Ransomware at the company, leaked customer data, a misconfigured system – digital losses can now affect any business, not just IT companies. The insurance response, though, is split: part of it lives in traditional liability cover, and a larger part in a separate product family, cyber insurance. This boundary article draws the line – factually.
The classic liability logic also applies in the digital space: if your professional mistake – a faulty software delivery, a wrong configuration, a botched migration – causes damage to your client, that's a matter for professional indemnity insurance (see the IT article). Likewise: if customer data in your care is corrupted or leaks out because of your mistake, a liability to pay compensation to third parties can arise – the extent to which professional cover extends to this depends on the policy terms, and should be clarified when requesting a quote.
Cyber insurance is a product with a different logic: at its centre is your own incident. Its typical elements: incident-response costs (IT experts, recovery), business-interruption losses, costs linked to a data-protection incident (notifying affected individuals, expenses connected with a regulatory procedure – within the framework of the applicable rules), handling ransomware situations, and typically a liability element towards third parties too. In other words: the cyber product deals with your own house burning down, liability cover deals with the flames spreading to someone else's – and where the two overlap depends on the specific product.
Data-handling obligations – incident notification, notifying affected individuals, accountability – exist under the applicable data-protection laws, independently of insurance. The role insurance can play here is easing the resulting costs, within the policy terms; whether regulatory fines can be insured at all is a limited question that depends on the legal system – no serious product makes easy promises about this. The lesson: data-protection compliance cannot be replaced by insurance – the two together provide protection.
If you work with customer data, systems or digital services: first assess your exposure (what could go down, what could leak, who it could harm), then check the digital lines in your existing cover (see the checklist), and if the picture is incomplete, it's worth opening up the world of cyber products in a separate discussion – that goes beyond the scope of this site, but I can help you get started: a free consultation.
An accounting firm can run into two kinds of digital trouble – and the two can be insured differently. The first: a staff member sends a payroll package to the wrong recipient – the client's data ends up with an unauthorised party, creating both a loss and a data-protection situation for the client. This is a professional mistake affecting a third party: it can be the territory of professional indemnity cover, under the policy terms. The second: the office's systems are encrypted by ransomware – its own operations go down, with recovery costs and incident handling. This is your own loss: the world of cyber insurance. A business that holds only one of the two products is left uncovered in the other scenario. That's why, when assessing digital risk, it's worth drawing up two lists: “what could I cause someone else” and “what could happen to me” – two columns, two product families.
A question tailored to your own trade? Book a free 20-minute consultation →
Free of charge, no obligation – at the end, you'll see exactly your options and the next step.
