Outsourcing service level agreement: what to ask your provider for

A service level agreement for outsourced work is the part of your contract that turns good service into numbers you can check. It says how fast the provider replies, how quickly routine work gets done, how accurate it has to be and what the monthly report shows. For a Singapore SME hiring an overseas assistant through a provider, the terms that protect you most are the ones about people and data: who covers when your assistant is on leave, how fast a replacement arrives when someone resigns, and what happens to your customers' personal data under the PDPA.

Below are the seven terms worth asking for, a table of sample targets, clauses you can adapt, what PDPC expects when the person doing the work sits outside Singapore, how to measure it all without checking every item yourself, and the case where an SLA does more harm than good.

Key takeaways

• Track four or five numbers at most, and set the targets after a baseline month of real work instead of guessing them on day one.
• With an assistant hired through a provider, the terms that protect you most cover leave, replacement when someone resigns, and personal data.
• Under the PDPA you stay responsible for data your provider handles for you. A transfer overseas needs a contract that names the countries the data may go to.
• If a breach is notifiable, PDPC must hear from you within 3 calendar days of you deciding so. Put a fixed notice period for the provider, such as 24 hours, in the SLA.
• An SLA is the wrong tool for one assistant doing judgement work. Use a weekly review and a short scorecard for the work, and keep the SLA for the provider's promises.

What the SLA is for

Most provider contracts come in two parts. The main agreement sets the price, the term, notice periods and liability. The SLA, usually a schedule at the back, lists the few things the provider promises and how each one is measured. If the main agreement says the provider will supply a full-time assistant, the SLA says what full-time means in hours, what happens when that person is ill, and how you will know whether the work met the standard.

When you hire a dedicated assistant through a provider, the SLA binds the provider. The assistant is the provider's employee, and no provider can promise that one person will never fall ill, make a mistake or hand in their notice. What it can promise is how quickly it reacts when any of those happens. A good SLA for a small company spends more words on that reaction than on speed targets.

The SLA sits beside the other Singapore rules for overseas hires, such as work passes, CPF and withholding tax. Our guide to hiring an overseas virtual assistant from Singapore covers those.

The seven terms to ask for

These are the terms worth writing down when an assistant or a small outsourced team takes over repeatable tasks. The targets in the table below are starting points. Adjust them once you have a month of real figures.

Response time

How long before someone acknowledges a request. Split it in two: requests you mark as urgent, and everything else. Count it during agreed working hours in Singapore time, so a message you send at 11pm is not a miss at 8am the next morning.

Turnaround

How long routine work takes from request to done. One deadline for every task invites argument, so set it as a share instead: for example, 80% of routine tasks finished the same working day and all of them within two. Leave out anything that is waiting on you, such as an approval or a login you have not sent yet.

Accuracy

The error rate on work you can check: data entry, invoices, calendar bookings or replies to customers. Define an error before you start. A typo in an internal note and a wrong amount on an invoice should not weigh the same, so the simplest rule is to count only errors that reach a customer, a supplier or the books.

Availability and cover for leave

State the hours in Singapore time and say which public holiday calendar applies. Manila keeps the same clock as Singapore, but the holidays differ. MOM lists 11 public holidays in Singapore for 2026, and National Day on 9 August is a normal working day in Manila. The Philippines has its own regular holidays, such as Independence Day on 12 June, and under the DOLE handbook on statutory benefits (2023 edition) most employees there with a year of service are entitled to five days of paid service incentive leave. So a full-time assistant will be away on some of your working days every year, and the SLA should say who covers. Ask for a named back-up who has read your procedures, planned leave notified two weeks ahead, and cover within one working day of an unplanned absence.

Data handling

Which systems the assistant may use, where your data may be processed, how fast the provider tells you about a breach, and what happens to the data when the contract ends. Passwords belong in a password manager, never in chat; our guide on sharing passwords with an assistant shows the set-up. The PDPA section further down covers what the law expects.

Replacement

What happens when the assistant resigns, or when you ask for someone else. Ask how long a shortlist takes, how long the handover overlap lasts, whether a replacement costs anything, and whether the new person's first weeks are billed at the full rate. Keep your processes in written SOPs that you own, so the knowledge stays with you when a person leaves. Our guide to writing SOPs shows a format that works.

Reporting

A one-page monthly report from the provider with the figures against each target, every miss and its reason, leave taken and planned, and any change in who can reach your systems. Agree the date it arrives, and hold a short review once a quarter.

