Outsourced service desk vs MSP vs in-house team for UK mid-market
Short answer
For a UK mid-market firm, the three models solve different problems. An in-house team gives you control and local knowledge, at the cost of hiring, cover for leave and sickness, and employer National Insurance (15% above the secondary threshold for 2026 to 2027, per HMRC). An MSP takes on infrastructure, devices and security as a bundle and usually runs support from its own tools; it suits firms without an IT function, but you often trade away visibility of your own tickets. An outsourced service desk takes the front line (Tier 1 and often Tier 2) inside your own ITSM tool under SLAs, while your IT team or an MSP keeps infrastructure; it suits firms that have IT ownership but cannot staff long hours or volume swings. Our default for 100 to 1,000 people with an existing IT lead is in-house ownership plus an outsourced desk in your tool. If the desk is delivered from India, two questions come up every time. Data: India is not on the UK government’s list of adequacy countries, so personal data access from India is a restricted transfer that needs safeguards such as the IDTA or the Addendum, and, since the Data (Use and Access) Act 2025 changes came into force on 5 February 2026, a judgement that protection is “not materially lower” than in the UK. Hours: India is 5 hours 30 minutes ahead of GMT and 4 hours 30 minutes ahead of BST, so a UK working day falls in an Indian afternoon and evening.
Contents
- Who this guide is for
- The three models, defined properly
- In-house: when it is the right answer
- MSP: when it is the right answer
- Outsourced service desk: when it is the right answer
- UK GDPR when the desk is delivered from India
- Support hours across UK and India time
- Decision table: which model for which firm
- Best for, and wrong choice when
- Frequently asked questions
Who this guide is for
This guide is for finance directors, COOs and heads of IT at UK firms of roughly 100 to 1,000 people deciding how to staff IT support. Typical triggers: the one or two IT people are overwhelmed, an MSP contract is up for renewal, the firm has grown into a second site or a second time zone, or auditors want evidence of how incidents and changes are handled.
We are an outsourced service desk provider, so we have a commercial interest. We have tried to say plainly where an MSP or an in-house team is the better answer. For the cost side in detail, see our in-house vs outsourced cost framework and outsourced pricing models guides. Legal and tax facts here come only from UK government sources checked on Nov 10, 2026: the GOV.UK page “The UK approach to international data transfers”, Data (Use and Access) Act 2025, Schedule 7, HMRC rates and thresholds for employers 2026 to 2027 and GOV.UK clock change dates. This is not legal advice; involve your data protection officer.
What we will not do
We do not quote market salary figures or “typical” MSP prices. They vary too much by region, skills and scope, and we would rather you price your own. We give you the drivers and a way to compare quotes like for like.
The three models, defined properly
The terms get used loosely, which is why quotes are hard to compare. Here is what we mean.
| In-house team | Managed service provider (MSP) | Outsourced service desk | |
|---|---|---|---|
| What you buy | Employees | A bundle of managed IT: devices, network, servers, cloud, security, and support | A staffed service desk: intake, triage, resolution and escalation |
| Scope | Whatever you hire for | Broad: usually infrastructure and end-user support together | Focused: the front line (Tier 1, often Tier 2) and its processes |
| Whose tools | Yours | Usually the MSP’s own ticketing and remote management tools | Usually yours: the provider works inside your ITSM platform |
| Who owns the data and history | You | Often the MSP, unless the contract says otherwise | You, because tickets live in your tool |
| Typical pricing unit | Salary plus on-costs | Per user or per device per month, plus projects | Per user, per ticket band or dedicated agent |
| Who owns IT strategy | You | Shared, often drifting to the MSP | You (or your MSP); the desk executes |
The last two rows are where the real differences sit. MSPs are good at running infrastructure and bundling support, but because tickets often live in the MSP’s tool, switching provider can mean losing your history and reporting. An outsourced desk inside your own platform keeps the history, the knowledge base and the reports with you, which matters when you later insource or change provider.
In-house: when it is the right answer
An in-house team is right when IT work is closely tied to the business: bespoke systems, sensitive on-site work, frequent hands-on hardware, or a culture where the IT person is part of the team. It is also right when volumes are steady and fit within working hours.
The costs people underestimate are not salaries. They are cover (holidays, sickness, training, resignations), hours (anyone who needs help before 9 or after 5:30), and on-costs. On the last one, HMRC’s rates for 2026 to 2027 set employer (secondary) Class 1 National Insurance at 15% on earnings above the secondary threshold of £5,000 a year for standard category letters. Add pension contributions, equipment, tooling licences and management time, and the cost per hour of available support rises quickly once you need more than standard office hours.
| In-house works well when | In-house struggles when |
|---|---|
| One site, office hours, steady volume | Users across time zones or shifts |
| Lots of physical, on-site work | Volume swings (onboarding waves, migrations, seasonal peaks) |
| Deep knowledge of bespoke systems matters most | A single person is the whole function and has no cover |
| You want to build a career path for IT staff | You need documented SLAs and reporting for audit, but nobody has time to run the process |
MSP: when it is the right answer
A managed service provider is the right answer when you have no IT function and want one supplier to run devices, network, Microsoft 365 or Google Workspace, backups, security tooling and support together. For a 100-person firm without an IT lead, that bundle is often the most sensible place to start.
