An update that takes a web shop offline for a day, a migration in which data is lost, an integration that passes on wrong amounts. For the client such a mistake quickly costs more than what you were paid for the assignment. Without an agreement you are liable for that damage.
Three things limit your risk: terms and conditions with a cap on your liability, a data processing agreement if you process personal data, and insurance for what remains. This article goes through all three.
In short
- As a contractor you must exercise the care of a good contractor. Without an agreement you compensate all damage caused by a mistake. In terms and conditions you can limit that.
- Give the terms to the client before or when the contract is concluded, otherwise a small client can annul a clause. In the case of intent or wilful recklessness by management, the cap in the NLdigital Terms lapses.
- If you process personal data for a client, a data processing agreement is mandatory. Professional liability insurance is not required by law for IT, but clients and public bodies often ask for it.
In this article
What are you liable for if you agree nothing?
For all damage the client suffers through your mistake. Building software, managing systems and giving advice are usually a contract for services: work that does not produce a physical object (Civil Code Book 7, article 400). In doing so you must exercise the care of a good contractor (Civil Code Book 7, article 401).
If you do not, you fall short and compensate the damage. The law sets no amount above which you no longer have to pay. Consequential loss, such as turnover the client missed while its system was down, can also be included. That is why IT companies almost always agree a cap.
How do you limit your liability in terms and conditions?
With a cap on the amount and an exclusion of certain types of damage. Many IT companies use the industry terms of NLdigital for this. The NLdigital Terms 2025 are filed with the Midden-Nederland district court (NLdigital Terms 2025, display copy). According to NLdigital, more than 3,000 IT companies in the Netherlands use them (NLdigital, NLdigital Terms 2025).
In them, direct damage is limited to the price of the contract, excluding VAT. For a continuing contract of more than one year it is the price for one year. Total liability for direct damage is never more than € 500,000. Damage from death, injury or damage to property is limited to € 1,750,000 (NLdigital Terms 2025, articles 15.2 and 15.3).
Indirect damage, consequential loss, lost profit, missed savings, damage from business interruption and damage from claims by your client's customers are excluded (NLdigital Terms 2025, article 15.4). The client must first give you written notice of default with a reasonable period to put it right. A claim lapses 24 months after it arose (NLdigital Terms 2025, articles 15.7 and 15.8).
If you use your own terms, choose amounts that suit your assignments and your insurance. A cap higher than what your insurance covers is one you pay yourself in a large claim.
When does the limitation not work?
If you did not provide the terms in time, if the clause is unreasonably onerous, or if relying on it is unacceptable. A clause in terms and conditions can be annulled if it is unreasonably onerous, or if you gave the client no reasonable opportunity to read the terms (Civil Code Book 6, article 233).
You give that opportunity by providing the terms before or when the contract is concluded. Electronically is also allowed, if the client can save them (Civil Code Book 6, article 234). A link at the bottom of a quote is therefore not always enough. Send the terms as an attachment with the quote, and have the client sign that he has received them.
Not every client can rely on those rules. A legal entity that publishes its annual accounts, and a company with 50 or more people, cannot (Civil Code Book 6, article 235). The strictest lists of prohibited clauses apply only to consumers, and there a clause that frees you from paying compensation is presumed unreasonably onerous (Civil Code Book 6, articles 236 and 237).
For every client, moreover, an agreement does not apply if that would be unacceptable by standards of reasonableness and fairness (Civil Code Book 6, article 248(2)). The NLdigital Terms themselves drop the limitations if the damage results from intent or wilful recklessness of the management (NLdigital Terms 2025, article 15.6).
When do you need a data processing agreement?
If you process personal data on behalf of a client. Then you are a processor, and the client is the controller. Examples are a cloud service that stores personal data, or outsourced management. You must then have a data processing agreement (Dutch Data Protection Authority, controller and processor).
The agreement describes the subject and duration of the processing, its nature and purpose, the type of personal data and the groups of people they concern. Among other things it provides that you only act on the client's written instructions, that you secure the data and that you do not engage another processor without permission (GDPR, article 28). The NLdigital Terms have a separate chapter for this (NLdigital Terms 2025, article 28).
Liability matters here too. A processor is only liable for damage if it did not comply with the obligations the GDPR specifically imposes on processors, or if it acted outside or against the client's instructions (GDPR, article 82). If you only work according to the instructions and secure the data well, responsibility lies largely with the client. If you start deciding what the data is used for, you become responsible yourself (GDPR, article 28(10)).
A seconded employee working at the client under the client's authority is not a processor (Dutch Data Protection Authority, controller and processor). For secondment a data processing agreement is therefore usually not needed.
Which insurance does an IT company need?
Professional liability insurance covers financial damage from a professional error, such as a mistake in software or advice. It is required by law for accountants, lawyers, architects, financial advisers and notaries, among others, not for IT. Clients or agencies do sometimes require you to insure your liability, and public bodies often ask for it (Ondernemersplein, professional liability insurance).
Business liability insurance usually covers damage to people or property (Ondernemersplein, professional liability insurance). For most mistakes by an IT company, where nothing is physically broken but money is lost, it is therefore not enough.
Cyber insurance pays costs if you fall victim to a cyber incident, up to a maximum amount. What is covered differs per insurer. It supplements business and professional liability insurance and does not replace them. Insurers set conditions, such as antivirus and firewall software that updates automatically, a password policy and regular back-ups (KVK, cyber insurance).
How do you make terms, contract and insurance fit together?
Compare the cap in your terms with the insured amount on your policy. If a large client asks for a higher cap, that is a negotiation about price and risk, and a question for your insurer. Agree a different cap in writing in the contract itself, so that it is clear which rule prevails.
Research on 112 IT outsourcing contracts in the United States, from 1993 to 2003, grouped the provisions into four categories: monitoring, dispute resolution, protection of property rights and arrangements for when something goes wrong. The characteristics and risks of the assignment were related to which provisions the parties included, and the researchers also looked at the difference between a fixed price and time and materials (Chen & Bharadwaj, 2009).
For a small IT company it comes down to three questions. Have all my clients demonstrably received my terms? Do I have a data processing agreement with every client for whom I process personal data? And does my insurance cover the amount I have promised in my terms and contracts?
Sources
- Civil Code Book 7, articles 400 and 401, version in force from 8 October 2026. wetten.overheid.nl
- Civil Code Book 6, articles 233 to 237 and 248, version in force from 16 July 2026. wetten.overheid.nl
- NLdigital, NLdigital Terms 2025, display copy, articles 15 and 28. nldigital.nl
- NLdigital, NLdigital Terms 2025, accessed 31 October 2026. nldigital.nl
- General Data Protection Regulation, articles 28 and 82, as published by the Dutch Data Protection Authority. autoriteitpersoonsgegevens.nl
- Dutch Data Protection Authority, Controller and processor, accessed 31 October 2026. autoriteitpersoonsgegevens.nl
- Ondernemersplein, Professional liability insurance, accessed 31 October 2026. ondernemersplein.overheid.nl
- KVK, What is cyber insurance and do I need it?, updated 21 July 2025. kvk.nl
- Chen, Y. & Bharadwaj, A. (2009). An empirical analysis of contract structures in IT outsourcing. Information Systems Research, 20(4), 484-506. doi.org