Sample service levels for an assistant hired through a provider (starting points to adjust after a baseline month)

Term	Sample target	How to measure it
Response time	Urgent requests acknowledged within 1 working hour; other requests within 4 working hours	Timestamps in the shared inbox, helpdesk or task tool
Turnaround	80% of routine tasks done the same working day; all within 2 working days	Created and completed dates in the task tracker
Accuracy	Fewer than 2 errors per 100 items checked	20 items you pick at random each week
Availability	9am to 6pm Singapore time, Monday to Friday, on the agreed holiday calendar	Status or login records in the monthly report
Cover for leave	Planned leave notified 10 working days ahead; briefed back-up within 1 working day of an unplanned absence	Leave log in the monthly report
Data	Suspected breach reported to you within 24 hours; data returned or deleted within 10 working days of exit, confirmed in writing	Contract clause and exit checklist
Replacement	Shortlist within 10 working days; at least 5 working days of handover when notice allows	Dates recorded in the monthly report
Reporting	Monthly report by the 3rd working day; review every quarter	Whether the report arrives on time

Only the first four rows are figures you track every month. The other four are promises you check when the event happens: a sick day, a resignation, a suspected breach or the end of the contract. If the list of tracked figures grows past five, the report gets longer without telling you anything new, so drop the ones no customer would ever notice.

Data handling under the PDPA

PDPC's Advisory Guidelines on Key Concepts in the PDPA, revised on 29 April 2026, leave little doubt about who carries the risk. Section 4(3) of the Act gives you the same obligations for personal data a provider processes on your behalf as if you processed it yourself. A provider doing that work under a written contract is what the Act calls a data intermediary. It has its own duties to protect the data, to stop keeping it once it is no longer needed and to tell you about a breach without undue delay. Everything else stays with you, which is why the contract has to be in writing and has to say what the provider may do with the data.

When the assistant works outside Singapore

Personal data that leaves Singapore falls under the Transfer Limitation Obligation. Under the Personal Data Protection Regulations 2021, as PDPC's guidelines explain them, you may transfer it if the recipient is bound by legally enforceable obligations to protect it to a standard comparable to the PDPA. A contract can do that, but only if it imposes that standard and specifies the countries and territories the data may be sent to. A data intermediary is also taken to meet the requirement if it holds one of four named certifications: Global CBPR, APEC CBPR, Global PRP or APEC PRP. Ask your provider whether it holds one. If it does not, the contract has to carry the whole load.

The guidelines also cover a case owners tend to miss. Your provider may be a Singapore company while the assistant works from Manila. PDPC treats the overseas transfer as yours to manage whether you send the data abroad yourself or your Singapore provider does it as part of the work. So the SLA, or the data processing agreement beside it, should name the Philippines (or wherever the assistant works) and say the data goes nowhere else without your written consent.

Breach notice timings

If something goes wrong, the clock runs in three stages. The provider must tell you without undue delay once it has credible grounds to believe a breach has happened. You then assess whether the breach is notifiable, which PDPC says should generally take no more than 30 calendar days. A breach is notifiable if it is likely to cause significant harm to the people affected or involves 500 or more of them. If it is, you must notify PDPC as soon as practicable and no later than 3 calendar days after reaching that conclusion, and tell the affected people where that is required. Undue delay is open to argument, so write a fixed figure into the SLA. Twenty-four hours from the provider's first grounds for concern is a figure both sides can check.

What PDPC's sample clauses cover

PDPC publishes a Guide on Data Protection Clauses for agreements where a contractor processes personal data for a customer. Its sample clauses (February 2021) include using the data only for the agreed services, no transfer outside Singapore without your prior written consent, security measures listed in a schedule, access limited to named staff on a need-to-know basis, return or deletion of the data on request with written confirmation, immediate notice of any breach of those terms, and an indemnity. Ask your provider which of these its agreement already contains. Ours are public: the data processing agreement and the information security policy.

Sample clauses you can adapt

The wording below is plain English for a services schedule, written for an SME hiring one or two assistants through a provider. Treat it as a starting point for your own contract and not as legal advice, and have a lawyer read anything you sign.

Response: the Provider will acknowledge requests marked urgent within 1 working hour and all other requests within 4 working hours. Working hours are 9am to 6pm Singapore time, Monday to Friday, excluding the public holidays listed in Schedule 2.

Cover: the Provider will tell the Client about planned leave at least 10 working days in advance. If the Assistant is absent without notice, the Provider will supply a back-up who has been briefed on the Client's written procedures within 1 working day.

Replacement: if the Assistant resigns, or the Client asks in writing for a replacement and gives reasons, the Provider will present a shortlist within 10 working days at no extra fee. Where notice allows, the outgoing Assistant will hand over for at least 5 working days.

Data location: the Provider will process Client personal data only in Singapore and the Philippines and only for the services in this agreement. It will not move the data to another country, or share it with a subcontractor, without the Client's prior written consent.

Breach notice: within 24 hours of having credible grounds to believe that Client personal data has been accessed, disclosed, lost or altered without authority, the Provider will tell the Client and give it the facts it needs to assess the breach.

Exit: within 10 working days of this agreement ending, the Provider will return or delete all Client personal data, remove the Assistant's access to Client systems, and confirm both in writing.

