Hiscox · compared independently · advice from Finass
Cyber insurance through Hiscox
In the cyber product we arrange through Hiscox the emphasis lies on what comes at you from outside after a data breach: a claim, an investigation and the costs of defence.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your situation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
Anyone who processes other people's data has a different cyber risk from someone running a production line. At service providers, agencies and digital businesses the largest item is not downtime but the claim from the party whose customer file, records or payment details were held by you. We mainly use this product where that is the case.
That shifts attention to the mechanics of liability: the claim has to be made within the policy period, defence costs may fall within or on top of the sum insured, and the boundary with your professional indemnity insurance is not always sharp. When comparing, we look precisely at that transition, so that a loss does not fall between two policies.
If your loss lies mainly in the hours during which work is at a standstill, cover with the emphasis on recovery makes more sense. We describe that side under cyber insurance through Hienfeld.
The structure of the cover in three parts, with an overview per situation below.
Basic cover
The basic cover insures the essentials. We show what Hiscox and other insurers offer here.
24/7 incident response (First Response)
Restoring systems, data & software
Forensic & IT investigation
Reporting a data breach (GDPR)
Extended cover
As well as restoration and assistance, also liability towards third parties, business interruption during downtime and crisis management.
Cyber liability (third parties)
Business interruption / network outage
Cyber extortion & ransomware
Crisis management & reputation repair
Complete package
The most complete cover. We compare Hiscox's extended versions with the market.
Fines from the regulator (AP / PCI-DSS)
Defence & legal costs
Worldwide cover
Retroactive cover (prior risk)
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Provided it is declared
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Provided it is declared
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
What we do
What we do
At Finass
Direct with Hiscox
Comparison across several insurers
Yes
No
Advice based on your own situation
Yes
Sometimes
One point of contact for claims
Yes
Sometimes
Cancellation with your current insurer arranged
Yes
No
We determine whether Hiscox is the best choice
Yes
No
Advice fees for you as a customer
No
No
This overview concerns our service, not the cover. What is actually covered is set out in the policy conditions and on the insurer's insurance card (verzekeringskaart); you receive both before you take out cover.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
The claim comes from the party whose data you held
If you process personal data for a client, you are the processor and you have a data processing agreement. That agreement often provides that you indemnify the client. Such an indemnity regularly goes further than what you would owe in law, and it is precisely that excess which is excluded on most cyber policies. So have contracts set alongside the policy conditions before you sign, not only once there is a breach.
Defence costs run even where a claim is unfounded
The most expensive part of a data breach file is often not the compensation but the investigation and the legal defence: the forensic report, correspondence with the regulator, informing those concerned. Those costs keep running, even if it turns out afterwards that you did nothing wrong. Check whether they fall within the sum insured or come on top of it. Your own hours and those of your staff are almost never reimbursed.
Claims-made: the date of the claim counts
With liability cover, the trigger is not the error but the claim. A breach from an earlier year that leads to a claim now is only covered with retroactive cover. If the policy ends, run-off cover is needed for claims that come in afterwards. Circumstances you already knew of at the start have to be disclosed under Article 7:928 of the Dutch Civil Code; known facts withheld cost you cover under 7:930 DCC.
A fine is not always insurable
An administrative fine from the Autoriteit Persoonsgegevens (the Dutch data protection authority) is punitive in nature. Whether it is insurable depends on the applicable law, and policies therefore cover it at most in so far as the law allows. The associated costs — defending the proceedings, the remediation plan, informing those concerned: generally are covered. Loss caused intentionally falls outside the cover in any event under Article 7:952 of the Dutch Civil Code.
Retroactive cover (prior risk)
Retroactive cover (prior risk) Included for your staff during work.
Defence & legal costs
What does your premium depend on?
Type of data. Health, payment and identity data weigh more heavily than a list of addresses without special categories.
Number of people concerned. The number of individuals in your files determines the scale of any duty to report and inform.
Contractual position. Data processing agreements with wide indemnities increase the risk that you carry more than the law requires.
Where your customers are based. Clients outside Europe bring different litigation risks from a purely Dutch customer base.
Retroactive date. Including earlier years widens the cover and feeds through into the premium.
Nature of the services. Advisory and processing work in which you influence customers' decisions is rated differently from pure execution.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Usually not the individual concerned, but your client. He is the controller, is held responsible and then recovers from you as the processor, often on the basis of the indemnity in the data processing agreement. The Autoriteit Persoonsgegevens may also open an investigation of its own. Those are two tracks running at the same time and both bring costs.
Do I need this alongside professional indemnity insurance?
Often yes, because the boundary is narrow. Advice that turns out badly is a professional error. A file that leaks usually is not. Without cyber cover, insurers point at each other where a file involves both. We therefore align the wording of the two policies and, where possible, keep them with the same insurer.
Is a fine from the Autoriteit Persoonsgegevens covered?
At most in so far as the law allows administrative fines to be insured, and that is limited. What is included are the costs around it: forensic investigation, legal assistance during the investigation, informing those concerned and setting up remedial measures. Ask us in advance which insurer words this most widely.
I have just discovered a breach from last year. Is that covered?
That depends on your retroactive date. This form of cover looks at the moment the claim is made, but excludes events from before the retroactive date. If you already knew of the incident when you took out the policy, it falls outside the cover because of the duty of disclosure. If you are only discovering it now and the retroactive cover reaches back far enough, there is scope.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
