IT recruitment agency insurance

Reviewed by Matthew Bartlett, Director, Apex Insurance Brokers Limited · Last reviewed 2026-08-06

Recruiting for the technology sector is a strange hybrid of a business. You are part sales operation, part data processor, part professional adviser — and each of those faces carries its own liability. A software house that takes your word on a contractor’s skills, a candidate whose passport scan and salary history sit in your ATS, a client who disputes your fee after hiring your candidate through the “back door”: all of them can turn into a claim against your agency, and each needs a different type of cover to respond.

This guide walks through the insurance a UK IT recruitment or tech staffing business actually needs, what each policy responds to, and where the traps are — written for the owner of an agency, not for other insurance people.

What insurance does an IT recruitment agency actually need?

Four covers do most of the work, and it helps to be clear from the start about which are legally required and which are commercially essential:

• Professional indemnity (PI) for your recruitment activities — claims that a placement was negligent, a candidate was misrepresented, vetting was inadequate, or your advice caused a client financial loss. PI is not a statutory requirement for recruiters, but most client terms of business and framework agreements demand it, so in practice you cannot trade at any scale without it.
• Cyber insurance — because a recruitment database is a concentrated store of candidate personal data, which makes you both a UK GDPR data controller with serious obligations and an attractive target for attackers.
• Employers’ liability (EL) — a legal requirement under the Employers’ Liability (Compulsory Insurance) Act 1969 once you employ staff, with only narrow exceptions. If you have even one employed consultant or resourcer, you need it.
• Public liability (PL) — injury or property damage to third parties: a candidate slipping in your office, a laptop knocked over a client’s desk during an on-site meeting.

Around those four sit the practical extras: office contents and portable equipment, legal expenses cover (useful for commercial disputes and employment matters within your own team), and — if your consultants drive to client sites — making sure vehicles are insured for business use, not just commuting. None of these are glamorous, but a recruitment business runs on people, laptops and meetings, and all three go wrong occasionally.

Can a client really sue us over a bad placement?

Yes — and this is the claim scenario that makes recruitment PI genuinely different from the technology professional indemnity bought by the software firms you place people into. A developer’s PI responds to defective code and failed projects. Yours responds to allegations that the person you supplied, or the process by which you supplied them, fell short.

The patterns are consistent across the sector. A client alleges you misrepresented a candidate’s experience — the CV said five years of Kubernetes in production and the reality was a weekend course. A vetting failure: references not taken up, qualifications not checked, a right-to-work document not verified properly, and the client suffers cost or disruption as a result. A contractor placed into a critical project abandons it mid-delivery and the client looks to you for the cost of the gap. Or a candidate themselves claims your handling of their application — a botched reference, a disclosure to their current employer — caused them loss.

Whether these claims ultimately succeed is almost beside the point. Defending an allegation of negligence is expensive and slow, and a well-arranged recruitment PI policy pays for the defence as well as any damages or settlement. That defence-cost function is, in practice, the thing agencies use most.

One important boundary: if you place contractors, you will constantly bump into IR35 — the off-payroll working rules. IR35 is a tax matter about employment status for tax purposes. No insurance policy changes or determines a contractor’s IR35 status, and you should treat any suggestion otherwise with suspicion. For status questions, your agency and your clients need a qualified accountant or tax adviser; your insurance programme sits alongside that advice, it does not substitute for it.

What about fee disputes and clients hiring through the back door?

Ask any established recruiter what actually ends up in dispute and the honest answer is usually fees, not negligence. A client interviews your candidate, goes quiet, then hires them directly three months later. Two agencies both claim the introduction. A client argues your terms of business were never agreed, or that the rebate clause applies, or that the placement fee was calculated on the wrong salary figure.

These are commercial contract disputes, and it matters to understand how they interact with insurance. A pure debt-recovery action — chasing a fee you are owed — is generally not what PI is for; that is where commercial legal expenses cover earns its keep. But fee disputes frequently arrive dressed as something else: the client withholds the fee and counterclaims that the placement was negligent or the candidate misrepresented. At that point your PI policy is squarely engaged, because you are defending an allegation of professional failure, not merely arguing about money.

The practical lesson is twofold. First, tight, consistently-issued terms of business prevent more losses than any policy will ever pay. Second, when you buy PI, make sure the insurer understands you are a recruitment business — a policy written for a generic “consultancy” may not respond cleanly to introduction-fee counterclaims or claims arising from the acts of the candidates you supply. This is exactly the kind of wording detail a specialist broker checks before you buy, not after a claim. If you would rather talk it through than read policy schedules, speak to an Apex specialist — it is a short conversation that saves long arguments later.

Why are recruitment agencies such a target for cyber attacks?

Think about what sits in an average IT recruitment agency’s systems: thousands of CVs; names, addresses, phone numbers and email addresses; salary histories and expectations; passport and visa scans gathered for right-to-work checks; references; sometimes bank details for contractor payroll. That is a dense, well-organised store of exactly the personal data identity fraudsters want — and it is all personal data under the UK GDPR and the Data Protection Act 2018, regulated by the Information Commissioner’s Office (ICO).

The exposure runs in two directions. If your systems are breached, you face the operational cost of investigating and containing the incident, notifying the ICO where required, and telling affected candidates — people whose goodwill your business depends on. Candidates or clients who suffer loss can bring claims against you. And a serious infringement can attract regulatory enforcement.

