How to hire a freelance web developer safely

Ownership of commissioned software does not follow payment.

Section 11(1) of the Copyright, Designs and Patents Act 1988 provides that the author of a work is the first owner of any copyright in it. Section 11(2) creates a single exception, for works made by an employee in the course of employment. The Act contains no commissioning exception. Section 3(1) classifies a computer program, and preparatory design material for a computer program, as a literary work, placing both within that rule.

The practical consequence is that a self-employed contractor who writes software is its author and its first owner, and an invoice does not change that.

Intellectual Property Office guidance describes what a commissioner is left with where nothing was agreed in writing: courts may find an implied licence "allowing the commissioner to use the work for the purpose for which it was commissioned", which "does not necessarily result in a transfer of ownership". A limited licence to use the thing is a materially weaker position than owning it — it is the difference between being able to rebuild the site elsewhere and needing permission to.

The rule is not universal, and a UK clause does not travel. German law takes a different route entirely: section 29 of the Urheberrechtsgesetz provides that "copyright is not transferrable" other than by inheritance, and section 31 allows the author to grant rights of use instead. Irish law follows the UK pattern — section 23(1) of the Copyright and Related Rights Act 2000 makes the author first owner with an employment exception. The outcome for a buyer is broadly similar; the mechanism is not.

This article describes what the sources say. It is not legal advice, and any decision that turns on it is one to take with a solicitor in the relevant jurisdiction.

Section 90(3) of the 1988 Act provides that an assignment of copyright "is not effective unless it is in writing signed by or on behalf of the assignor". There is no prescribed form of words, and nothing else achieves it — not an invoice, not an email confirming a payment, not a verbal agreement.

Timing is the part that gets missed. Section 91(1) provides for the assignment of future copyright by an agreement "signed by or on behalf of the prospective owner", with copyright vesting in the assignee when the work comes into existence. The effect is that the clause belongs in the engagement contract signed before the work starts, rather than in a document produced afterwards.

Two adjacent points are frequently conflated with ownership. Section 94 provides that moral rights are not assignable; section 87(2) allows them to be waived only "by instrument in writing signed by the person giving up the right". And section 79(2) disapplies the right to be identified as author for a computer program, the design of a typeface, and any computer-generated work — so for software specifically, that particular right does not arise.

A domain registered by a developer in the developer's own name is a separate problem from the code, and often the more urgent one.

For .uk domains, Nominet's registrant terms and conditions state that Nominet will "make changes to the Registry in accordance with the Registrant's instructions made via its Registrar" — the registrant being the entity named on the register, not whoever set it up. The same document records that a domain "is not an item of property", which is worth knowing before it is described as an asset in a negotiation.

For .com and other generic domains, ICANN's Transfer Policy remains in force with its sixty-day locks: a registrar imposes "a 60-day inter-registrar transfer lock following a Change of Registrant" unless the registered name holder opted out beforehand. A reform reducing those locks completed the policy-development stage in 2025, but ICANN's own project record still shows Board action as pending, so the current locks apply.

The registrant field is the one that matters. Administrative and technical contacts do not carry the same weight, and a domain listed in an agency's name behaves as that agency's, whatever the invoices say.

There is a widely held belief that paying by credit card provides a fallback. For a company, it does not.

Section 75 of the Consumer Credit Act 1974 applies to a debtor under a debtor-creditor-supplier agreement, which section 12 requires to be a regulated consumer credit agreement. Section 8(1) defines a consumer credit agreement as one "between an individual" and a creditor, and section 189 defines "individual" to include a partnership of two or three persons not all of whom are bodies corporate — a definition that excludes a limited company. Section 75(3) also limits claims to items with a cash price "not exceeding £100 or more than £30,000".1

Separately, article 60C(3) of the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 exempts an agreement where "the lender provides the borrower with credit exceeding £25,000" and the agreement is entered into "wholly or predominantly for the purposes of a business".2 An exempt agreement is unregulated, and section 75 does not reach it.

What remains is contractual rather than statutory: staged payments tied to defined deliverables. It is also worth knowing that money cannot simply be parked with a solicitor as a convenience — rule 3.3 of the SRA Accounts Rules prohibits using a client account to provide banking facilities, requiring payments to relate to regulated services actually being delivered.

On employment status, HM Revenue and Customs states that the off-payroll working rules apply where a worker provides services "through their own intermediary", usually a limited company, and that where the client is small and outside the public sector, responsibility for determining status sits with the worker's intermediary rather than the client. The thresholds that define a small client changed for financial years beginning on or after 6 April 2025, so two sets of figures are currently live for different periods.

Somewhere in most conversations about commissioning software, a number appears about how often these projects fail. It is almost always from the same place, and that place has been taken apart in a peer-reviewed journal.

Researchers at the Vrije Universiteit Amsterdam applied the Standish Group's own definitions to 5,457 forecasts of 1,211 real-world projects and showed that the metric inverts: on one organisation's data, the same underlying performance produced a 5.8% success rate or a 94.2% one depending only on the direction of estimating bias.3 They also record the Standish chairman's own position, that its reports "should be considered Standish opinion and the reader bears all risk in the use of this opinion" — adding that this disclaimer "was never stated in the Chaos reports".

There is better data, and it says something more useful. A 2022 study of 5,392 IT projects found that cost overruns follow a power law rather than a normal distribution, which means the risk is concentrated in a fat tail rather than spread evenly.

The honest caveat is one nobody quoting these figures mentions: none of this research is about small projects. It studies large IT programmes. Nobody audits the outcome of a small commissioned website, so there is no failure rate for the thing you are actually buying — and anyone who quotes you one has made it up.

The same gap applies to rates. The Office for National Statistics documents that its own earnings sources exclude the self-employed — its guide records "Excludes the self-employed" and "No earnings information is captured for the self-employed" across four separate collections. There is no official day-rate statistic for freelance developers, only advertised rates published by platforms with an interest in them.

Everything above reduces to six things worth establishing before work starts. None of them is adversarial, and a developer who has done this before will have answers ready.

• Is there a written, signed assignment of copyright, in the contract, before work begins? Section 90(3) and section 91 are why the timing matters.
• Whose name is in the registrant field of the domain? Not the admin contact — the registrant.
• Who holds the hosting, the DNS and the repository, and what happens to access at handover?
• What is the payment schedule, and what deliverable does each stage attach to?
• What is included after launch, and for how long? The fortnight after a site goes live is when the missed things surface.
• What is handed over at the end, and in what form? A repository and a document beat a zip file and a shrug.

These are the questions I would want asked of me, which is the only real test of whether they are fair. How I work answers most of them before they are asked, and every project here ships with a handover walkthrough — there is a real one published in full.