IT Support Contracts For Managed Helpdesks

Yes, if you provide managed helpdesk services in New Zealand, you should have a written IT support contract before you start work.

The nuance is that a good contract does more than say, "we provide IT support and you pay us". For a helpdesk provider, the real protection usually sits in the details: response times, scope limits, exclusions, escalation steps, security responsibilities and what happens when a client asks for work outside the monthly package.

If those details are vague, you can end up carrying open ended support obligations for a fixed fee. That can quickly eat into your margins, frustrate your team and make it harder to deliver reliable service to the clients who are paying properly.

Let's look at what your IT support contract in NZ should cover, especially if you're offering managed helpdesk support or ongoing IT services terms and conditions.

What Should An IT Support Contract Include?

Your IT support services agreement should clearly set out what you're providing, what you're not providing, what the client needs to do, and how you get paid.

For a managed helpdesk provider, the contract often has two layers:

• Main terms and conditions, which cover fees, liability, confidentiality, termination and payment.
• Service schedule or SLA, which describes the support package, hours, response targets, inclusions, exclusions and escalation process.

Your contract should usually cover:

• The parties to the contract, including correct company names and NZBN details where relevant.
• The services you're providing, such as remote helpdesk, monitoring, user support, patch management or Microsoft 365 administration.
• The services you're not providing, such as onsite work, project work, hardware replacement, cyber incident response or support for unsupported software.
• Support hours, response times and priority levels.
• Fees, billing cycles, setup charges, after hours rates and charges for out of scope work.
• Client responsibilities, including giving you access, maintaining licences, following security advice and backing up data where agreed.
• Security, privacy, liability, termination and data handling obligations.

Templates can be a helpful starting point, but managed IT support is an area where small wording gaps can create big operational problems. Your contract works best when it matches how your helpdesk actually runs.

How Do You Stop Helpdesk Support From Becoming Unlimited?

You stop helpdesk support from becoming unlimited by defining the scope, support channels, user limits, devices, service hours and excluded work in plain terms.

This is where many managed helpdesk agreements fall down. A client hears "unlimited support" and assumes every IT related issue is covered. You might mean unlimited tickets for ordinary user issues during business hours. Those are very different things.

Be careful with words like "unlimited", "all inclusive" or "fully managed" unless your contract explains exactly what those phrases mean. Under the Fair Trading Act 1986, you should avoid statements that could mislead clients about what they're actually getting.

Scope Limits That Usually Matter

Your contract should say whether the plan is limited by:

• Number of users, such as up to 20 named users.
• Number of devices, such as laptops, desktops, printers or mobile devices.
• Support channels, such as email, phone, remote access tool or ticketing portal.
• Support hours, such as 8:30am to 5:30pm on business days in New Zealand.
• Types of issues, such as troubleshooting, software access issues and user account management.
• Locations, especially if you support multiple sites or remote workers.

You should also say what happens if the client grows. If the agreement covers 25 users and the client hires another 10 staff, do your fees automatically increase? Do you need to issue a variation? Can you refuse support for users who haven't been added to the plan?

Example: When A "Simple" Ticket Is Actually Project Work

Say you provide monthly IT support to a Wellington accounting firm. Their plan covers helpdesk support for 15 users during business hours.

One day, the client asks you to "just sort out" a move to a new file server, migrate data, update permissions and test access for every staff member. From their perspective, it's all IT support. From your perspective, it's a project.

Your contract should make that distinction clear. Helpdesk support might include troubleshooting user access to an existing file server, while server migration is out of scope project work charged separately.

What Should Your Service Level Agreement Say?

Your service level agreement should set realistic response targets, priority levels and escalation steps, rather than promising guaranteed fix times for every issue.

An IT support service level agreement isn't just a sales document. It's also an operational tool for your helpdesk team. If it's written well, everyone knows which tickets need urgent attention and which ones can wait.

Response Time Vs Resolution Time

One of the most useful distinctions is between response time and resolution time.

• Response time means how quickly you acknowledge or start working on a ticket.
• Resolution time means how quickly the issue is fixed or closed.

