Reviewed by licensed advisers at Smiths Insurance & KiwiSaver (FSP712931) · Updated 11 November 2026

IT Contractor Insurance NZ: Cover for Freelance Developers and Consultants

Most IT contractors in New Zealand start with professional indemnity insurance, which responds when a client says your code, advice or configuration cost them money. Cyber cover is the usual second layer, because policies for other risks generally do not respond to a data breach. The limit you need is normally set by the client contract, so read the insurance clause before you sign.

In short

Professional indemnity (PI) is the core cover for a developer, consultant or sysadmin. It is claims-made, so keep it continuous.
We did not find a licensing board for software work in New Zealand, so the push to insure comes from clients and contracts, not a regulator.
Cyber insurance pays your own response costs. Public liability and PI wordings often leave cyber events out, so check each one.
For personal life and income cover, see insurance for IT workers.

For the wider picture, see our business insurance guide.

What clients ask IT contractors for

A minimum PI limit in the master services agreement
A certificate of currency before the first invoice
Proof of cover to join an agency panel
An answer on cyber cover in the security questionnaire

A release breaks something

A shipped change takes down a client's checkout over a busy weekend.

Your device is compromised

Admin logins and API tokens on your laptop become a way into the client's systems.

A broad indemnity clause

Promising to cover "any loss" can go further than a PI policy does.

The spec was not met

A system that does not do what was promised, and the client wants the fix paid for.

Work out what to raise

Tick what applies to you

I ship code or configuration that clients rely on
A fault in what you deliver is the classic professional indemnity claim.
Covers to raise: Professional indemnity
I work through an agency or recruiter
Agency panels often ask for a certificate of currency.
Covers to raise: Professional indemnity
I hold admin logins or API tokens for clients
Covers to raise: Cyber, Professional indemnity
I touch customer or personal data
Covers to raise: Cyber
I build and sell my own product
Covers to raise: Professional indemnity, Cyber
I work at client offices
Mainly property damage or injury on their premises.
Covers to raise: Public liability
I carry a laptop and test devices around
Covers to raise: Tools and equipment
A contract has an uncapped or broad indemnity clause
Worth reading with the adviser before you sign.
Covers to raise: Professional indemnity

What these covers do not pay

The cost of redoing your own code or fixing your own bug is usually outside professional indemnity.
Liability you take on by contract beyond what the law would impose may not respond.
Public liability does not pay for financial loss from advice or software faults.
Fines and penalties are generally not covered.
Laptops left in an unlocked car or lost through carelessness may fall outside the gear cover.

General information only. Whether a cover responds depends on the policy wording.

Which clause is in your contract?

Limitation of liability
A cap on what you could owe the client if something goes wrong, often tied to your fees or a set figure. It can also exclude certain losses such as lost profit.
Covers to raise: Professional indemnity, Public liability
What it does not decide: It does not decide what your insurance pays. A cap in the contract may sit below or above your policy limit, and some claims, such as personal injury, may fall outside it.
Hold harmless
You agree to cover the other party's losses or claims connected to your work, sometimes including claims caused by their own actions. It is also called an indemnity clause.
Covers to raise: Public liability, Professional indemnity
What it does not decide: It does not decide whether your insurer will pay liability you took on only by contract. Many policies limit or exclude contractually assumed liability, so the wording matters.
Data and privacy duties
The contract asks you to protect client information, keep it secure and report a breach. It often refers to the Privacy Act 2020, which has its own duties on notifying serious breaches.
Covers to raise: Cyber, Professional indemnity
What it does not decide: It does not decide whether a breach is insured. Cyber policies differ on response costs, privacy claims and fines, and some penalties cannot be insured at all.

General information, not legal advice. The full clause and the policy wording decide how it applies.

