A good IT support contract in Ireland sets out exactly what the provider will do, how fast, for which users and devices, at what price, and how you leave. The service level agreement (SLA) is the part that defines priorities and response times. The data processing terms required by GDPR sit alongside it. ERS IT Solutions, an IT provider in Dublin 15 since 1983, gives every outsourced IT client clear SLAs and a dedicated account manager as standard.
This guide is an outline you can use when reading a proposal or drafting a request for proposal. It is not legal advice. Have a solicitor review any contract before you sign.
What is an IT support service level agreement?
An IT support SLA is the part of the contract that commits the provider to measurable service: how quickly they respond to each type of problem, during which hours, how you log issues, how problems are escalated, and how performance is reported. It turns "we'll look after you" into numbers you can check every month.
The SLA should sit inside a wider managed IT services agreement covering scope, price, term, liability, data protection and exit. A one-page SLA with no contract around it leaves most of the important questions open.
What should an SLA for IT support include?
An SLA for IT support should include priority definitions, response and resolution targets for each priority, support hours, contact channels, escalation contacts, reporting, and what happens when targets are missed. Each target should say whether it is a response time (work starts) or a resolution time (it is fixed).
The core SLA sections:
- Priority levels with plain examples of each.
- Response and resolution targets per priority.
- Support hours, including bank holidays and out-of-hours arrangements.
- How to log a ticket: phone, email, portal.
- Escalation path with named roles.
- On-site terms: when a visit is included, and target arrival times.
- Reporting: monthly ticket, patching and backup reports.
- Review meetings: how often you meet to go through performance.
- Service credits or remedies if targets are missed.
Example SLA priority table
There is no legal standard for IT response times, so providers set their own. This example shows how a priority table is usually laid out. Fill in each provider's own figures and compare them:
| Priority | Example situation | Response target | Resolution target |
|---|---|---|---|
| P1 Critical | Whole office down, server or internet failed, suspected breach | Provider's figure | Provider's figure |
| P2 High | A team or key system affected | Provider's figure | Provider's figure |
| P3 Normal | One user affected, workaround exists | Provider's figure | Provider's figure |
| P4 Request | New starter, software install, change request | Provider's figure | Provider's figure |
As a reference, ERS managed IT clients get an average call response of 15 minutes, 98% of issues solved within 30 minutes and an average on-site response of 2 hours. Ask every provider for their averages as well as their contractual targets.
What should a managed IT services agreement include?
Beyond the SLA, a managed IT services agreement should cover scope, pricing, term, responsibilities on both sides, data protection, security, liability, insurance, ownership of accounts and documentation, and exit. Use this as a template outline when reviewing any IT services contract:
| Clause | What to check |
|---|---|
| Scope | Users, devices, servers, sites and services covered |
| Exclusions | Projects, hardware, licences, out-of-hours work, third-party software |
| Price | Monthly fee, how it changes with headcount, annual review terms |
| Projects | How extra work is quoted and approved |
| Term and renewal | Length, auto-renewal, notice period |
| Your responsibilities | Reporting issues, approving changes, keeping licences current |
| Security | Admin access controls, MFA, how the provider protects its own tools |
| Data protection | GDPR Article 28 processor terms, subprocessors, location of data |
| Ownership | You own admin accounts, documentation, licences and data |
| Liability and insurance | Caps, exclusions, the provider's cover |
| Exit | Handover of credentials, documentation and data, removal of tools |
What GDPR terms must an IT services contract have?
If your IT provider can access personal data, it is a processor, and GDPR Article 28 requires a written contract setting out the subject matter, duration, nature and purpose of the processing, the types of data and your rights as controller. The contract must also cover the specific processor duties below.
Article 28 requires the processor to:
- act only on your documented instructions
- ensure staff with access are bound by confidentiality
- take the security measures required by Article 32
- not engage another processor without your written authorisation
- help you respond to data subject requests
- help you with security, breach notification and impact assessments
- delete or return all personal data at the end of the service, at your choice
- give you the information needed to show compliance, and allow audits
If a provider has no standard data processing agreement, ask why.
What exit terms should an outsourced IT services agreement include?
Exit terms decide how hard it is to leave. The agreement should commit the provider to hand over all admin credentials, documentation and configuration within a set time, return or delete your data, remove their remote tools and accounts, and cooperate with your new provider. Check the notice period, any exit fees and any auto-renewal clause.
Ownership is the key point. Your business should own the Microsoft 365 tenant, the domain names, the firewall admin login and the backup accounts. The provider should hold delegated access, not the keys. Our guide on how to choose an IT provider in Ireland includes a step-by-step plan for switching.
Do NIS2 rules affect IT support contracts in Ireland?
They will for organisations in scope. NIS2 requires in-scope entities to manage supply chain security, including security in their relationships with direct suppliers and service providers. As of 28 October 2026, Ireland's National Cyber Security Bill had not been introduced in the Oireachtas, so the Irish rules are not yet in force.
The NCSC has published draft risk management measures while the law is pending. If your organisation may be in scope, read our NIS2 compliance guide and build supplier security terms into your next IT contract now.
For regulated financial firms, DORA already applies. The Central Bank of Ireland notes that DORA, in application since 17 January 2025, covers management of risk from ICT third-party providers.
What should go in an RFP for IT support or a managed service provider?
An RFP for managed IT services should describe your business, users, sites, systems and pain points, then ask each provider the same specific questions so answers can be compared. Ask for prices in the same format, written SLA targets, exclusions, onboarding plan, references and data protection terms.
A managed service provider RFP question list:
- Describe your onboarding process for a business of our size.
- Give your SLA targets for each priority, and your actual averages over the last year.
- List everything included in the monthly fee, and everything excluded.
- Price the service per user and per server, and show the total for our headcount.
- Who will handle our tickets, and where are they based?
- Will we have a named account manager?
- What security tools are included, and what is optional?
- How do you test backups, and how often?
- Provide your standard data processing agreement.
- What certifications does your business hold?
- What is the contract term, notice period and exit process?
- Provide two references from clients of a similar size and sector.
How does an IT support proposal from ERS work?
ERS quotes per business after a short call. We look at your users, devices, servers, network, Microsoft 365 and backup, then send a written proposal with scope, SLAs and exclusions spelled out. Once agreed, every managed service starts with an onboarding and site audit to secure, update and document your systems.
For some clients ERS runs managed services under the ERS x360 Managed Services Framework, which includes agent monitoring, monthly health-check reports and quarterly IT review meetings, as in the JMB case study. See outsourced IT support or call 01 885 9500.