Cyber Liability Insurance for Indian Businesses

What cyber liability insurance covers

India’s data protection landscape shifted meaningfully with the Digital Personal Data Protection Act, 2023 coming into force, alongside tightening sector-specific cybersecurity requirements from the RBI and IRDAI. For businesses of every size, data breach exposure is no longer a theoretical IT concern — it is a financial and legal risk sitting squarely in the CFO and founder’s remit.

First-party coverage — costs your own company incurs directly after an incident: forensic investigation to determine scope and cause; data recovery and system restoration; business interruption losses from downtime; customer and regulator notification costs, which can be substantial given DPDP notification obligations; ransomware-related costs including incident response; and crisis PR support.

Third-party liability coverage — claims made against you: legal defence and settlement costs from customers, partners or vendors whose data was compromised; regulatory investigation defence costs; and PCI compliance failure costs where relevant.

Why this matters beyond “tech companies”

A common misconception is that cyber insurance is only relevant for software or tech-first businesses. In reality, almost any company holding customer, employee or partner data — a manufacturer’s ERP system, a healthcare provider’s patient records, a retail chain’s loyalty database, an HR system full of employee PII — carries meaningful breach exposure.

The DPDP Act’s obligations around consent, data handling and breach notification apply broadly across sectors that process personal data, not narrowly to IT companies. While cyber insurance does not eliminate compliance obligations, it provides a financial backstop for the costs that follow an actual breach — costs that can otherwise be severe enough to threaten a smaller company’s continuity entirely.

Common cyber risks facing Indian businesses

• Ransomware — increasingly common across sectors, encrypting business-critical systems and demanding payment for restoration.
• Phishing and social engineering fraud — employees tricked into transferring funds or credentials.
• Third-party and vendor breaches — a breach at a SaaS provider you use can expose your data without any direct attack on your systems.
• Insider threats — data misuse or theft by current or former employees.
• Cloud misconfiguration — increasingly common as companies scale infrastructure faster than security practices mature.

What cyber insurance typically does NOT cover

• Losses from known, pre-existing vulnerabilities not disclosed at policy purchase.
• Intentional acts by the insured company’s leadership.
• Reputational harm not tied to a quantifiable financial loss, though crisis PR support is often included as a service.
• Betterment costs — upgrading security infrastructure beyond restoring the pre-incident state.
• Acts of war or state-sponsored attacks in many policies — an evolving and closely scrutinised exclusion given rising nation-state activity.

How insurers assess risk — what you will be asked

• What types and volumes of personal or sensitive data you handle.
• Security controls in place: encryption at rest and in transit, multi-factor authentication, access controls, patch management.
• Backup and disaster recovery practices, including how frequently backups are tested.
• Incident response plan maturity — do you have a documented plan, and has it been tested?
• Prior incident history and third-party vendor risk management practices.

Companies with stronger security postures generally receive more favourable pricing, which makes a cyber insurance evaluation a useful forcing function to actually document and improve security practices.

Choosing the right policy

• Coverage scope — does it include both first-party and third-party coverage, and does it explicitly address ransomware?
• Sub-limits — some policies cap specific costs like notification expenses or forensic investigation well below the headline limit.
• Panel providers — many insurers require using their approved panel of forensic investigators, legal counsel and PR firms. Check whether that panel is genuinely strong or a limiting factor.
• Retroactive date — ensures coverage applies to breaches discovered during the policy period even if the underlying vulnerability existed earlier.
• Business interruption trigger and waiting period — how quickly does interruption coverage begin after discovery?

Cyber sits alongside, not inside, D&O and professional indemnity cover — the three address different risks and are frequently confused.