An HR or recruitment agency holds information that people deliberately keep hidden from their own employer, and that makes a breach here personal rather than financial.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
Your systems hold CVs, covering letters, interview notes, assessment reports, salary expectations and reference checks. For a candidate, the mere fact that he is applying is sensitive information: if it reaches his current employer, the damage is his position or his job. On top of that, you often serve two sides, the candidate and the client, and you have a different confidentiality arrangement with each. A breach affects both relationships at once.
In law you are on two tracks. For candidate data you are usually the controller yourself, with retention periods you have to set out and observe: normally a short period after the process ends, and longer only with consent. If you carry out work within a client's personnel administration, you are a processor there and the periods in his data processing agreement apply. In the event of a data breach, the report to the Autoriteit Persoonsgegevens (the Dutch data protection authority) within 72 hours applies, and where the risk is high so does the duty to inform the people concerned.
Pay particular attention to health information. Around sickness absence and reintegration you as an adviser may record only very limited data. That belongs with the company doctor. If medical information does appear in your files, that makes both the acceptance and the consequences of a breach more serious. Insurers ask about it expressly and incorrect answers affect the duty of disclosure under Article 7:928 of the Dutch Civil Code and the consequences of this in Article 7:930 of the Dutch Civil Code.
What does cyber insurance for HR and recruitment agencies cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
The loss falls on the candidate, not on you
If an application becomes known to the current employer, the candidate suffers concrete loss while you yourself have lost nothing. That is exactly what the third-party section exists for: claims from individuals after a breach, plus the legal assistance that goes with them. Reduce the risk by controlling access file by file and clearing out completed processes in line with your own retention period, and record that you demonstrably do so.
Assessment and screening reports weigh more heavily
A personality profile, an integrity investigation or a reference report contains judgements that were not intended for the person concerned and that can follow him for years. Keep such reports separate from ordinary candidate data and with restricted access. Also check whether the party carrying out the assessment is your processor. If so, there should be a data processing agreement in place with its own reporting deadline.
Phishing here targets changes to details
A message that appears to come from a placed candidate or from a contact at the client, asking for a bank account number or address to be changed, is a recurring scenario in this sector. Nobody has broken in there; someone has been manipulated, and that falls under the separate module for fraud and social engineering. Ask whether that module is included and what control procedure the insurer requires with it.
What falls outside the cover
Not covered are administrative fines of a punitive nature, placement fees lost because an assignment was withdrawn, and improving your systems afterwards. A complaint about the quality of your advice or of a candidate you put forward also belongs with the professional indemnity insurance (BAV). Intent and wilful recklessness remain excluded under Article 7:952 of the Dutch Civil Code.
What does your premium depend on?
Number of candidate files. The size of your database determines how many people you have to inform after a breach.
Retention periods and clearing out. Demonstrably deleting completed processes reduces the risk and counts towards acceptance.
Type of services. Recruitment, assessment, absence advice or interim placement each involve different data.
Health data in the files. Recording data around absence or reintegration makes the assessment more serious and often leads to additional requirements.
Number of clients where you act as processor. More data processing agreements means more contractual reporting deadlines that are shorter than 72 hours.
Access control per file. If every recruiter can see everything, the extent of an incident is greater from the outset.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
The usual line is a short period after the process ends, and longer only with the candidate's express consent for a talent pool. The GDPR sets no fixed period, but requires you to set one, record it and keep to it. After a breach, the question is whether data was still held that should no longer have been there.
A candidate holds us liable after a breach. What does the policy do?
The third-party section handles claims from individuals arising from a breach of their data, including the costs of defence. The insurer assesses whether you are liable and whether the loss is substantiated. Report a claim without delay; Article 7:941 of the Dutch Civil Code requires you to report an event as soon as it is reasonably possible to do so.
We use an external recruitment system. Who is responsible?
You remain the controller for the candidate data. The supplier is your processor and must report a breach to you. Your own duty to report to the Autoriteit Persoonsgegevens within 72 hours still stands. Set out contractually the period within which the supplier informs you and what investigation he provides, because without that information you cannot report.
May we record sickness absence data on a client's employees?
Only to a very limited extent. Data about the nature of the complaints and the treatment belongs with the company doctor and not in an HR file. If you do record it, you are processing health data with all the additional requirements that entails, and a breach is judged more seriously. Insurers ask about this explicitly at the acceptance stage.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
