Incident response
- 24/7 reporting line
- Forensic investigation
- Recovery and restart
Confidentiality · case files · professional secrecy
Cyber insurance for solicitors
At a law firm the breach itself is the loss: once court documents and client correspondence leave the office, the harm to the client can no longer be undone.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
Deze pagina in het Nederlands: Cyberverzekering voor advocaten.
Calculate your premium or request a quote
Without obligation; a reply within one working day.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert.nl or call 072 - 509 24 56 and we will take it from there.
Work out your own premium with the calculator.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
The duty of confidentiality and legal professional privilege make a cyber incident at a solicitor's office something other than an IT failure. What is held is exactly what an opposing party must not know: litigation strategy, draft writs of summons, room for settlement, witness statements. A leak of that cannot be solved with a restored back-up. Alongside the report to the Autoriteit Persoonsgegevens (the Dutch data protection authority) within 72 hours, professional disciplinary law comes into play here, and the question of whether you organised the care of the file properly.
That explains why the emphasis on this policy differs from that at firms holding mainly administrative data. What matters are the incident response cover which establishes within hours which files and which mailboxes have been affected, the guidance on informing clients and opposing parties, and the cover for crisis communication. Restoring systems and business interruption remain included, but are rarely the largest item here.
Note the dividing line with your professional indemnity insurance. If the outage causes an appeal period or a limitation period to expire, the complaint that the deadline was not monitored is a professional error; that claim is assessed on the BAV. If the client is harmed because his file became public, the third-party section of the cyber policy comes into play. In practice, report a claim on both policies and let the insurers decide between themselves which responds.
What does cyber insurance for solicitors cover?
The structure of the cover in three parts, with an overview per situation below.
Own damage
What the incident costs you yourself.
- Data recovery and reconstruction
- Business downtime
- Ransom under consideration
Liability
Claims from customers and data subjects.
- Claims after a data breach
- GDPR notification costs
- Legal assistance
What is covered
| Situation | Cyber | AVB | BAV |
|---|---|---|---|
| Ransomware brings your systems down | Yes | No | No |
| Data breach involving personal data | Yes | No | Sometimes |
| Costs of notification and informing those affected | Yes | No | No |
| Fraud through a falsified payment instruction | Sometimes | No | No |
| Administrative fine from the regulator | No | No | No |
| Hardware that is physically damaged | No | No | No |
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
A leaked file cannot be restored
A back-up helps with encrypted files, but not with documents that have been published or sold on. Attackers threaten this deliberately, because they know that the contents of a legal file are a means of pressure. The policy therefore has to deliver speed above all: forensic investigation into what was actually taken, legal guidance and press handling. Ask whether negotiators and communications advisers fall within the cover or only technical specialists.
The mailbox is the file
Correspondence with the client, the opposing party and the court runs by email, so that a single compromised account often exposes a complete file. Insurers therefore make multi-factor authentication on email a condition and not a recommendation. If it is not in place at the time of the incident, the payout may be reduced. The same applies to accounts of staff who have left the firm and have not been revoked.
Your duty of confidentiality conflicts with the investigation
Forensic investigation means that external specialists look inside your systems, which hold documents covered by legal professional privilege. Set out in advance how that is to be arranged: which party gets access, under what confidentiality undertaking and who keeps control. A policy that obliges you to accept a specific supplier may conflict on this point with your professional rules. Discuss that at the acceptance stage, not during the crisis.
What falls outside the cover
Not covered are disciplinary measures and administrative fines of a punitive nature, the harm your client suffers in his case because the opposing party obtained information, and structural improvements to your security. Intent and wilful recklessness fall outside the cover under Article 7:952 of the Dutch Civil Code. Damage to laptops and servers themselves is also excluded; that belongs under the business contents cover.
What does your premium depend on?
- Number of solicitors and support staff — The number of mailboxes and workstations determines how many points of access there are to secure.
- Areas of law in the practice — Criminal law, family law and corporate law each involve their own sensitivity of file content.
- Size of the digital archive — The longer closed files remain accessible online, the larger the extent of a breach.
- Email security — Multi-factor authentication, encrypted sending and a policy for departing staff are conditions of acceptance.
- Cover for crisis communication — Press handling and informing clients can be included or left out; that makes a difference to the premium.
- Claims history — An earlier compromised mailbox almost always leads to additional requirements before acceptance.
Insurers weigh these details differently. That is why comparing pays off.
How we arrange it
- You request a quoteWe take stock of your situation, your risk and your wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Frequently asked questions
The questions we are asked most often about this.
Does a data breach also affect our professional disciplinary position?
That is quite possible, because the care of confidential data is part of professional practice. The insurance does not pay a disciplinary measure; that is a sanction and not a loss. Many policies do reimburse the costs of legal assistance around the incident and the investigation into its extent. Check whether the costs of defending disciplinary proceedings are expressly included.
The outage makes us miss an appeal deadline. Which policy applies?
That claim is assessed on the professional indemnity insurance (BAV). The complaint is that the deadline was not monitored, even if the cause was an attack. The cyber policy pays for restoring the systems, the investigation and your own interruption, but not the loss your client suffers through the missed deadline.
Do we have to inform the opposing party if their data has leaked?
If their personal data was in your file and the risk to them is high, the duty to inform applies to them as well. That is awkward both legally and in terms of communication in a live case. Have the wording drawn up by the privacy lawyer available through the incident response team; those costs usually fall within the cover.
We work in a cloud case management system. Is there still a risk?
Yes. Responsibility for the files stays with the firm, even if a supplier provides the storage. The most common incident, moreover, is not a break-in at the supplier but a compromised staff account. You also carry the risk that the service is unreachable for days while hearings go ahead.
Read more
Similar pages
Also relevant
Ready to compare?
Request a quote without obligation. We will look at which insurer best matches your activities and your risk.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was written and checked by an adviser at Finass Verzekert. Last updated on .
The information on this page is general in nature and is not personal advice.