Hiring a team overseas? Sort these 6 things first.

Imagine a physiotherapy chain in Texas pays a studio abroad to build a booking app. The invoices are paid and the app works. A year later the studio is sold, and the new owners say the code belongs to them. This is the story behind many "horror stories", and it is avoidable.

Here is what the official texts say:

• US law. Under 17 U.S. Code section 201, copyright vests initially in the author. Section 204 says a transfer of ownership is not valid unless it is in writing and signed by the owner of the rights being given up.
• "Work made for hire" is narrower than people think. Section 101 defines it as work by an employee within the scope of their job, or a specially commissioned work that falls into one of nine listed categories and is covered by a signed written agreement saying so. Custom software written by an independent contractor generally does not sit neatly in those categories, so the safe route is a written assignment.
• UK law. The Copyright, Designs and Patents Act 1988 makes the employer first owner only where the work is made by an employee in the course of employment. An assignment of copyright must be in writing signed by or on behalf of the person assigning it.

The simplest way to stay safe is to keep personal data away from the team: build and test with made-up data. If real customer data must be used, the rules depend on where your customers are.

• EU customers. The European Commission publishes a list of countries it has found to offer an adequate level of protection. India is not on it. The Commission's Standard Contractual Clauses are ready-made model contracts that businesses can use as a safeguard when personal data goes to a country without an adequacy decision. Use them together with a data processing agreement.
• UK customers. The Information Commissioner's Office provides its own International Data Transfer Agreement and an Addendum that attaches to the EU clauses. It says the EU clauses are not valid on their own for UK transfers. A transfer risk assessment is also needed.
• US customers. There is no single federal rule like the GDPR, but many states have privacy laws and many industries, such as health, have their own. Ask your lawyer.

The EU-US Data Privacy Framework is a different arrangement. It covers certified US companies. It does not help with a team in India.

This section is a map, not advice. Show it to your accountant.

• US buyers: collect Form W-8BENThe IRS says a foreign individual gives the payer a Form W-8BEN to certify their foreign status for withholding and reporting. Entities use a related form.
• US buyers: know the general ruleThe IRS says foreign-source income paid to a nonresident alien is normally not subject to US tax under chapter 3 or 4, and normally need not be reported on an information return. Work done inside the US is treated differently.
• UK buyers: the reverse chargeHMRC says that when a UK business buys services from outside the UK, the reverse charge applies. You work out the VAT and show it on your VAT return as if you had supplied the services yourself, so there is usually nothing extra to pay.
• EU buyers: the customer accounts for VATThe European Commission explains that for business-to-business services the place of taxation is where the customer is established. National tax authorities set out the details.
• Verify the supplierFor an Indian company, the GST portal's Search Taxpayer tool shows whether a GSTIN is registered, the legal and trade name, the principal place of business and the status. It proves existence, not skill.

India Standard Time is UTC+5:30, and India does not change its clocks for the seasons. Your own clocks do, so the gap moves during the year. We calculated the overlap for a 9am to 6pm working day on both sides:

Clock changes happen on different dates in different places. In 2026 the US moved on 8 March and goes back on 1 November, while the UK goes back on 25 October. For a few weeks the gaps are an hour different from the usual figures.

What this means in practice:

• With the UK and central Europe you get a solid half-day of shared time. Hold meetings in your morning.
• With the US you have no shared hours unless someone moves. A common fix: the India team works late. For example, 6:30pm India time is 9am in New York during summer time.
• Work asynchronously either way. Written briefs, recorded demos and a daily written update beat late-night calls.

Any lawyer will tailor a contract to you. These are the clauses to make sure it contains:

• IP assignmentSigned and in writing, as in section 1.
• Background versus new IPWhat the supplier brings to the project and what is created for you, with a licence for anything you need but do not own.
• Acceptance criteriaWritten tests for "done": what the work must do, how you will check it and how long you have to report problems.
• ConfidentialityWho may see your information and what happens to it at the end.
• Data processing termsIf personal data is involved, a data processing agreement and the transfer clauses from section 2.
• HandoverSource code, documentation, accounts and a transition period if you part ways.
• Payment milestonesTie payments to delivered, accepted work, not just to calendar dates.
• Exit and disputesNotice period, which country's law applies and how disagreements are handled.

Giving an outside team access to your systems is a security decision, however much you trust them. The official guidance is consistent:

• Understand who has access. The UK's National Cyber Security Centre says a vulnerable supply chain can cause damage and disruption. Its guidance sets out 12 principles for oversight, and the NCSC's own survey found very few UK businesses set minimum security standards for their suppliers.
• Give the least access needed. NIST defines least privilege as granting each entity only the minimum system resources it needs for its function.
• Verify third-party connections and use multifactor authentication. CISA advises checking whether integrators, vendors or other third parties have remote access to your systems, using a monitored jump host and enforcing multifactor authentication where possible.

In practice: create individual accounts for each person, never share one password, turn on two-step sign-in, work on a staging copy rather than your live system, review access when people join and leave, and keep a record of who has what.

When you are ready to compare suppliers, our guide to building a business website has a list of questions to ask first.