FCA authorised · FRN 724952 0117 325 0027Quote & buy →
IT and outsourcing
Yes: if you run payroll, process claims, key data or answer customers on another business’s behalf, you need professional indemnity insurance. The client hands you a process and relies on the output, so a processing error becomes its financial loss and then a claim against you. Public liability will not respond, because nobody was injured and nothing was physically damaged. PI usually pays your defence costs and any compensation you owe, and it works alongside cyber insurance when the mistake also exposes personal data.
Part of: Professional indemnity for IT professionals
In short
Business process outsourcing (BPO) providers are judged on accuracy, timeliness and how they handle data. The client usually stays answerable for the task you run: HMRC says an employer is legally responsible for PAYE even if it pays someone else to do it, and the FCA’s outsourcing rules leave a regulated firm fully responsible for functions it outsources. When something goes wrong, the client puts it right and then looks to you under the contract. PI usually covers allegations that your processing or service was negligent; cyber insurance covers your own costs after a breach or attack. Check how your policy treats service credits, contractual indemnities and data protection claims.
Last reviewed 5 October 2026 by the Apex professional indemnity team.
A client that outsources a process to you is buying an outcome: correct payslips on payday, claims registered against the right policy, clean records, customers given the right answer. When the outcome is wrong, the loss is almost always financial: staff paid the wrong amount, money sent to the wrong account, a regulator asking questions, customers leaving.
Public liability insurance answers claims for accidental injury and accidental damage to property, such as a visitor falling over a cable in your contact centre. It does not pay for a client’s financial loss caused by a mistake in the work you were hired to do.
Professional indemnity (PI) insurance does; for technology-enabled outsourcing it is often written as technology errors and omissions cover. It responds when a client alleges you were negligent, ignored its instructions or breached confidentiality. In a business-to-business contract that expectation is set by law: the Supply of Goods and Services Act 1982 implies a term that a supplier acting in the course of a business will carry out the service with reasonable care and skill. Your contract then adds service levels, data protection terms and often indemnities.
The scenarios below are illustrative. They show the kind of allegation BPO providers face; they are not real claims or outcomes.
Each alleges you did the job badly, not that you caused accidental damage, which makes PI the core policy for an outsourcing business.
Claims against outsourcing providers are argued against what the law expects of your client and what your contract says you would do. These reference points come up most often.
| Rule or standard | What it says | Why it matters to your PI |
|---|---|---|
| Supply of Goods and Services Act 1982, s.13 | In a business contract to supply a service, the supplier must carry out the service with reasonable care and skill. | The baseline for any negligence or contract claim, even where the contract is silent. |
| HMRC guidance on running payroll | An employer is legally responsible for completing all PAYE tasks, even if it pays someone else to do them. HMRC can charge a penalty if a Full Payment Submission is late, and the amount depends on how many employees the employer has. | The employer deals with HMRC first, then looks to the bureau that caused the problem. |
| UK GDPR, Article 28 | A processor must act only on the controller’s documented instructions, keep the data secure, use sub-processors only with authorisation, help the controller with breach notification, delete or return the data when the contract ends and allow audits. | These terms must be in the contract, so a breach of them is a contract claim and a data protection issue at the same time. |
| UK GDPR, Articles 33(2) and 82 | A processor must tell the controller about a personal data breach without undue delay. A processor is liable for damage caused by processing only where it has not complied with obligations directed to processors, or has acted outside or contrary to the controller’s lawful instructions. | Following documented instructions is your strongest defence. |
| FCA Handbook, SYSC 8 (outsourcing) | A regulated firm that outsources critical or important operational functions remains fully responsible for its regulatory obligations. The firm, its auditors and the FCA must have effective access to data about the outsourced activity and to the service provider’s premises. | Regulated clients push audit rights, controls and insurance requirements down to you. |
| PCI DSS | Applies to organisations that store, process or transmit cardholder data, including service providers. | A contact centre taking card payments is judged against it after any card data incident. |
| Usually covered by PI | Often excluded or limited | Needs a different policy |
|---|---|---|
| Errors in payroll, claims, data entry and other processing you carry out | Service credits, liquidated damages and rebates of your fees under the SLA | Your own response costs after a cyber attack or data breach (cyber insurance) |
| Failure to follow the client’s documented instructions or procedures | Indemnities and uncapped liabilities that go beyond what you would owe at law | Money stolen by your own staff, or your own funds paid to a fraudster (crime or fidelity cover) |
| Breach of confidentiality and data protection claims by clients, where the policy includes them | Client losses from payment fraud that your staff failed to stop, unless the wording covers them | Injury to visitors (public liability) and to your staff (employers’ liability) |
| Defence costs, including forensic accountants and other experts | Fines and penalties imposed on you | Claims against your directors personally (directors and officers cover) |
| Loss of or damage to client documents and records in your care, where included | Work delivered through offshore centres or subcontractors you did not declare | Damage to your own equipment and premises (property insurance) |
Cover is subject to the policy terms. Make sure the business description in your schedule includes payroll, claims handling or contact centre work if you do it; a policy written for an IT consultancy may not.
