Preparing to Deliver IT Projects for Australian Clients from Sri Lanka

You may already have an opportunity with an Australian client, or be in contract negotiations, but key delivery questions are still unresolved: can the required data be handled from Sri Lanka, how will the first team be deployed, and which entity is accountable to the client for delivery? At this stage, the main risk is often not technical capability. It is that contracts, staffing and workplace arrangements are progressing separately, only to clash just before go-live.

For IT, software development, technical support and BPO projects serving Australian clients, it is usually more practical to prepare along three parallel tracks: client contract and data requirements, employment and team management, and delivery site and operating processes. These tracks do not need to wait until company registration, office setup or recruitment is fully complete. However, their key assumptions should be aligned before you make final commitments.

A common assumption is that you can sign the client contract first and then recruit people and find office space. In practice, client security questionnaires, data-processing arrangements, service hours, personnel screening expectations and incident-notification procedures may directly affect which roles you can hire, what systems employees may access and what conditions the workplace needs to meet. Discovering these requirements after the contract is signed can mean renegotiating scope, adding budget or delaying project launch.

Establish who delivers to the client and who actually handles data

Before the project begins, map the contractual structure and the actual workflow. It is not enough to say that “the Sri Lankan team supports the Australian client.” Define each role clearly.

At a minimum, clarify the following:

• Which entity contracts with the Australian client: an overseas headquarters, a Sri Lankan company or another group entity;
• Which entity invoices the client, receives payment and carries contractual responsibility for service levels;
• Whether the Sri Lankan team works directly for the client or operates as an internal delivery centre supporting the overseas contracting entity;
• What information the team will access, such as client contact details, end-user information, source code, business reports, payment information or customer-service recordings;
• Whether data must be downloaded, stored, backed up or accessed remotely, or whether it will only be handled online through the client’s systems;
• Who can approve system access, data exports, the onboarding of external personnel and the handling of security incidents;
• How data and work output will move if subcontractors, freelancers or support teams in other countries are involved.

This map has a practical purpose. It helps you identify which contractual commitments must be implemented in Sri Lanka, rather than remaining at the sales or head-office level.

Do not leave data clauses for legal review alone

Australian clients may impose requirements on confidentiality, information security, data processing, audit cooperation, subcontracting restrictions, incident notification and personnel management. You do not need to make legal determinations on these clauses yourself. You do need to turn them into operational questions, then work with appropriate legal, data-protection and information-security professionals to assess them.

For example, if a clause says that access is limited to authorised personnel, the next questions should be: Who approves access? How are accounts disabled on an employee’s final day? Are shared mailboxes or shared accounts in use? Can temporary staff use the client’s systems?

If the contract says subcontractors cannot be used without consent, clarify whether contract staff hired in Sri Lanka may be treated by the client as subcontractors. If another group team provides overnight support, does the client’s approval need to be obtained? These issues should not be left until personnel have already joined the project.

It is useful to turn delivery-related obligations in the client contract and security questionnaire into a “commitment–owner–evidence” table:

Client requirement area	Internal points to confirm	Operational evidence to retain
Data access	Personnel roles, access approvals and permission scope	Access approval records and account lists
Confidentiality	Confidentiality obligations for employees, consultants and vendors	Signed documents and filing process
Security incidents	Detection, escalation, internal decision-making and client communication route	Incident-response process and contact list
Service hours	Time-zone coverage, on-call arrangements and public-holiday handling	Rosters and escalation procedures
Project exit	Account recovery, information return and handover responsibilities	Exit checklist and handover records

Start employment planning with project roles, not with “how many people to hire”

The number of initial hires matters, but role boundaries matter more. A software development project and a BPO project handling client information may require very different approaches to personnel selection, training, supervision and workplace management.

Before publishing job requirements, prepare a role profile for each position. It should cover at least:

• Whether the role will access client data, production environments or source code;
• Whether the employee will communicate directly with the Australian client;
• Whether working hours involve Australian time-zone coverage, shifts or on-call duties;
• Whether particular language skills, technical certifications or industry experience are needed;
• Whether remote work is permitted and, if so, how devices and access will be managed;
• Who manages the role day to day, and who is responsible for performance, leave and exit handover;
• Who provides backup coverage and knowledge transfer if staffing is insufficient or a key employee leaves.