Client duties: service levels are paused while the Provider is waiting on the Client for access, approvals or information it has asked for in writing. The Client will name one contact for day-to-day questions.

How to measure it without checking everything yourself

The figures should come from the tools the work already runs through, and never from the assistant's own account of the week. A shared inbox or helpdesk records when a message arrived and when it was answered. A task tool, even a shared spreadsheet, records when a task was created and when it was ticked off. If the work happens in WhatsApp or someone's personal email, nobody can measure it, which is a good reason to move it before the SLA starts.

Run a baseline month first

Targets guessed on day one tend to be wrong in one direction or the other. A loose target quietly becomes the standard. A tight one gets missed from the first week, and the monthly report turns into a list of excuses. Agree that the first month is measured but not enforced, then set the targets together from what actually happened.

Sample instead of auditing

For accuracy, check a small random sample instead of every item. Twenty items a week, picked by you and not by the provider, is enough to show a trend within a month and should take you about fifteen minutes. Log each error with the date and what went wrong. After two months the log shows whether errors are falling and which kind keeps coming back.

Read the monthly report against your own sample, and keep the quarterly review short: what was missed, why, and whether any target or task should change. If you run the assistant day to day, our guide on managing a virtual assistant covers the weekly routine that sits alongside the SLA.

What should happen when a target is missed

Large contracts use service credits, a percentage off the monthly fee for each miss. For a small client paying for one or two assistants, a credit of a few percent on one invoice rarely changes how the provider behaves. These remedies tend to do more:

• A written fix plan from the provider within 5 working days of a missed month, with a date to check it.
• A replacement at no fee if the same target is missed two months running.
• The right to end the agreement on short notice, such as 14 days, after three missed months in any six.
• Targets paused, and not counted as misses, while the provider is waiting on you.

The last point protects the provider, and you should offer it without being asked. An SLA that only one side has to keep gets argued over more than it gets used.

When an SLA is the wrong tool

An SLA works when the work is a queue of similar items: invoices to enter, tickets to answer, bookings to make. It works badly for one assistant doing judgement work, such as an executive assistant running a founder's inbox, drafting replies to clients or deciding which meeting matters more.

Three things go wrong. A response-time target rewards a fast reply over a right one, and in a founder's inbox a quick wrong answer costs more than a slow good one. With one person there is no volume to average across, so a single bad week can sink a month of figures. And the work changes from week to week, so there is no stable baseline to set a target from.

For that kind of role, use a short scorecard instead: three to five outcomes you go through together for 20 minutes each week, such as no client email left unanswered past one working day, or the board pack ready by Thursday. Add an end-of-day report so you can see what was done without asking, and set a clear decision point at the end of the first month. Keep the provider-level terms in the contract anyway. Leave cover and replacement apply to judgement work just as much as to a queue, and so do the data terms.

An SLA is also the wrong tool when the work adds up to a few hours a month, or when you cannot yet describe the task in writing. In the first case the time spent measuring costs more than the work itself. In the second, write the process down before anyone signs anything; our delegation matrix helps you decide what to hand over and in what order.

Frequently asked questions

Is an SLA legally binding?

It is enforceable as a contract term when it forms part of the agreement you sign, usually as a schedule. Check that the main agreement refers to the schedule by name, and ask a lawyer if a lot of money rides on it.

How many service levels should an SLA have?

For one or two assistants, four or five tracked figures is plenty, such as response time, turnaround, accuracy or hours of availability. Add yes-or-no promises on leave cover, replacement and data, which you check when the event happens.

Does the PDPA apply if the provider is in Singapore but the assistant is overseas?

Yes. PDPC's guidelines say you remain responsible for the Transfer Limitation Obligation whether you send the data overseas yourself or your Singapore provider does so as part of the work. The contract should name the countries the data may go to.

What is a reasonable response time for a virtual assistant?

Within agreed working hours, one working hour for requests you mark urgent and four for the rest is a workable start for most admin roles. Measure a baseline month before you commit, because the right figure depends on how much work arrives and what kind.

Can I ask for a different assistant under the SLA?

Only if the contract gives you that right, so ask for replacement terms before you sign. They should say how fast a shortlist arrives, whether there is a fee and how long the handover lasts.

Sources

• PDPC: Advisory Guidelines on Key Concepts in the PDPA (revised 29 April 2026)
• PDPC: Guide on Data Protection Clauses for Agreements Relating to the Processing of Personal Data (1 February 2021)
• MOM: Public holidays in Singapore, 2026
• DOLE Bureau of Working Conditions: Handbook on Workers' Statutory Monetary Benefits, 2023 edition

If you are comparing providers, take this list to each of them and ask which terms they will put in writing. We are headquartered in Singapore, and every assistant we place works the client's hours. Book a call and we can go through which service levels fit the work you want to hand over.