Three things to check in an MSP contract, from our experience of taking over from MSPs:
- Ticket and data ownership. Ask whether ticket history, asset records and documentation can be exported in a usable format at exit, and at what cost.
- What “unlimited support” covers. Many bundles include remote support but charge projects, on-site visits and out-of-hours separately. Ask for the exclusions list.
- Reporting. Ask for a sample monthly report. If it shows only ticket counts, you will not be able to tell whether problems recur or whether SLAs are met in the hours that matter to you.
MSPs also run service desks, and a good one is a perfectly good choice. The difference is mostly packaging: an MSP sells IT outcomes as a bundle; an outsourced service desk sells a specific function you can measure and swap independently of infrastructure.
Outsourced service desk: when it is the right answer
An outsourced service desk is right when you already have IT ownership (an IT lead, an internal team, or an MSP for infrastructure) but the front line is under-staffed, needs longer hours, or needs a process. The provider takes intake on every channel, triages, resolves what it can, escalates the rest to your team or MSP, keeps the knowledge base current and reports against SLA every month.
The arrangement we recommend for most UK mid-market firms is in-house ownership plus an outsourced desk in your own tool: your IT lead owns priorities, changes and vendors; the desk handles volume and hours. If you do not yet have an ITSM tool, start there; our shared inbox to first ITSM tool guide covers the options.
| Outsourced desk works well when | Outsourced desk struggles when |
|---|---|
| You have someone internal who owns IT decisions | Nobody internal owns IT; then an MSP bundle is usually better |
| You need cover beyond office hours or for peaks | Most work is hands-on and on-site |
| You want SLA reporting and a working knowledge base | Systems are undocumented and nobody will help write runbooks during transition |
| You want to keep the option to insource later | You want one supplier accountable for infrastructure and support together |
UK GDPR when the desk is delivered from India
If your provider delivers the desk from India, the first question a UK DPO asks is whether that is allowed. The short answer is yes, with the right safeguards. The longer answer:
1. It is a restricted transfer
The UK government publishes the list of countries, territories and frameworks covered by UK adequacy regulations (sometimes called data bridges). On the GOV.UK list we checked on Nov 10, 2026, India is not included. The list covers the EU and EEA states plus places such as Andorra, Argentina, Canada (partial), Faroe Islands, Gibraltar, Guernsey, Isle of Man, Israel, Japan (partial), Jersey, New Zealand, Republic of Korea, Switzerland, the United States (Data Privacy Framework) and Uruguay. If agents in India can access your users’ personal data (names, emails, device details, ticket content), that is a transfer to a country without UK adequacy.
2. Safeguards: the IDTA or the Addendum
GOV.UK explains that the UK International Data Transfer Agreement (IDTA) and the international data transfer Addendum to the EU Standard Contractual Clauses were laid before Parliament on 2 February 2022, and that exporters can use either as a transfer tool for transfers to non-adequate countries. In practice your provider should offer one of them as part of the contract, alongside the controller-processor terms.
3. The “data protection test” since February 2026
The Data (Use and Access) Act 2025 rewrote the UK GDPR transfer rules. Schedule 7 came into force on 5 February 2026. Under the amended Article 46, a transfer is made subject to appropriate safeguards only if safeguards such as standard data protection clauses are in place and the controller or processor, acting reasonably and proportionately, considers that the “data protection test” is met: that the protection for the data subject after the transfer “would not be materially lower” than under UK law. What is reasonable and proportionate depends on all the circumstances, including the nature and volume of the data transferred.
For a service desk, that judgement is usually easier than people fear, because the data is mostly business contact details and ticket content, and the provider can work inside your UK- or EU-hosted tool rather than copying data to its own systems. Document it anyway.
What to ask an India-delivered provider
- Which transfer tool they sign: the IDTA, or the Addendum alongside EU SCCs
- Whether agents work inside your tool (data stays where your tool hosts it) or copy data elsewhere
- Access controls: SSO with your identity provider, MFA, least-privilege roles, and logging of agent actions
- Device and network controls for agents, and how remote access is recorded
- How they handle sensitive tickets (HR, legal, health) and whether those can be routed to your internal team only
- Breach notification commitments and sub-processor list
Your DPO, not your provider, makes the final call. A good provider makes the paperwork easy.