A common misunderstanding is that adding a confidentiality clause to the employment contract solves the client’s data requirements. In reality, the document is only one layer. Without access controls, induction training, device rules, exit procedures and management oversight, confidentiality obligations are difficult to turn into workable daily practice.

Where the project involves employment arrangements, employment documents, working hours, employee benefits, foreign personnel or employee-data handling, a qualified local professional adviser should provide advice based on your actual operating model. Your responsibility is to explain the project accurately: who employs the personnel, where they work, what information they access, when service begins, and whether night work or remote arrangements are involved. If the underlying information is incomplete, subsequent advice and documentation can easily fail to match the delivery model.

An office needs more than desks and internet access

If the client requires controlled access, fixed workstations, restrictions on photography, a ban on personal devices, or reliable voice and video support, office selection can directly affect whether the project can be delivered. Even where the team plans to work in a hybrid model, define before launch which tasks can be completed from home and which must be performed in a controlled environment.

When assessing office space, review each delivery condition individually:

• Internet connections, backup connectivity and the response plan for network failures;
• Access control, visitor registration, workstation visibility and meeting-room privacy;
• Who provides employee devices, how they are configured, and how repairs and replacements are handled;
• Whether quiet areas are available for client calls, training and quality checks;
• How the team maintains minimum service if there is a power outage, network interruption or unexpected inability to attend the workplace;
• Whether the client requires an on-site audit, remote review or security-related documentation;
• Whether there are timing dependencies between the lease, fit-out, network activation and delivery of office equipment.

Do not assume that one office model will automatically meet client expectations. Co-working space, a dedicated office, remote work and hybrid work may all be suitable. The key question is whether the actual controls match the commitments in your contract and can be confirmed with the client and relevant professional advisers.

Use a launch tracker to keep all three workstreams aligned

The biggest risk in project preparation is that each owner says their part is nearly complete, while nobody can see the real dependencies before launch. A project lead should maintain a simple launch tracker. It does not need to be complex; its purpose is to make unresolved issues visible.

Workstream	Outputs that must be clear before launch	Common dependencies
Client contract and data	Service scope, data flows, client approval points and escalation procedures	Client legal team, information security team and contracting entity
Personnel and management	Role profiles, recruitment plan, onboarding and exit processes, backup arrangements	Recruitment progress, employment documents and manager availability
Site and technology	Workplace model, devices, network, access permissions and support processes	Lease arrangements, IT vendors and client-system access
Commercial and finance	Pricing assumptions, payment milestones and project-cost allocation method	Contract scope, team size and procurement plan

Costs should be discussed in this tracker as well, rather than discovered after the project begins. You will usually need to obtain and compare costs beyond recruitment and rent, including devices, connectivity, information-security tools, staff training, professional-adviser services, client-review support and project-management costs. Some costs may arise once before launch, while others vary with headcount, service hours and the client’s control requirements.

When reviewing supplier quotations, do not compare only the total amount. Check the scope of service, whether implementation or configuration is included, how ongoing support is charged, how change requests are priced, whether cancellation or delay creates costs, and what prerequisites you must provide. Budget pressure often arises when resources are procured as though the project will expand on demand, while the client has been promised a fixed service scope.

Use “ready to deliver” as the final test

Before committing to a formal go-live date, the project lead can test readiness with one simple question: if the client asks tomorrow for the first employee to begin handling work, does that person already have suitable contractual arrangements, training, equipment, access permissions, management support and an escalation route for exceptions?

If the answer is only “we have hired someone” or “we have leased an office,” preparation is not yet complete. Being genuinely ready to deliver means that the client contract, employees’ day-to-day conduct and workplace conditions support one another.

MMD Business Support can assist with organising project requirements, coordinating document checklists, identifying office-space and local-resource options, and coordinating communication with legally qualified legal, tax, immigration and other professional advisers. Specific requirements relating to contracts, data processing, employment and regulation should be confirmed against the latest guidance from relevant authorities, client requirements and appointed professional advisers.

Sources: Office of the Australian Information Commissioner https://www.oaic.gov.au/ ; Sri Lanka Department of Labour https://labourdept.gov.lk/ . Review date: 14 September 2026.

This content is provided for general information only and does not constitute legal, tax or immigration advice. Specific requirements should be confirmed based on the latest guidance from relevant Sri Lankan authorities and appointed licensed professional advisers.