Incident response
- 24/7 reporting line
- Forensic investigation
- Recovery and restart
Cyber insurance for employment agencies
An employment agency holds, for hundreds of people, exactly the set of data with which someone else can take over an identity: a copy of the identity document, citizen service number, address and bank account number.
- several insurers compared objectively
- 9.5 customer rating for a new policy
- AFM licence 12016589
- Personal 072 - 509 24 56, weekdays 9–17
This page in another language: Nederlands
Work out for yourself what it would cost.
Enter your details; you will receive a proposal within one working day.
- We compare the offerings of several insurers
- An adviser checks whether the cover suits your activities
- We arrange the switch, including cancellation
A premium indication, not personal advice. Prefer to talk it through? Call 072 - 509 24 56.
- Independent advice
- Several insurers
- Switching arranged
- Help with claims
In brief
The tax duty to retain records on the identification of employees requires you to keep copies of identity documents in the payroll administration. That creates a file more valuable to fraudsters than a customer list: a complete file per person, including salary details and bank account number. At an agency the number of people concerned quickly mounts up, because temporary workers from years ago are still on file.
There is also a weekly flow of payments. Payroll processing is a recurring, predictable moment, and that is precisely what makes it suitable for fraud with changed bank account numbers or a forged payment batch. The practical question is not whether your firewall is set up properly, but whether someone is allowed to make a change on the basis of an email alone.
If you mainly place people in advisory or recruitment roles rather than handling payroll, the cyber insurance for HR advice fits better; for your own office IT, the general business version the starting point.
Independent, personal, sorted quickly
We compare your cyber insurance across dozens of insurers, explain where the real differences lie, and arrange the switch from start to finish — without you having to chase it yourself.
Cyber insurancePhoto coming soon
ComparePhoto coming soon
Get coveredPhoto coming soon
What does cyber insurance for employment agencies cover?
The structure of the cover in three parts, with an overview per situation below.
Own damage
What the incident costs you yourself.
- Data recovery and reconstruction
- Business downtime
- Ransom under consideration
Liability
Claims from customers and data subjects.
- Claims after a data breach
- GDPR notification costs
- Legal assistance
What is covered
| Situation | Cyber | AVB | BAV |
|---|---|---|---|
| Ransomware brings your systems down | Yes | No | No |
| Data breach involving personal data | Yes | No | Sometimes |
| Costs of notification and informing those affected | Yes | No | No |
| Fraud through a falsified payment instruction | Sometimes | No | No |
| Administrative fine from the regulator | No | No | No |
| Hardware that is physically damaged | No | No | No |
This overview is general in nature and is not personal advice. What is actually covered, including exclusions, limits and the excess, is set out in the policy conditions and the insurance card (verzekeringskaart) of the insurer; you receive both before you take out cover. Taking out cover without advice? Then read what execution only means for you.
What does your premium depend on?
- Number of current and former temporary workers on file. The total number of people whose data you still hold determines the scale of the duty to report after a breach.
- Nature of the data retained. Copies of identity documents and citizen service numbers weigh more heavily than ordinary contact details.
- Frequency and volume of payroll processing. A weekly payroll run offers more opportunities for payment fraud than a monthly one.
- Checks on changes to payment details. Call-back verification and two-person authorisation on changes are the most heavily weighted measure here.
- Links with hirers and time recording systems. Every portal or link through which data is exchanged is another point of access and of possible leakage.
- Number of branches and temporary office staff. Changing consultants with access to the candidate database increase the number of accounts to manage.
Insurers weigh these details differently. That is where your saving is.
How we arrange it
- You request a quoteWe take stock of your situation, your risk and your wishes.
- We compareseveral insurers, on premium as well as conditions.
- You receive a proposalWith an explanation of the differences and the exclusions.
- We arrange the switchIncluding cancellation, so there is no gap in cover.
Why arrange it through Finass Verzekert?
We look at the terms as well as the premium, and stay your point of contact when there is a claim.
Independent
We are not tied to one insurer and compare on the basis of an objective analysis of several companies.
One fixed adviser
You call or email someone who knows your file. No menu options, no changing call centres.
Switching without hassle
We cancel your old policy and align the start date, so you are never a day without cover.
Help with claims
We report the claim and monitor how it is handled. In urgent cases you can reach us on the emergency line.
9.5New policy
9.8Claims handling
Customers rate our service on four aspects: personal service, service delivery, availability and the outcome. The reviews are collected and published by NH1816 and come from customers who have actually taken out a policy with Finass Advies B.V. or reported a claim.
