I’m hiring a freelancer. Can they subcontract the work?

You hire a developer whose portfolio you like. Halfway through the project, a new person asks for access to your customer database. “They help me with overflow work” might be perfectly reasonable—but it raises questions your original brief may not answer.

Subcontracting is not automatically a problem. Unclear responsibility and uncontrolled access can be. Read the signed agreement, proposal and any incorporated terms before deciding what was promised. A “personal service,” substitution or subcontracting provision may matter more than the name on the invoice.

Separate four different permissions

Permission to help with a design is different from permission to see confidential files, administer production systems or process personal data. Ask about each separately.

Ask whether approval can be withheld reasonably, how replacements are handled and what notice you receive. Blanket consent to “any third party” may be broader than you intended. A blanket ban can also make an ordinary specialist task unnecessarily difficult. Match the rule to the project.

Keep one clear owner of the result

If the main freelancer remains your supplier, ask the agreement to say how they manage quality, deadlines and corrections when a helper is involved. Otherwise a missed deadline can turn into a circular conversation about whose task it was.

Check the money too. Are specialist costs included in the fixed fee? Can the freelancer incur extra costs without your approval? Will you ever owe the helper directly? Agree the answer before work begins; an introduction alone should not become an unexplained extra invoice.

For a website project, the handover checklist covers repositories, accounts and documentation. Add every contributor's access to that list.

Check confidentiality and ownership together

Ask how helpers are bound to confidentiality and how their contributions are licensed or assigned through to you. Do not assume that paying your freelancer answers every question about a helper's code, photographs or illustrations. Ask for an inventory of third-party assets and licence restrictions too.

If your agreement bans AI use or restricts uploading files to outside tools, confirm that the restriction reaches the people doing the work. The no-AI clause guide gives questions about tools, confidential inputs and exceptions.

Use individual accounts where possible, grant the access needed for the task and record who removes it at handover. Do not solve a permission question by sending your main account password to an unfamiliar person.

UK example: a helper processing personal data

For UK GDPR purposes, first establish the parties' actual roles. A freelancer is not automatically your data processor merely because you hired them.

Where the freelancer is a processor and engages another processor to handle personal data on your behalf, the ICO explains that prior specific or general written authorisation is required. Its guidance also describes equivalent contractual protection and the original processor's responsibility to the controller for the sub-processor's compliance. See the ICO's contracts guidance. The ICO marks this guidance as under review following the Data (Use and Access) Act 2025; check the current position for your arrangement.

That is a bounded UK data-protection example, not a worldwide rule covering every subcontractor. If data will be accessed from another country, separately establish whether transfer rules apply.

A message before granting access

Thanks for explaining who will help. Before access is granted, please confirm their role, which systems and data they need, the applicable confidentiality and rights arrangements, and who remains responsible for delivery and corrections. Please also confirm whether this needs our approval under the contract or data-processing terms, and who will remove access at handover.

Keep the reply with the agreement. If you agree a change, use the revised-contract checklist to make sure the final text reflects it.