Saya & Associates
UK startup hiring an Indian developer: IP and data checks
The developer starts Monday. The contract is still a template
A UK startup engages an independent developer in India to build part of its product. The founder sends a standard contractor agreement, grants repository access and adds the developer to the support workspace.
An invoice marked "work for hire" does not settle ownership. Keeping the servers in London does not settle the data question either.
This article concerns an independent Indian developer or development company, not a UK company's own employee working abroad for a while. The legal and transfer analysis can change with that distinction.
Put the work and ownership in writing
Start with a schedule of what the developer will create: source code, documentation, designs, configurations, tests and reusable components. List pre-existing tools and open-source packages separately.
The startup needs to know what it is acquiring and what it may only license.
Under the Copyright Act, 1957, the author is ordinarily the first owner.
The employer exception in section 17 covers work made under a contract of service. A contractor is not an employee just because the startup directs or pays for the work.
Section 19 requires an assignment to be in writing and signed by the assignor or an authorised agent. It must identify the work and state the rights, the duration, the territory and the consideration.
If the deed is silent, the Act presumes five years and India only (sections 19(5) and 19(6)). For a UK company building a global product, those defaults are rarely what the founder intends.
The agreement should state the deliverables, whether rights are assigned or licensed, the territory and duration, when the transfer takes effect, and how the contractor's earlier materials may be used.
Ask who in the contractor's team writes the code, and whether each person has assigned their rights to the contracting entity. A company's assignment is less reassuring if it cannot show its own chain of title.
A choice-of-law clause is useful, but it does not replace checking the creation and assignment chain under the laws that may govern the rights.
Remote access is a restricted transfer
Can the developer build and test with synthetic data? If not, identify exactly which live records are needed, why and for how long. Production access can expose names, messages, payment information or health data.
The UK Information Commissioner's Office (ICO) is explicit. Making UK personal data accessible to a separate organisation outside the UK, including by remote access, is a restricted transfer.
The ICO's own example is a UK business whose Indian IT support company reaches data on UK servers through a VPN. The data never leaves the UK, but the transfer takes place when the Indian company accesses it.
The UK company must have a transfer mechanism in place before access begins: adequacy regulations, an appropriate safeguard or an exception. In the ICO's India example, the business relies on appropriate safeguards.
| Tool | What it is |
|---|---|
| International Data Transfer Agreement (IDTA) | The ICO's standalone contract for restricted transfers |
| UK Addendum | Adapts the EU Standard Contractual Clauses for transfers from the UK |
| Transfer risk assessment | Required with either, to show protection is not materially lower after the transfer |
The ICO plans to update the IDTA and the Addendum during 2026, following the Data (Use and Access) Act 2025. It says to keep using the current versions until then.
Match the contract to the actual access
The agreement and any processing terms should match the access: documented instructions, security, incident reporting, limits on subcontractors, deletion or return of data, and a way to verify compliance.
The ICO's guidance on controller-processor contracts under Article 28 is a useful checklist where the developer processes personal data for the startup.
Map the role to each data flow rather than assuming the developer is always a processor.
For an Indian SaaS company facing the same question from the other side, see what to check in an EU customer's DPA.
Decide what happens on the last day
Most templates say access ends on termination. The operating plan needs more: who holds repository admin rights, who rotates secrets and revokes cloud credentials, and where the build and deployment instructions live.
Which copies of customer data must be returned or deleted, and what evidence will show it happened? Require a handover that another developer can use.
Preserve project records before removing access, particularly if an ownership or payment dispute is emerging. Never let the contractor's personal account be the only route into a business-critical system.
A signing check
- Define the deliverables. List what will be created and what pre-existing material stays with the developer.
- Secure the assignment. Get a signed assignment stating the rights, duration, territory and consideration, backed by the contractor's own chain of title.
- Map the data access. Record what personal data will be accessible from India, and why.
- Document the transfer route. Put the IDTA or UK Addendum and the transfer risk assessment in place before access starts.
- Settle subcontractors and AI tools. State whether the developer may use subcontractors or AI coding tools with the code or customer data.
- Plan the exit. List the accounts, documentation and data to be handed back or deleted when the work ends.
The point is not to make a small development contract unmanageably long. It is to make ownership and access visible before the first line of production code changes.
Frequently asked questions
Does a UK startup own code written by an Indian freelancer?
Not automatically. Under the Copyright Act, 1957, the author is ordinarily the first owner. The startup needs a written assignment, signed by the developer, that identifies the work and states the rights, duration and territory.
Is remote access from India a data transfer under the UK GDPR?
Yes, if the developer is a separate organisation. The ICO treats making UK personal data accessible to an organisation outside the UK, including by remote access, as a restricted transfer, even if the data stays on UK servers.
Which transfer mechanism suits an Indian contractor?
Usually an appropriate safeguard: the ICO's International Data Transfer Agreement or the UK Addendum to the EU clauses. Either comes with a transfer risk assessment showing protection is not materially lower.
Is "work for hire" wording enough?
Not on its own. Outside the employment and commissioning exceptions in section 17, ownership passes by assignment. Section 19 requires that in writing, signed, with the rights, duration and territory stated.
Can the developer use AI coding tools on our code?
Only if the contract allows it. Decide before access begins whether the developer may put your code or customer data into AI tools, and on what terms.
The takeaway
A cross-border build is safest when ownership and access are settled on paper before the repository opens. A signed assignment, a documented transfer route and a planned exit cover most of the risk.
To review a specific engagement, contact Saya & Associates.
This article provides general information as at 25 September 2026. The position depends on the developer's status, the contract, the work created, the data flow and the jurisdictions involved. It is not legal advice.