For most helpdesk providers, it's safer to commit to response targets rather than guaranteed resolution times. Resolution can depend on third party vendors, internet providers, hardware availability, client access, user cooperation or the complexity of the issue.

For example, your SLA might say:

• Critical priority: target response within 1 business hour.
• High priority: target response within 4 business hours.
• Standard priority: target response within 1 business day.
• Low priority: target response within 2 business days.

Only use numbers your team can realistically meet. If you promise a 15 minute response time but don't have the staffing to support it, that can create service issues and customer complaints.

Priority Levels

Your helpdesk SLA clauses should define ticket priority based on business impact, not simply the client's level of frustration. For example, critical might mean the client's whole business is unable to operate, while standard might mean one user or non critical function is affected.

You can also reserve the right to reclassify tickets if the client selects the wrong priority. That helps you avoid every ticket being marked urgent.

Escalation Clauses

Your contract should explain when and how an incident is escalated. This helps manage major issues without creating open ended obligations.

An escalation clause can cover when a ticket moves to senior technical support, when you involve a third party vendor, who can approve extra costs, when an issue becomes a security incident or project, and how you communicate updates during major outages.

This is especially useful where you provide managed helpdesk support but don't control every part of the client's technology stack.

Who Is Responsible For Security And Data Protection?

Both you and your client may have security and data protection responsibilities, so your contract should divide them clearly.

As an IT support provider, you may have access to client systems, personal information, passwords, backups and admin accounts. That means your services can raise privacy, cyber security and confidentiality issues.

Under the Privacy Act 2020, New Zealand organisations need to handle personal information in line with the Information Privacy Principles. If a privacy breach is likely to cause serious harm, it may be a notifiable privacy breach. In that case, the organisation must notify the Privacy Commissioner and affected individuals as soon as practicable after becoming aware of it.

Your contract should deal with how you and the client will manage privacy incidents. For example, you might require the client to promptly tell you about suspected breaches, and you might agree to help with technical information so the client can assess its notification obligations.

Security Responsibilities To Spell Out

Your contract should make it clear who is responsible for:

• Maintaining user lists and removing access for former staff.
• Approving admin privileges and privileged access.
• Setting up multi factor authentication.
• Keeping software licences active.
• Approving security changes that affect users.
• Maintaining and testing backups, if this is part of the service.
• Following your reasonable security instructions.

If you recommend a security measure and the client declines it, your contract should let you record that decision and limit your responsibility for issues that flow from it.

How Should Fees, Out-Of-Scope Work And Price Changes Work?

Your contract should make your fees easy to understand and give you a clear process for charging work that falls outside the agreed support package.

Unpaid or disputed invoices often come from one simple problem: the client didn't realise something would cost extra. A clear fee clause helps prevent that.

Monthly Fees And Included Support

If you charge a monthly fee under a managed services agreement, specify what the fee includes. For example:

• Helpdesk support during business hours.
• Remote support only, unless onsite support is agreed separately.
• Support for named users and approved devices.
• Basic user administration.
• Monitoring or patching for specified systems.

You should also say whether unused support carries over. In most managed support arrangements, the monthly fee secures availability and included services for that month. It usually doesn't create a bank of unused hours unless you expressly offer that.

Out-Of-Scope Work

Your contract should list common out of scope items and how they're charged. These might include onsite support, after hours work, major upgrades, hardware installation, cyber incident response, training sessions, new office setups and support for unlicensed, unsupported or end of life software.

It's also worth stating who can approve out of scope work. If any staff member at the client's business can request extra services, you may end up arguing about whether the work was authorised.

Price Reviews And Payment Terms

Your contract should cover when you can review pricing. For example, you might increase fees annually, when user numbers increase, or when third party vendor costs rise.

If your clients are businesses, your payment terms can be set by contract. Common options include payment in advance for monthly support, or invoices payable within 7, 14 or 30 days. Choose a period that works for your cash flow and make it clear when services can be suspended for non payment.

Can You Limit Liability In IT Services Terms And Conditions?

Yes, you can often limit liability in business to business IT services terms and conditions, but the wording needs to be fair, clear and suited to the services you're providing.

