Data protection insurance – protecting your business from data breach risks

We examine the measures firms can take to protect themselves from data breaches and how data protection insurance can help minimise financial and reputational damage.

What is data protection insurance?

‘Data protection insurance’ is another term for cyber insurance, which, among other things, covers the financial and reputational impact of data breaches. For example, if customer information was stolen from your business. Under GDPR (General Data Protection Regulation) laws and the Data Protection Act 2018, there are strict rules (which can include fines) about how personal or sensitive information is kept and used. If that information is leaked as part of a cyber attack, data protection insurance can help cover the cost of managing and resolving the breach and help to mitigate damage to your business’ reputation.

This cover is usually part of a broader cyber insurance policy, which provides compensation for a wide range of cybersecurity issues.

What does data protection insurance cover?

Cyber insurance (which includes data protection) varies depending on the specific policy you choose. The main aim is to cover your losses and restore your business operations if your business is affected by a cyber breach or attack.

Policies typically cover:

• Incident investigation – provides expertise to help you find the source of the breach or attack and rectify your systems, recover data, and repair damage.

• Incident reporting – this includes informing relevant regulatory bodies that a breach has occurred and notifying anyone affected by a data leak. This includes cover for fines which are deemed to be legally insurable as, understandably, fines resulting from criminal acts can’t be insured.

• PR management costs – covers costs for managing reputational damage.

• Business interruption costs – compensates you for lost income as a result of the data breach.

• Liability costs – covers your legal expenses if third parties take you to court.

• Extortion – covers costs if criminals demand ransom payment to unblock malicious ‘ransomware’ software (although this can depend on your policy terms)

• Theft of own funds – covers monies and other financial assets, including identity theft.

Does data protection insurance cover fines?

As a general rule, cyber insurance doesn’t cover fines due to criminal or fraudulent acts. Policies normally cover legal and regulatory costs as long as they are deemed legally insurable.

What else isn’t covered by cyber insurance?

Like most insurance policies, you usually won’t be covered for acts of terrorism or cyber war. However, incident response costs will often be covered.

Why is data protection insurance important?

Latest government figures show 43% of businesses have experienced a cyber security breach or attack in the last year. Business owners are also acutely aware that techniques used by criminals will become more sophisticated as technology improves.

For criminals, data is hugely valuable, and almost all businesses store some sort of data – whether that’s information about staff or customers. Confidentiality of data is often a common part of most customer contracts. Criminals can sell that information, use it for their own activities, or hold businesses to ransom by locking access to it.

Organisations and businesses that store or process data must also follow GDPR rules. If a breach does happen and data has been compromised, firms can face severe penalties from the ICO.

Currently, the ICO imposes two levels of fines:

• The higher maximum – this is £17.5 million or 4% of your business’s total annual worldwide turnover, based on the last financial year (whichever is higher). This applies if firms fail to meet any data protection principles.

• The standard maximum – this is £8.7 million or 2% of your business’s total annual worldwide turnover, based on the last financial year (whichever is higher). This generally applies if your firm has failed to meet any other requirements set out in data protection laws.

Who needs data protection insurance?

Any business or organisation that relies on digital technology or uses data is at risk of a breach or attack and should consider data protection insurance. This includes:

• Businesses that handle personal data of customers, employees, or other stakeholders, such as contractors or suppliers.

• Organisations in regulated industries, like healthcare, finance, and education.

• Small and medium-sized enterprises (SMEs) and charities that don’t have the resources to handle data breaches effectively.

• Any organisation that relies on digital technology and data for its operations.

What are the key benefits of data protection insurance?

Cyber insurance and data protection cover provides reassurance that should the worst happen, you’ll have the support and expertise to get your business back on track. On a practical level, benefits include:

• Access to experts who can find the source of the breach and take steps to repair damage and recover data.

• Help meeting your regulatory responsibilities, such as notifying the ICO and those affected by the breach.

• Financial protection against the cost of data breaches so that your business is no worse off after an incident.

• Financial support to cover PR, minimise reputational damage, and maintain customer trust.

What affects the cost of data protection insurance?

The cost of your policy will depend on the risk your business faces. The higher the risk or the more sensitive the data, the more you can expect to pay. To work this out, insurers will consider a number of factors, including:

• The size and type of your business, as well as the industry it’s in.

• The type of data you manage and its sensitivity.

• Your business’s cyber security policy and how you audit and manage the risk of a breach.

• Your excess and the level of cover you choose.

How to choose the right data protection insurance policy

The right policy will depend on the nature of your business and the specific risks you need covered. If you’re not sure where to start, a cyber security expert or insurance broker can offer guidance and help highlight the risks your business faces, along with the most suitable solutions.

When you’re searching for a policy, you’ll need to consider:

• Risks and vulnerabilities – understanding which areas of your business could be compromised can help you focus on the type of protection you need.

• The right level of cover for the risks you face – for example, how much compensation might you need to rectify damaged systems.

• Exclusions – be aware of what isn’t covered by your policy.

• Terms and conditions – if you don’t meet any specific conditions (like regularly auditing your cyber security measures), you can risk invalidating your policy.

• Comparing quotes from different insurers to find the best options for your needs and your budget.

FAQs

Data protection and cyber insurance for peace of mind

Protecting sensitive data is becoming increasingly important, particularly as technology improves and cyber attacks and criminals become more sophisticated. Adequate data security also helps you to protect your business’ reputation.

But even with robust policies and procedures in place, there’s still a risk that something could go wrong, which is where cyber insurance can help. Policies are a safety net, designed to limit the financial and reputational fallout of a breach or attack that’s beyond your control.

To find out more about tailored cyber and data protection insurance and how it can help your business deal with security and data breaches, speak to us on 01603 218000.