Recruitment also has a specific fraud profile worth naming. Agencies move money on predictable cycles — contractor payroll, client invoicing — which makes them a natural target for payment-diversion fraud: a convincing email purporting to come from a contractor or supplier asking to “update bank details” before the next run. Attackers also impersonate agencies to defraud job seekers, which is a brand and trust problem even when your own systems were never touched. Simple controls — call-back verification for any bank-detail change, multi-factor authentication everywhere, restricted access to the candidate database — do a great deal of the work, and insurers increasingly expect to see them.

What does cyber insurance actually pay for — and does it cover GDPR fines?

A good cyber policy for a recruitment business funds three things. First, incident response: forensic investigators to work out what happened, legal advice on your notification obligations, credit-monitoring or support for affected candidates, and PR help if the story travels. Second, your own losses: business interruption while your CRM and ATS are down (a recruitment agency locked out of its database is, functionally, closed), data restoration, and — where the policy includes it and conditions are met — cyber crime losses such as funds diverted by fraud. Third, third-party liability: claims from candidates or clients whose data was compromised.

On fines, be careful with what you are sold. Whether UK GDPR or other data-protection fines can be insured at all is legally uncertain, and cyber policies commonly exclude or restrict fine cover. No honest broker will tell you a policy definitely pays a regulatory fine. The realistic value of cyber insurance is everything around the fine: the emergency response, the lost income, the legal costs of dealing with the ICO, and the liability claims. Buy it for that, and treat good data-protection practice — minimising the data you keep, deleting stale candidate records, securing right-to-work documents — as the thing that actually protects you from enforcement. Our guide to how cyber insurance works goes deeper on what these policies do and don’t respond to.

Do we legally need employers’ liability insurance?

Almost certainly, yes. Under the Employers’ Liability (Compulsory Insurance) Act 1969, UK employers must hold employers’ liability insurance — usually with a minimum limit of £5 million, and £10 million is the market norm — from the moment they take on staff, with only narrow exceptions such as certain family-only businesses. For a recruitment agency that means your consultants, resourcers, marketers and back-office team, whether employed or, in many cases, working for you on a casual basis.

Staffing businesses have an extra wrinkle: the workers you supply. If you operate as an employment business — engaging temporary workers or contractors under contracts with your agency and supplying them to clients — the question of who is responsible for those workers, and whose insurance responds if one of them is injured or causes injury, depends on the contractual chain and how your model is set up. Do not guess at this. Describe your model to your broker precisely — permanent placements only, temps on your payroll, limited-company contractors, umbrella arrangements — so the EL, PL and PI are arranged around the reality rather than an assumption. Misdescribing it is one of the most common ways staffing firms end up with cover that doesn’t match their exposure.

How do the employment agency conduct rules affect our insurance?

Recruitment is a regulated activity in the UK: employment agencies and employment businesses operate under specific conduct rules governing how they deal with both work-seekers and hirers — covering things like agreeing terms, the checks made on candidates and vacancies, and restrictions on charging work-seekers. We deliberately won’t recite chapter and verse here, because the detail depends on your model and you should take the rules themselves, or proper legal advice, as your source.

What matters for insurance is the relationship between compliance and claims. Insurance does not make you compliant, and no policy is a substitute for running your checks properly. But allegations that you failed in your duties to a candidate or client — inadequate vetting, checks not carried out, information not verified — are precisely the raw material of PI claims, and a policy arranged for recruitment activities is built to defend them. The two disciplines reinforce each other: strong compliance processes reduce the frequency of claims, and well-documented processes make the claims that do arrive far easier to defend.

What limits should an IT recruitment agency carry?

There is no universal answer, but there is a sensible method. For PI, start with your contracts: client terms of business and any framework or preferred-supplier agreements usually specify a minimum limit, and £1 million, £2 million and £5 million are common asks. Then sanity-check against your exposure — the seniority of the roles you fill, the value of the projects your contractors sit inside, and whether you supply into sectors like fintech where a placement failure has expensive consequences. For cyber, think about the number of candidate records you hold and what a fortnight without your database would cost; illustrative limits of £250,000 to £1 million are common starting points for smaller agencies, scaling with the data. EL is set by law at a minimum, and PL of £1 million to £5 million satisfies most office-based operations.

Two structural points matter more than the headline numbers. PI and cyber policies are typically written on a claims-made basis, meaning the policy in force when the claim is made responds — so keep cover continuous, and take advice before ever letting a policy lapse after a busy trading period. And make sure the covers meet in the middle: a candidate-data incident can trigger both cyber (the breach) and PI (the professional fallout), and it is a broker’s job to ensure the wordings hand off to each other rather than each pointing at the other. If your agency also does any consulting, RPO or managed-service work alongside placements, say so — the business description on a PI policy defines what is covered, and activities outside it are activities uninsured. You can set all of this out in a few minutes via our online proposal and we’ll come back with a considered recommendation rather than a form response.

Why arrange it through a technology-specialist broker?

Because an IT recruitment agency sits at the junction of two specialisms — recruitment liability and technology risk — and a generalist arrangement tends to serve one and neglect the other. Apex works with technology businesses day in, day out: the software houses and IT consultancies you recruit for, the contractors you place, and the agencies that connect them. That means we recognise the contract clauses your clients will send you, the difference between an employment agency and an employment business, and the data profile that makes your cyber risk what it is — and we place cover with insurers who understand recruitment rather than treating it as generic consultancy.

The result is not a stack of paperwork; it is an insurance programme that matches how you actually trade, reviewed as your desk mix, contractor book and headcount change.

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority (FRN 724952). This article is general information, not advice on a specific policy or a recommendation to buy any product.