You own the code only if your contract says so. Use a signed NDA before sharing ideas, a written IP assignment that transfers all deliverables on payment, and keep repositories, cloud and domain accounts in your name. Sri Lanka's Personal Data Protection Act, with key provisions reported effective 1 January 2027, adds duties for handling personal data. This is general information, not legal advice.
Handing your idea or customer data to a team in another country is a trust decision, and trust is easier when the paperwork is clear. This guide covers the practical protections we would ask for if we were the buyer. It is written by a software agency, not a law firm, so use it to prepare questions for your own lawyer. It is part of our wider guide to outsourcing software development to Sri Lanka.
Who owns the code when you outsource software development?
By default, ownership is not as obvious as buyers assume. In many legal systems, the person who writes the code, or the company that employs them, can be the first owner unless a written agreement transfers the rights. Paying an invoice does not automatically transfer copyright. The rules differ by country, so ask your lawyer how they apply to your contract and to the country of the developer.
The practical answer is simple: put ownership in writing. A clear contract states that all deliverables, including source code, designs and documentation, belong to you once you have paid for them.
| Item | Who should own it | What to ask for | |---|---|---| | Custom source code | You, on payment | Written IP assignment in the contract | | Designs and UI assets | You, on payment | Assignment covers design files, not only exports | | Third-party libraries and open-source code | Original licensor | A list of licences used, so you know the terms | | Developer's pre-existing tools | The developer | A licence to you to use them inside your product | | Domain name | You | Registered in your name, not the agency's | | Hosting and cloud accounts | You | Accounts under your login, developers added as users | | Your business and customer data | You | Stated in the contract, with a return or deletion clause |
What should an NDA cover, and when should it be signed?
Sign a non-disclosure agreement before you share anything you would not publish: product ideas, pricing logic, customer lists, source code or credentials. A reasonable NDA covers:
- What counts as confidential information, and what does not (for example, information already public).
- Who may see it. Limit access to named staff who need it.
- How long the duty lasts. Many agreements run for a fixed number of years after the relationship ends.
- What happens to the material when the project ends: return or secure deletion.
- Which law applies, and where disputes are handled.
An NDA protects what you say, not what you build. For the code itself you need the IP assignment below. We are happy to sign an NDA before a scoping call, and a professional vendor should offer one without being chased.
What is an IP assignment clause and what should it include?
An IP assignment clause transfers the rights in the work from the developer or agency to you. Ask for these points, then have your lawyer check the wording.
- Transfer of all rights in deliverables, effective on full payment.
- A statement that the work is original and does not knowingly copy another party's code.
- A list or description of open-source components and their licences.
- A licence for any pre-existing tools the agency reuses.
- A promise that individual developers and freelancers on the team are bound by the same terms.
- A moral-rights or similar waiver where your jurisdiction needs one.
How do you protect source code and credentials day to day?
Contracts matter, but daily habits do most of the work. Use this checklist.
- Create the code repository in your own account (GitHub, GitLab or Bitbucket) and invite the agency, not the other way round.
- Register domains and open cloud accounts under your company, with the agency as a user.
- Give each developer a separate login. Do not share one password.
- Use a password manager and two-factor authentication for every shared system.
- Give the least access needed. A front-end developer rarely needs production database access.
- Keep real customer data out of development and test environments. Use dummy data.
- Agree a written offboarding step: remove access, rotate keys and change shared passwords when a person or the project leaves.
- Ask for regular access to the repository so you see progress and can take a copy at any time.
- Require the vendor to tell you promptly if they suspect a security incident.
- Request handover documentation as a milestone, not an afterthought.
What does Sri Lanka's Personal Data Protection Act mean for offshore projects?
Sri Lanka passed the Personal Data Protection Act, No. 9 of 2022, which WilmerHale described as the first comprehensive privacy law in South Asia. It has since been amended by Act No. 22 of 2025. The full text of the original Act is available on the government documents site.