Many outsourcing contracts include a service level agreement with automatic service credits: miss a turnaround time, accuracy target or call-answer rate and the monthly charge goes down. Credits are a price adjustment you agreed to, not compensation for negligence, and PI policies commonly exclude them, along with liquidated damages and fee refunds.
One failure can therefore produce two bills. A missed payroll cut-off might trigger a service credit and also cause the client a wider loss, such as penalties or emergency manual payments. The credit is usually yours to absorb; the claim for the wider loss may fall within PI, subject to the policy terms.
Before you sign, look at how the contract and the policy fit together:
BPO work usually involves someone else’s personal data, so many incidents are a processing error and a data protection event at once. PI and cyber insurance split the consequences between them.
PI answers the client’s claim against you: the remediation it asks you to fund, its own losses and liability to individuals that it says you caused. Cyber insurance usually pays your own costs: forensic investigation, legal advice on notification, restoring systems and income lost while an attack stops you working. Many cyber policies also carry some data breach liability cover, which can overlap with PI.
Timing matters as well. Under the UK GDPR a processor must tell the controller about a personal data breach without undue delay, and the controller must report a notifiable breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Both your client and your insurers will expect prompt notification.
Read the data protection wording in your PI policy closely. Some include it in full, some limit it and expect a cyber policy to take the lead. Our guide to cyber insurance explains what each section of a cyber policy does.
Your PI limit is usually driven by your contracts. Outsourcing agreements tend to set a liability cap and an insurance clause together, and regulated clients often want your certificate before go-live. Set the limit by your largest contract, not your average one.
Some contracts also oblige you to keep PI for a set number of years after they end. Diarise that period: a lapse in cover can leave a gap.
A complete proposal gets better terms than a bare one, and a broker can only present what you tell us. Have these ready:
Speak to a broker
PI for business process outsourcing providers, placed by a named broker
Start the online proposal and save it as you go, or leave your number and a named broker will call you back, usually the same working day.
Apex Insurance Brokers is an independent insurance broker based in Bristol, established in 2009 and authorised and regulated by the Financial Conduct Authority. We are not tied to one insurer: we work with over 30 markets, including Lloyd’s syndicates through wholesale brokers, and every client has a named broker who handles the placement, mid-term changes, certificates for clients and the renewal.
Yes, if you run processes such as payroll, claims handling, data entry or customer contact for other businesses. Your errors cause financial loss to clients, and public liability does not cover financial loss. PI pays defence costs and compensation when a client alleges your processing or service was negligent, subject to the policy terms.
No UK law requires outsourcing providers in general to hold PI. In practice clients require it: outsourcing agreements usually contain an insurance clause with a minimum limit, and FCA-regulated clients, which remain fully responsible for the functions they outsource, commonly ask for evidence of cover before the service starts.
Usually not. Service credits, liquidated damages and refunds of your fees are commonly excluded, because they are agreed price adjustments rather than compensation for negligence. If the same failure causes the client a wider loss and it claims damages from you, PI may respond to that claim, subject to the policy terms.
It may. HMRC treats the employer as responsible for PAYE even when a bureau runs it, so the employer pays the penalty and may then claim its loss from you. PI can respond to that claim if your negligence caused it, subject to the wording. Fines or penalties imposed on you directly are usually excluded.
Usually, yes. PI usually deals with claims made against you by clients. Cyber insurance usually pays your own costs after a breach or attack, such as forensic investigation, legal advice, restoring systems and lost income. For a business holding payroll, claims or customer data, those costs often arrive before any client has made a claim.
Under the FCA’s outsourcing rules, a regulated firm that outsources critical or important functions stays fully responsible for its regulatory obligations, and the firm, its auditors and the FCA need effective access to data and premises. Expect audit rights, detailed controls, business continuity commitments and a minimum PI limit in the contract.
Apex arranges professional indemnity insurance for business process outsourcing providers across the UK. Tell us about your work and we’ll find cover that fits. Or call 0117 325 0027.
Start your PI proposal Call 0117 325 0027Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. Cover is always subject to the insurer’s acceptance and the policy terms, and this page does not guarantee that cover will be available or on what terms.
