Software development: briefing a developer and keeping control of your code in Ireland

A good brief describes the problem, not the screens. Explain what your staff or customers do today, where it breaks down, and what a successful system would change. Name the people who will use it and roughly how many, and list the systems it has to talk to: accounting software, a CRM, a warehouse system, a payment provider, Microsoft 365.

Separate what you must have at launch from what would be nice later. Developers price uncertainty, so an open-ended wish list produces either a high fixed price or a loose estimate. If you have no written specification, many firms offer a paid discovery phase of workshops and prototypes that ends in a specification and a firmer price. That is often money well spent, and the document belongs to you even if you take it to someone else.

• the business problem and who uses the system
• existing systems, data sources and any integrations
• platforms: web, iOS, Android, desktop or back end only
• where it will be hosted and who pays for hosting
• security and personal data involved
• accessibility requirements for staff or public users
• deadlines that are real, such as a contract start or a system being switched off

A fixed price suits a well-defined piece of work. The developer carries the risk of underestimating, so expect a contingency in the price and a strict change-control process: anything not in the specification becomes a paid change request. Make sure the contract states the acceptance criteria, meaning the tests that decide whether a feature is finished.

Time and materials means you pay for the hours or days worked, usually in sprints of a few weeks. It fits projects where you expect to learn as you go, but the risk of overrun sits with you. Ask for a day rate per role, a regular report of time spent against the backlog, and the right to stop after any sprint with everything built so far handed over.

Many projects combine the two: a fixed-price discovery phase, then time and materials with a budget cap and a review point before the cap is reached.

The law requires a written contract with a processor that covers, among other things, confidentiality, security, the use of sub-processors and what happens to the data at the end.

For high-risk processing, such as profiling, large volumes of sensitive data or automated decisions about people, you may need a data protection impact assessment before the system goes live. This comes up often with AI features. Ask the developer which third-party AI services the system would send data to, where those services process it, and whether your data is used to train their models.

Security should be part of the specification rather than an afterthought: authentication, role-based access, logging, encryption, and a security test before launch. For a baseline on the developer's own house, ask whether it holds Cyber Essentials, the government-backed scheme run by the NCSC with IASME. Some public sector contracts require it from suppliers.

Software does not stay finished. Operating systems, browsers, app store rules and third-party libraries all change, and security patches arrive constantly. Agree before launch who keeps dependencies up to date, how quickly faults are fixed, and what that costs each month. A support agreement should define response and fix times by severity, the hours covered, and how hosting, backups and monitoring are handled.

Insist on handover material that another developer could work from: documentation, deployment instructions, credentials held by you, and automated tests. It is the best protection against being tied to one supplier for years.

The GDPR applies to your IT projects; in Ireland the Data Protection Commission is the supervisory authority. If a supplier processes personal data on your behalf, you need a data processing agreement.

Irish companies are registered with the Companies Registration Office. Ask for the company number and VAT number, and check whether prices are quoted with or without VAT.

Source: dataprotection.ie · eur-lex.europa.eu · revenue.ie

You confirm your mobile number with a text code and your email address with a link. We then show the request to businesses in your area, without your name or contact details. Only one business can take it on; it pays Offrano for the request, and it costs you nothing.

Before that business sees your details, we email you its name, address and phone number. We check only that it is a registered business, for example through its Companies Registration Office entry or VAT number, not the quality of its work. We cannot promise that a business will respond; if nobody takes the request within 21 days, we withdraw it. Offrano is not a party to any contract for the work.