Commencement dates are the part to handle with care, because sources have described the phasing differently. Daily FT reported that Gazette 2498/16, dated 22 July 2026, set 1 January 2027 as the effective date for key provisions, including those on contracts between controllers and processors and on cross-border transfers. Please verify the current status on the official documents site or with a lawyer before you rely on any date.
In plain terms, the Act places duties on organisations that decide how personal data is used (controllers) and on those who handle it for them (processors). If a Sri Lankan team builds or runs software that handles personal data, expect to put a written agreement in place that sets out what data they may process, for what purpose, under what security measures and what happens to the data afterwards. That agreement is good practice even where the law is still phasing in.
How do GDPR, UK GDPR or other foreign rules interact with a Sri Lankan processor?
We will not give a legal analysis of every regime, because that needs a lawyer who knows your situation. The safe general approach is this:
- If you handle personal data from people in the EU, UK, Australia, the UAE or elsewhere, find out which privacy laws apply to your business.
- Ask whether those laws require a written data processing agreement with any vendor who touches the data, and whether special rules apply to sending data to another country. Regimes such as the GDPR commonly do address both.
- Sign a data processing agreement (DPA) with your Sri Lankan vendor that covers purpose, security, sub-processors, breach notice and deletion.
- Keep production personal data away from developers unless the work truly needs it.
If you are not sure which rules apply, ask your lawyer before you share live data.
What happens at the end of the project?
Plan the exit on day one. A clean handover includes:
- Full source code in your repository, with commit history.
- Documentation: how to run, deploy and update the system.
- A list of all accounts, third-party services and licences in use.
- Credentials transferred and old ones rotated.
- Removal of the vendor's access, or a separate maintenance agreement if they stay on.
- Return or secure deletion of your data, confirmed in writing.
Some buyers also use code escrow for critical systems. It adds cost and is not needed for most small projects, but it is worth asking about if your business depends on one vendor.
What should a contract checklist include?
Before signing, confirm that the contract covers:
- [ ] Named parties and a clear scope of work
- [ ] IP assignment on payment
- [ ] NDA, or confidentiality clauses
- [ ] Data processing terms where personal data is involved
- [ ] Acceptance criteria and a change-request process
- [ ] Payment schedule tied to milestones (see our guide to fixed price vs time and materials)
- [ ] Open-source licence disclosure
- [ ] Handover and offboarding duties
- [ ] Governing law and dispute handling
- [ ] Termination rights for both sides
When you compare vendors, these terms belong on your scorecard next to price. See how to choose a software development company for the full list. If your project involves chatbots or customer records, see how this applies to AI automation, and our post on WhatsApp automation for customer-data points. Our software development team works on these terms with overseas and local clients.
Want to start with the paperwork? Ask for our NDA before you share anything
FAQ
Is it safe to share my idea with a Sri Lankan agency?
It is as safe as the paperwork and the vendor. Ask for an NDA before you share details, share the minimum needed for a quote, and check references. An NDA does not make theft impossible, but it gives you legal recourse and signals a professional vendor. Ideas matter less than execution, so most agencies value their reputation highly.
Who owns the source code after payment?
Whoever your contract says. Without a written IP assignment, ownership can be unclear, because paying an invoice does not automatically transfer copyright. Ask for a clause that transfers all deliverables to you on full payment, and keep the repository in your own account. Check the wording with a lawyer.
Do I need a data processing agreement?
If the vendor will handle personal data about your customers or staff, yes, in most cases. Many privacy laws, including those widely used in Europe and the UK, expect a written agreement with processors. Sri Lanka's PDPA also addresses controller-processor contracts. We cannot say which rules bind you, so confirm with a lawyer.
Can I take the project to another vendor later?
Yes, if you set it up for that from the start. Own the repository, domain and cloud accounts, require handover documentation and avoid custom tools only the vendor can run. Vendor lock-in usually comes from missing documentation and accounts held by the agency, not from the code.
Talk to us
This guide is general information, not legal advice. If you want to talk to a Sri Lankan team about your project, we will sign an NDA first, before you share any details. Ask for it on WhatsApp and we will take it from there at no cost.
Chat with us on WhatsApp or use the contact page.