Support hours across UK and India time
India Standard Time is UTC+5:30 all year. The UK moves between GMT and British Summer Time; GOV.UK lists BST as running from 29 March to 25 October in 2026, and from 28 March to 31 October in 2027. So India is 5 hours 30 minutes ahead in UK winter and 4 hours 30 minutes ahead in UK summer.
| UK hours | India time in GMT months | India time in BST months |
|---|---|---|
| 08:00 to 18:00 | 13:30 to 23:30 | 12:30 to 22:30 |
| 09:00 to 17:30 | 14:30 to 23:00 | 13:30 to 22:00 |
| 07:00 to 22:00 (extended) | 12:30 to 03:30 next day | 11:30 to 02:30 next day |
A UK business day falls in an Indian afternoon and evening, which is a normal shift pattern for providers serving UK and European clients. Two practical points. First, ask how the provider staffs the clock change weeks, when UK hours shift by an hour against India. Second, early UK mornings (07:00 GMT is 12:30 in India) are easy to cover from India, which is often the hardest slot for an in-house team. Out-of-hours and weekend cover is a staffing and contract question, not a time-zone one: agree it explicitly.
Decision table: which model for which firm
| Your situation | Our recommendation |
|---|---|
| Under ~150 people, no IT lead, mostly Microsoft 365 and laptops | MSP bundle, with a contract that guarantees data export at exit |
| 150 to 1,000 people, an IT lead or small team, office hours are the pain point | In-house ownership plus an outsourced service desk in your own ITSM tool |
| Multiple sites or time zones, need extended hours | Outsourced desk for hours and volume; in-house or MSP for infrastructure and on-site |
| Heavy on-site, hands-on work (labs, retail, manufacturing floors) | In-house or MSP with on-site engineers; outsource only the remote front line |
| Regulated data, strict residency rules | Outsourced desk working only inside your tool, with documented transfer assessment; or keep sensitive queues in-house |
| Planning to insource in two to three years | Outsourced desk in your tool, so history and knowledge stay with you |
Whatever you choose, compare quotes on the same baseline: users, ticket volume by month, hours of cover, channels, what counts as Tier 1 and Tier 2, and what is excluded. Our pricing models guide shows how per-user, per-ticket and dedicated-agent quotes compare.
Best for, and wrong choice when
In-house is best for
Firms with steady, office-hours demand, lots of on-site work and systems that need deep local knowledge.
In-house is the wrong choice when
One or two people carry the whole function with no cover, or users need help outside office hours.
An MSP is best for
Firms without an IT lead that want devices, infrastructure, security and support from one supplier.
An MSP is the wrong choice when
You need to own your ticket history and reporting, or want to change support provider without changing infrastructure provider.
An outsourced service desk is best for
Firms with IT ownership that need hours, volume capacity and a working service process inside their own tool.
An outsourced service desk is the wrong choice when
Nobody internal owns IT decisions, or most work is physical and on-site.
Frequently asked questions
What is the difference between an MSP and an outsourced service desk?
An MSP usually sells a bundle of managed IT (devices, network, cloud, security and support) and often runs tickets in its own tools. An outsourced service desk sells the front-line support function, usually working inside your own ITSM tool so you keep the history and reports.
Is it legal under UK GDPR to have IT support delivered from India?
Yes, with safeguards. India is not on the UK government’s list of adequacy countries, so it is a restricted transfer. Use the IDTA or the Addendum to the EU SCCs and, under the rules in force since 5 February 2026, make a reasonable and proportionate judgement that protection is not materially lower than in the UK.
What changed for international transfers in 2026?
The Data (Use and Access) Act 2025, Schedule 7, came into force on 5 February 2026. It replaced the UK GDPR transfer articles with new ones built around a “data protection test”: protection after the transfer must not be materially lower than under UK law.
What is the time difference between the UK and India?
India Standard Time is UTC+5:30 with no daylight saving. India is 5 hours 30 minutes ahead of GMT and 4 hours 30 minutes ahead of British Summer Time, which in 2026 ran from 29 March to 25 October.
How much does employer National Insurance add to an in-house hire?
For 2026 to 2027, HMRC sets employer Class 1 National Insurance at 15% of earnings above the secondary threshold of £5,000 a year for standard category letters. Pension, equipment, tooling and cover come on top.
Can an outsourced service desk work alongside our MSP?
Yes. A common pattern is the MSP keeping infrastructure and on-site work while the outsourced desk handles intake, triage and remote resolution, escalating to the MSP under agreed rules.
Which model is cheapest?
It depends on hours, volume and scope. Price all three on the same baseline of users, monthly ticket volume, hours, channels and exclusions; our cost framework guide shows how.
How long does it take to move to an outsourced service desk?
Our own transition model runs discovery, shadow running, go-live with hypercare and then continuous improvement; for most mid-sized estates that is six to ten weeks from signature, longer where systems are poorly documented.