Candidate data · citizen service numbers · payroll processing
Cyber insurance for employment agencies
An employment agency holds, for hundreds of people, exactly the set of data with which someone else can take over an identity: a copy of the identity document, citizen service number, address and bank account number.
The calculator and the quote form below are in Dutch. Prefer to do this in English? Email info@finassverzekert. nl or call 072 - 509 24 56 and we will take it from there.
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
We compare the offerings of several insurers
An adviser checks whether the cover suits your activities
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
In brief
The tax duty to retain records on the identification of employees requires you to keep copies of identity documents in the payroll administration. That creates a file more valuable to fraudsters than a customer list: a complete file per person, including salary details and bank account number. At an agency the number of people concerned quickly mounts up, because temporary workers from years ago are still on file.
There is also a weekly flow of payments. Payroll processing is a recurring, predictable moment, and that is precisely what makes it suitable for fraud with changed bank account numbers or a forged payment batch. The practical question is not whether your firewall is set up properly, but whether someone is allowed to make a change on the basis of an email alone.
What does cyber insurance for employment agencies cover?
The structure of the cover in three parts, with an overview per situation below.
Immediate help
Incident response
Specialists who look into it within hours.
24/7 reporting line
Forensic investigation
Recovery and restart
Your business
Own damage
What the incident costs you yourself.
Data recovery and reconstruction
Business downtime
Ransom under consideration
Towards third parties
Liability
Claims from customers and data subjects.
Claims after a data breach
GDPR notification costs
Legal assistance
What is covered
Situation
Cyber
AVB
BAV
Ransomware brings your systems down
Yes
No
No
Data breach involving personal data
Yes
No
Sometimes
Costs of notification and informing those affected
Yes
No
No
Fraud through a falsified payment instruction
Sometimes
No
No
Administrative fine from the regulator
No
No
No
Hardware that is physically damaged
No
No
No
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Identity documents make a breach weigh more heavily
A leak of email addresses is a nuisance. A leak of passport copies with citizen service numbers is material for identity fraud that runs on for years. The Autoriteit Persoonsgegevens (the Dutch data protection authority) assesses that risk as high, which means that alongside the report you almost always have to inform the people concerned as well. So limit who has access to the identification folder and delete what you no longer need to keep; old files only increase the number of people affected.
Every change of bank account number gets a second channel
The most common scenario is not spectacular: an attacker takes over the mailbox of a temporary worker or of a payroll administrator and requests a change of bank account number just before the payroll run. So work with a call back to a number from the file and with two-person authorisation on the batch. Be aware that the salary amount transferred away is not covered on a standard cyber policy. That requires a separate section for deception in payments.
You are the processor for the hirer and the other way round
Hours, absence reports and sometimes appraisals go back and forth between your system and the hirer's. After a breach the first question is who was responsible for what. Record for each client which data you exchange and on what legal basis, and keep data processing agreements up to date. That determines not only the notification, but also who bears the loss and whether your sum insured is sufficient for claims from several directions at once.
What the policy does not solve
Administrative fines of a punitive nature are not insurable, including those from the labour inspectorate or the Autoriteit Persoonsgegevens. Salary you have to pay out again after a fraudulent change is not a data loss but a financial loss. And internal fraud by one of your own staff falls outside cyber cover; Article 7:952 of the Dutch Civil Code allows intent to be excluded. What is covered is forensic investigation, notification costs and the claims of temporary workers and clients.
What does your premium depend on?
Number of current and former temporary workers on file. The total number of people whose data you still hold determines the scale of the duty to report after a breach.
Nature of the data retained. Copies of identity documents and citizen service numbers weigh more heavily than ordinary contact details.
Frequency and volume of payroll processing. A weekly payroll run offers more opportunities for payment fraud than a monthly one.
Checks on changes to payment details. Call-back verification and two-person authorisation on changes are the most heavily weighted measure here.
Links with hirers and time recording systems. Every portal or link through which data is exchanged is another point of access and of possible leakage.
Number of branches and temporary office staff. Changing consultants with access to the candidate database increase the number of accounts to manage.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
You request a quoteWe take stock of your situation, your risk and your wishes.
We compareseveral insurers, on premium as well as conditions.
You receive a proposalWith an explanation of the differences and the exclusions.
We arrange the switchIncluding cancellation, so there is no gap in cover.
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
We keep copies of identity documents because we have to. Does that raise the premium?
Yes, because those documents make a breach riskier for those concerned and therefore more expensive in handling and claims. What helps is showing that the folder is protected, that only the payroll department can reach it and that you delete files as soon as the statutory retention period ends. Insurers are not concerned with whether you keep them, but with how many and for how long.
Salary has gone to a false bank account number. What does the policy pay?
Investigation of the break-in, restoring the mailbox, legal assistance and claims from the temporary worker affected generally fall under the cover. The amount you then have to pay out again does not, unless you separately included financial loss through deception. Insurers usually offer that extension only where there is a demonstrable verification procedure for changes of bank account number.
Our payroll processing is done by an external firm. Who is liable after a breach?
Towards the people concerned you remain the controller. The payroll firm is the processor. So you make the report and you inform the people. Whether you can recover the costs depends on the data processing agreement and the limitation of liability in it. Check whether your own policy covers notification costs and claims even where the incident arose at that processor.
What does the insurer expect from our security as a minimum?
Usually two-factor authentication on email and on the staffing software package, up-to-date patching, and back-ups that are tested and cannot be deleted from the working environment. For the payment flow, a verification procedure is added. What you enter about this is a disclosure within the meaning of Article 7:928 DCC; if the measure is missing when a loss occurs, the insurer may reduce the payout under Article 7:930 DCC.
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