Check your certificate of currency against the contract

Check the insured name, limit and dates match the contract. The policy wording, not the certificate, decides what is covered. How a certificate of currency works

What each cover may pay, and what it usually does not

Professional indemnity
May respond to
A client says your code, advice or configuration cost them money.
Common trigger
A missed requirement, a bug in production or a bad recommendation.
Usually not covered
The cost of redoing your own work and liability taken on by contract.
Cyber
May respond to
Your own response costs after ransomware, a breach or a compromised device.
Common trigger
Phishing, malware or stolen credentials on your systems.
Usually not covered
Upgrading your security afterwards. Client claims only where the policy has a liability section.
Public liability
May respond to
Injury or property damage you cause when working at a client's premises.
Common trigger
A cable trip or a knocked-over device at their office.
Usually not covered
Financial loss from software faults or advice.
Tools and equipment
May respond to
Laptops and test devices lost, stolen or damaged away from home.
Common trigger
Theft from a bag, car or co-working space.
Usually not covered
Wear and tear, and loss from unattended or unsecured gear.

If something goes wrong

A release takes down checkout
A change you shipped breaks a retailer's checkout over a busy weekend and they claim lost sales.
May respond: Professional indemnity
Have ready
- The contract and its liability clause
- The ticket or change record for the release
- Test notes and sign-off emails
- Dates the fault started and was fixed
Your laptop is compromised
Malware on your laptop exposes a client's admin login and someone gets into their systems.
May respond: Cyber, Professional indemnity
Have ready
- A list of the logins and tokens you held
- When you noticed and what you did first
- Any security questionnaire you answered for the client
The build misses the spec
A system goes live but does not do what the statement of work described, and the client wants the fix paid for.
May respond: Professional indemnity
Have ready
- The statement of work and any change requests
- Acceptance or sign-off records
- Messages where scope was discussed
Damage at a client office
You knock a client's monitor off a desk while setting up, and it breaks.
May respond: Public liability
Have ready
- Photos of the damage
- The site visit booking or email
- The client's repair or replacement quote

Typical examples, not real claims. ACC deals with most injuries, so an injury claim is mostly about property and legal costs. Whether a claim is paid depends on the policy wording and the facts.

Why a contractor is exposed

As an employee, a mistake is mostly your employer's problem. As a contractor it is yours, and so is the invoice that follows. A typical IT claim is a client saying:

A release you shipped broke their checkout over a busy weekend.
A migration you ran lost records, or left a gap in the backups.
A firewall or cloud setting you configured was too open.
A system you built did not do what the specification promised.

The loss is money, not injury or damaged property. That is professional indemnity territory, covered on our PI insurance page.

Who asks for cover

There is no software equivalent of an electrical or plumbing board. If you belong to a professional or certification body, read its rules, because membership terms can ask about insurance. In practice the ask comes from:

The master services agreement. Corporates, councils and agencies often set a minimum PI limit and ask for a certificate of currency before the first invoice.
The recruiter or platform. Agencies may ask for proof of cover as a condition of the panel.
The security questionnaire. Larger clients ask whether you hold cyber cover.

Our certificate of currency page explains the one-page proof.

Clauses to read before you sign

The limit. Per claim or in the aggregate for the year? A figure wildly larger than your fees is worth questioning, though whether the client changes it is their call.
Uncapped liability. With no cap, the policy limit becomes the practical ceiling on what is insured, not on what you owe. Ask whether a cap can be negotiated.
Indemnities. A promise to indemnify the client for "any loss" can go beyond a PI policy, because insurers often exclude liability you take on only by contract.
Run-off. Some contracts ask you to keep PI for a set number of years after the work ends.
Intellectual property. Under the Copyright Act 1994, a person who commissions and pays for a computer program is the first owner of its copyright, subject to any agreement to the contrary (s 21(3) and (4)). Your contract decides who owns the code, and often asks you to promise it infringes nobody's rights. Check whether your policy responds to that kind of claim.

Claims-made cover

The policy that responds is the one in force when the claim is made and notified, not when the work was done. Software problems surface late, and most money claims can be filed within six years of the act or omission, with a late-knowledge extension and a 15-year long stop (Limitation Act 2010, s 11). If you wind down or move to a salaried role, ask about run-off. When changing insurer, ask that the retroactive date carries over. For non-technical advisory work, see consultant insurance.

