agreed position on who owns the configuration. The ICO's required "end-of-contract provisions" are the minimum, not the ambition. Write the exit while you still have a choice of supplier.
No owner left inside the business. When the last person who understood the process leaves, the employer loses the ability to challenge anything: an invoice, an error, a service report, a proposed change. One named internal owner who knows how the process works is the cheapest insurance available, and the first role cut when the savings case is written.
Service levels that measure activity rather than outcomes. Calls answered in twenty seconds, tickets closed within two days, reports issued monthly. All achievable while payroll is wrong and employees are unhappy. Measure what the user cares about: accuracy of pay, time to resolve a query fully, the proportion of cases reopened, and what employees say when asked. Then agree what happens when the numbers are missed, because a service level with no consequence is a sentence in a document.
Frequently asked questions
What is BPO outsourcing?
BPO outsourcing is business process outsourcing: paying a supplier to run a whole business process for you, such as payroll, benefits administration, invoice processing or recruitment screening, usually under a multi-year contract with agreed service levels. You remain the employer and the customer of a service.
What is the difference between BPO and shared services?
Business process outsourcing sends a process to an external supplier under a contract. Shared services centralises the same process inside the organisation, with one internal team serving every division. Shared services is not outsourcing: no supplier, no commercial contract and no transfer of employment.
What is the difference between a PEO and an EOR?
An employer of record is the legal employer of the person concerned and carries the employer obligations in that country, while you direct the work. A PEO, in the American model, shares defined employer responsibilities with the client under co-employment. Co-employment is an American construction with no direct UK equivalent, so a UK provider using the word "PEO" is normally offering either an EOR arrangement or outsourced HR administration. Ask which, in writing.
What is employee leasing?
Employee leasing describes a provider employing staff and supplying them to work in your business for a fee. The term is largely American. UK arrangements of that shape are usually agency work through an employment business, governed by the agency worker rules, including equal treatment after twelve weeks in the same job.
Does outsourcing transfer responsibility for employee data?
No. The ICO states that controllers are primarily responsible for overall compliance with the UK GDPR and for demonstrating that compliance. A supplier running the process is normally your processor, and a written contract covering the required terms has to be in place.
Does TUPE apply when we outsource a service?
It can. GOV.UK treats a service provided in-house and then awarded to a contractor as a service provision change, one of the two types of transfer TUPE protects, so employees' jobs and terms may transfer and duties to inform and consult apply. This is general information rather than legal advice; take advice on your facts.
Your next step: write the exit before the contract
- Name the process, write down how it runs today and how well, then decide which of the four arrangements you are actually considering.
- Ask whether centralising internally would get most of the benefit without a contract.
- Check whether your own employees currently provide the service, and get TUPE advice before you approach the market.
- Put the ICO's required contract terms into the procurement documents, with sub-processors and end-of-contract provisions answered in writing.
- Name one internal owner who will still understand the process in three years.
For the controller duties that stay with you whoever runs the process, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form.
Want visibility of a process that is partly outside the business? Book a New Dynamics demo and bring the arrangement you are considering. You can also email contact@new-dynamics.com.