IT support can create high value risk. A small monthly support fee may sit alongside systems that are critical to your client's operations. Your contract should avoid making you responsible for every loss connected to the client's technology environment.

Common liability protections include:

• Excluding indirect or consequential loss, such as lost profits or lost opportunity.
• Capping your liability to a set amount, such as fees paid over a recent period.
• Excluding liability for third party platforms, vendor outages or internet provider failures.
• Excluding liability where the client ignores your advice or withholds access.
• Requiring the client to maintain suitable backups and business continuity processes.

There are limits. Under the Consumer Guarantees Act 1993, you can only contract out of certain guarantees where the client acquires services for business purposes, both parties are in trade, the contracting out is in writing, and it's fair and reasonable. You generally can't contract out for consumer clients.

The Fair Trading Act also restricts unfair contract terms in standard form small trade contracts. Broadly, this can apply where the trading relationship doesn't exceed the annual value threshold when it first arises, currently, where the relevant annual value is less than $250,000. If you use standard terms for small business clients, avoid one sided clauses that go further than needed to protect your legitimate interests.

A sensible limitation clause should match your risk profile, insurance and pricing. If you're providing basic helpdesk support, your risk allocation may look different from a provider managing backups, security monitoring and privileged admin access.

Can You Use Subcontractors Or Third Party Tools?

Yes, you can use subcontractors or third party tools if your contract allows it and your client understands how those arrangements work.

Many IT providers rely on external tools and vendors, such as remote access software, ticketing systems, password managers, cloud platforms, endpoint protection and backup solutions. You may also use contractors for after hours support, specialist security work or project work.

Your contract should say:

• Whether you can use subcontractors to deliver services.
• Whether you remain responsible for their work.
• Whether client data may be stored or accessed through third party tools.
• Whether data may be held outside New Zealand.
• Which third party terms the client needs to accept.
• What happens if a vendor changes pricing or withdraws a product.

If you engage individual contractors to help deliver services, make sure your contractor agreements are properly documented too. From 2026, changes to the Employment Relations Act 2000 include a contractor gateway test aimed at giving more certainty about when a worker can be treated as an independent contractor. If you're relying on contractors as part of your delivery model, your agreements and working arrangements should be consistent with that framework.

You should also deal with intellectual property. For example, if your team writes scripts, automations, documentation or configuration templates, your contract should say whether the client owns them, receives a licence to use them, or only gets the benefit of them while your services continue.

Common Mistakes To Avoid

The biggest mistake is assuming a friendly client relationship will be enough when expectations change.

Most IT support problems don't start with bad intentions. They start with unclear boundaries. A client assumes something is included, your technician tries to be helpful, and suddenly the contract no longer matches the work being done.

Watch out for these common issues:

• Calling support "unlimited" without limits: explain the users, devices, hours and issue types that are covered.
• Promising fix times you can't control: use response targets unless you're confident you can guarantee resolution.
• Leaving security responsibilities vague: say who manages backups, access, MFA, licences and breach reporting.
• Failing to define out of scope work: list common exclusions and set approval rules.
• Not identifying authorised client contacts: decide who can raise tickets, approve costs and request changes.
• Ignoring third party dependencies: make it clear that vendors, internet providers and platforms can affect outcomes.

Your contract doesn't need to be full of legal jargon. In fact, the best managed helpdesk agreements are usually practical and easy to use. Your team should be able to read the SLA and know how to handle the next ticket.

Key Takeaways

• A strong IT support contract in NZ should cover scope, service levels, exclusions, fees, security, privacy, liability and termination.
• Clear SLA clauses help you avoid unlimited support obligations by setting response targets, priority levels and escalation steps.
• Your contract should separate ordinary helpdesk support from project work, onsite work, after hours work and cyber incident response.
• Privacy and security responsibilities should be shared clearly, especially if you access personal information or admin systems.
• Liability limits can protect your business, but they need to be fair and drafted with the Fair Trading Act and Consumer Guarantees Act in mind.
• If you use subcontractors or third party tools, say so in the contract and make sure your delivery model is properly documented.

If you'd like help with your managed helpdesk agreement, IT services terms and conditions, SLA clauses or privacy and security terms, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.