Cyber cover: the second layer

A PI policy answers a client's claim against you. It generally does not pay for your own laptop being ransomwared, your inbox being used to redirect a client's invoice, or the cost of notifying people after a breach.

Under the Privacy Act 2020, an agency must notify the Privacy Commissioner as soon as practicable after becoming aware of a notifiable privacy breach (s 114). If you hold personal information for a client, the Act treats the client as holding it, and you as well if you use or disclose it for your own purposes (s 11), so ask the client who carries the duty.

Contractors hold keys to other people's systems: admin logins, API tokens, repositories. Our cyber insurance page sets out what policies pay for and the controls insurers ask about, such as multi-factor authentication and tested backups.

What is usually excluded

Deliberate or fraudulent acts.
Claims or circumstances you knew about before the policy started.
Contractual penalties, such as liquidated damages for late delivery.
Liability accepted only by contract.
Bodily injury and property damage, which fall under public liability.
Work outside the services you described, such as moving from web development into security testing.
Fines. Health and safety fines can never be insured (Health and Safety at Work Act 2015, s 29).

Other covers

Public liability is mostly relevant if you work from a client's premises or clients visit you. ACC bars most claims for compensatory damages for personal injury (Accident Compensation Act 2001, s 317), so the claims that remain are mainly property damage. See public liability insurance.
Equipment. Ask whether a business or tool policy covers laptops away from home. See tool insurance.
Your own income. See ACC for contractors and insurance for contractors.
A company with a co-founder. See business protection.

How we help

A Smiths adviser will phone you to talk through which covers to look at. Some business covers we refer to another licensed Financial Advice Provider, and we will tell you who, and how they are paid, before your details go to that firm. Having your contract's insurance clause and a short description of your services to hand makes the call quicker. Smiths Insurance & KiwiSaver may receive a commission or referral payment if you buy. Cover and price depend on insurer underwriting and the policy wording. Financial advice is provided by Craig Smith Business Services Limited, trading as Smiths Insurance & KiwiSaver, a licensed Financial Advice Provider (FSP712931).

Frequently Asked Questions

Do IT contractors need insurance in NZ?

We did not find a law or licensing board that requires it. Clients and contracts often do. If a client could say they lost money relying on your work, the exposure exists whether or not anyone asks you to insure it.

What is the difference between PI and cyber insurance for a developer?

PI responds to a client's claim that your work or advice cost them money. Cyber cover responds to an incident such as ransomware or a breach, including your own response costs.

Does PI cover a bug in my code?

Often, if the bug led to a client's financial loss and the claim falls within the wording. The cost of fixing your own work, penalties and contract-only promises are treated differently.

Do I need cover if I work through an agency?

Check your agreement. Agencies commonly ask contractors for proof of cover. Do not assume the agency's policy protects you personally.

Can I insure a contract that has uncapped liability?

Some insurers will look at it. Show the clause to an adviser before you sign.

References

Related industries

Protect the people behind the business

Liability cover protects the business from claims. If you or a business partner could not work, or died, key person and shareholder cover can help keep the business, and your family, going.

Key person cover, if the business relies on you
Shareholder cover, so partners can buy each other out
Income protection for owners and the self-employed

Read the insurance clause before you sign

A licensed Smiths adviser phones you and asks what you build or advise on, who your clients are, and what the contract says about liability limits, IP and cyber. If we refer you to another licensed firm, we tell you who first. Smiths Insurance & KiwiSaver may receive a commission or referral payment if you buy.

A licensed Smiths adviser phones you. If we refer you to another licensed firm we tell you who first and how they are paid.

Read the full insurance guides

Explore related pages: Life Insurance, Income Protection, Health Insurance, Trauma Insurance, Guides.

Tell us how the business trades and a Smiths adviser will phone you to talk through which covers to look at. Check what cover you need. No cost to talk it through.