Customer data · incident response · small business
Cyber insurance for self-employed professionals
For a sole trader, cyber insurance is above all the purchase of help: the obligations under the GDPR apply in full, while there is no IT department and no lawyer in-house to meet them.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert.nl or call 072 - 509 24 56 and we will take it from there.
Work out your own premium with the calculator.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
You are the controller for the personal data you record, whatever your size. In the event of a data breach you have to report it to the Autoriteit Persoonsgegevens (the Dutch data protection authority) within 72 hours and, where the risk to those concerned is high, inform them as well. That means establishing within three days what data has been affected, whose it is and how. Alongside your ordinary work that simply cannot be done; the incident responseteam is therefore the most important component of this policy.
The cover falls into three items that must not be confused. First party: restoring your systems and files and the turnover you lose while you are down. Third party: liability towards customers and clients whose data has leaked. And the costs of the duty to report itself: forensic investigation, legal guidance and informing those concerned. With ransomware an extortion module is added, with its own conditions.
What you arrange yourself determines whether the cover holds up. In the application, insurers ask questions about multi-factor authentication, back-ups and updates, and attach conditions to them. Answers that are not correct affect the duty of disclosure under Article 7:928 of the Dutch Civil Code and the consequences of this in Article 7:930 of the Dutch Civil Code. If you supply IT services to others, professional indemnity cover belongs alongside it; see the package for self-employed professionals in IT.
What does cyber insurance for self-employed professionals cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
The duty to report costs time you do not have
The 72-hour period starts running as soon as you become aware of the breach, not as soon as you have worked it out. In those days you have to establish the extent, draw up the report and, where necessary, inform customers, while your current work carries on. For a sole trader, access to forensic investigators and a privacy lawyer is therefore more valuable than the level of the sum insured.
Fraud is something other than hacking
A copied invoice with a changed bank account number, an email that appears to come from your client, a payment request you carry out yourself: in these cases there has been no break-in, you made the transfer. Many cyber policies cover only attacks on your systems and leave these social engineering out of account, or include them in a separate module with a lower limit. Check that point expressly in the quote.
Your security is a condition of cover
Multi-factor authentication on email and cloud storage, a back-up that is kept disconnected and has demonstrably been restored, and updates installed on time often appear as a warranty clause in the policy. If they are not in place at the time of the incident, the insurer may reduce the payout. So complete the questionnaire carefully and report any change in the way you work.
What falls outside the cover
Not covered are improvements to your security afterwards, equipment itself that is stolen or damaged, which falls under the business contents cover, fines in so far as they are not insurable under Dutch law, and intent or wilful recklessness under Article 7:952 of the Dutch Civil Code. Attacks arising from a vulnerability you knew about and left unaddressed, and damage caused by acts of war or state actors, are also excluded.
What does your premium depend on?
Type and quantity of personal data — Contact details alone are rated differently from medical, financial or other special categories of data.
Your sector — Healthcare, financial services and IT attract more targeted attacks than, say, skilled trades.
Dependence on your systems — How quickly work stops when systems fail determines whether interruption cover is needed and how wide it should be.
Security measures taken — Multi-factor authentication, back-up strategy and update policy determine both acceptance and conditions.
Sum insured and waiting period — The limit per event and the number of hours before the interruption cover starts are separate choices.
Earlier incidents — An earlier data breach or ransom incident weighs heavily and often leads to additional requirements in advance.
Insurers weigh these details differently. That is why comparing pays off.
How we arrange it
You request a quoteWe take stock of your activities, turnover and wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Does the GDPR apply to a sole trader without staff?
Yes. The GDPR makes no exception for company size. As soon as you process personal data, from customer addresses to a membership list, you are the controller with all the duties that go with it. That means a record of processing activities, agreements with the parties that process data for you, and in the event of a data breach the report to the Autoriteit Persoonsgegevens within 72 hours.
My client requires a data processing agreement. What does that mean?
It means you process data on his instructions, and that agreement sets out what you may do with the data, what security you apply and within what period you report a breach to him. That period is usually shorter than 72 hours. Set such agreements alongside your policy, because they help determine what you can be held liable for.
Does the insurer pay a ransom after a ransomware attack?
Only if an extortion module is included, and then only after consultation and prior consent. Conditions apply under sanctions legislation and the insurer first brings in negotiators and investigators. Payment also gives no certainty that you will get your data back; a disconnected and tested back-up remains the only reliable way out.
I work entirely in the cloud. Do I still need this?
Yes. Responsibility for the data stays with you, even if a supplier provides the storage. If your account is taken over or the service is down for days, that is your problem towards your customers. The policy covers your own interruption and the duty to report; under his terms the supplier usually pays little more than part of the subscription.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