Where things go wrong in practice
Four points that make the difference between a policy that pays out and one that does not.
Identity documents make a breach weigh more heavily
A leak of email addresses is a nuisance. A leak of passport copies with citizen service numbers is material for identity fraud that runs on for years. The Autoriteit Persoonsgegevens (the Dutch data protection authority) assesses that risk as high, which means that alongside the report you almost always have to inform the people concerned as well. So limit who has access to the identification folder and delete what you no longer need to keep; old files only increase the number of people affected.
Every change of bank account number gets a second channel
The most common scenario is not spectacular: an attacker takes over the mailbox of a temporary worker or of a payroll administrator and requests a change of bank account number just before the payroll run. So work with a call back to a number from the file and with two-person authorisation on the batch. Be aware that the salary amount transferred away is not covered on a standard cyber policy. That requires a separate section for deception in payments.
You are the processor for the hirer and the other way round
Hours, absence reports and sometimes appraisals go back and forth between your system and the hirer's. After a breach the first question is who was responsible for what. Record for each client which data you exchange and on what legal basis, and keep data processing agreements up to date. That determines not only the notification, but also who bears the loss and whether your sum insured is sufficient for claims from several directions at once.
What the policy does not solve
Administrative fines of a punitive nature are not insurable, including those from the labour inspectorate or the Autoriteit Persoonsgegevens. Salary you have to pay out again after a fraudulent change is not a data loss but a financial loss. And internal fraud by one of your own staff falls outside cyber cover; Article 7:952 of the Dutch Civil Code allows intent to be excluded. What is covered is forensic investigation, notification costs and the claims of temporary workers and clients.
Frequently asked questions
This is what people ask us most.
We keep copies of identity documents because we have to. Does that raise the premium?
Yes, because those documents make a breach riskier for those concerned and therefore more expensive in handling and claims. What helps is showing that the folder is protected, that only the payroll department can reach it and that you delete files as soon as the statutory retention period ends. Insurers are not concerned with whether you keep them, but with how many and for how long.
Salary has gone to a false bank account number. What does the policy pay?
Investigation of the break-in, restoring the mailbox, legal assistance and claims from the temporary worker affected generally fall under the cover. The amount you then have to pay out again does not, unless you separately included financial loss through deception. Insurers usually offer that extension only where there is a demonstrable verification procedure for changes of bank account number.
Our payroll processing is done by an external firm. Who is liable after a breach?
Towards the people concerned you remain the controller. The payroll firm is the processor. So you make the report and you inform the people. Whether you can recover the costs depends on the data processing agreement and the limitation of liability in it. Check whether your own policy covers notification costs and claims even where the incident arose at that processor.
What does the insurer expect from our security as a minimum?
Usually two-factor authentication on email and on the staffing software package, up-to-date patching, and back-ups that are tested and cannot be deleted from the working environment. For the payment flow, a verification procedure is added. What you enter about this is a disclosure within the meaning of Article 7:928 DCC; if the measure is missing when a loss occurs, the insurer may reduce the payout under Article 7:930 DCC.
Every situation is different. For these situations we have a separate page.
- Compare business cyber insuranceThe main page
- Cyber insurance for estate agentsClient data, transactions, fraud
- Cyber insurance for civil-law notariesClient money, transactions, confidentiality
- Cyber insurance for psychologistsTreatment records, confidentiality, duty to report
- Cyber insurance for mortgage advisersClient files, identity fraud, duty of care
- Cyber insurance for bookkeeping firmsPayroll data, payments, client data
- Cyber insurance for HR and recruitment agenciesCandidate data, screening, duty to report
- Cyber insurance for marketing agenciesClient accounts, advertising budget, data
- Cyber insurance for webshopsPayment details, customer data, downtime
Read more
Ready to compare?
Request a quote without obligation. We will look at which insurer best matches your activities and your risk.
Prefer to call? 072 - 509 24 56, weekdays 09:00–17:00.
Claim on the road? Emergency line 06 - 55 20 40 72.
About our service
Finass Verzekert is a trading name of Finass Advies B.V. We advise on and arrange non-life insurance on the basis of an objective analysis of several insurers, and receive commission for this from the insurer, which is included in the premium. You pay no separate advice fee. Before you take out cover, we establish your wishes and needs.
You will find our licence, KvK and Kifid details and our complaints procedure at the foot of every page.
This page was compiled by Finass Verzekert (LinkedIn). Last updated on .
The information on this page is general in nature and is not personal advice.