Get Started

Cyber Liability Insurance in California

A person or business conducting business in California that owns or licenses computerized personal information must notify affected residents within 30 calendar days after discovery or notification if unencrypted personal information, or encrypted personal information plus its key or security credential, was or is reasonably believed acquired by an unauthorized person and the key or credential could make it readable or usable. For a single breach requiring notice to more than 500 California residents, the person or business required to issue consumer notice must submit a de-identified sample to the Attorney General within 15 calendar days after notifying consumers. 1,2

What Is Cyber Liability?

Cyber insurance can help pay covered response costs and claims against your business after a cyber incident. If your business relies on data, software or outside providers, compare response limits, vendor outages and approval rules. Read the national Cyber liability guide.

What to Watch for in California

  • A Fixed 30-Day Notice Window

    Effective January 1, 2026, California Civil Code § 1798.82(a) sets a 30-calendar-day period from discovery or notification for an individual or business conducting business in California that owns or licenses computerized data with qualifying personal information acquired, or reasonably believed acquired, by an unauthorized person. Necessary scope-and-integrity work and a law-enforcement delay can extend timing; a maintainer that does not own the data must notify its owner or licensee immediately after discovery. Ask how the response team distinguishes those roles and tracks the permitted delay grounds. 1

  • Send the AG a Sample Within 15 Days

    When a single breach requires notice to more than 500 California residents, the person or business required to issue the consumer notice must electronically submit a de-identified sample to the Attorney General within 15 calendar days after notifying consumers. Confirm the response service tracks this separate filing clock. 1,2

  • Some Breaches Can Lead to Consumer Lawsuits

    California’s limited private action applies when specified nonencrypted and nonredacted personal information, or email credentials allowing account access, is subject to unauthorized access and exfiltration, theft, or disclosure because a business violated its reasonable-security duty. Current statutory damages are $107–$799 per consumer per incident, or actual damages if greater (effective January 1, 2025); ask whether the policy responds to defense costs for such a claim. 3,4

  • California Prescribes the Notice Format

    California requires breach notices to use plain language, the title “Notice of Data Breach,” specified headings, and the listed minimum details. Substitute notice is a separate option only when the cost exceeds $250,000, the affected class exceeds 500,000 people, or contact information is insufficient; it requires email when available, conspicuous website posting for at least 30 days when a site is maintained, and statewide media notice. Ask who checks the notice method and format against the actual trigger. 1

Who Regulates Insurance in California

California Department of Insurance

The California Department of Insurance regulates insurers and insurance producers, provides company and license-status searches, and accepts complaints through its Consumer Complaint Center. Its commercial-insurance guidance explains the Department’s limited jurisdiction over surplus-line insurers. 7,8,9,10,20

Surplus-lines tax and stamping office

Reported tax rate: 3% of taxable premium when California is the insured's home state When California is your home state, the surplus-line broker tax is generally 3% of gross premiums less returned premiums. Ask the broker to show the home-state determination, taxable premium and any applicable exception; ordinary multistate reporting does not itself reduce the tax base. A broker generally must search the admitted market unless a California exemption or the qualified federal commercial-purchaser exception applies. CIGA does not protect claims under a surplus-line policy. 11,13,18,10,12,14,15,16,19

Surplus Line Association of California

  • California usually requires an admitted-market search: Before most nonadmitted placements, a broker must search among admitted insurers. After a public hearing and the required statutory findings, California’s Commissioner may exempt qualifying coverage or risks through an Export List order. The confidential written report remains required under §1763.1. Separately, §1763(h) waives the search for a commercial insured meeting California’s §1760.1(b) definition: the broker must first give written disclosure about possible admitted-market availability and its potential greater protection and oversight, then receive the insured’s written request for nonadmitted placement. The broker must ensure eligibility, with a safe harbor for reasonable reliance on information supplied in good faith. The federal exempt-commercial-purchaser route under §8205 has its own §8206 definition and requires disclosure about possible admitted-market availability and its potential greater protection and oversight, followed by the purchaser’s written request. Ask which route and eligibility criteria the broker relies on. 12,15,16,5,6,21
  • Separate tax calculation from allocation reporting: Section 1775.5 generally counts the entire premium for nonadmitted insurance placed in one transaction with one underwriter or group for a California-home-state insured. It has a separate interstate-motor-transit formula and exclusions for premiums on insurance placed by or through a special-lines surplus line broker under §1760.5 and the defined risk-financing portion of specified Superfund remediation products. CDI’s calendar-year 2025 instructions include policy-related fees in gross premium, say it does not collect the tax on risks outside the United States, and treat multistate allocation percentages as informational. Have the broker explain how those rules apply to your placement. 13,17,18

Providers With Documented State Licenses

These providers publish a national listing for Cyber liability; the state records document licenses for the entities and roles shown below. Some records rely on company-reported information rather than independent regulator verification. A national listing does not confirm the product is available in California. Check the regulator’s license lookup and confirm state availability for your business when requesting a quote.

  • At-BayAt-Bay Insurance Services LLCInsurance producer, Surplus-lines broker · checked 2026-09-28At-Bay’s license page lists P&C producer and surplus-lines broker license numbers for all 50 states and the District of Columbia. These are company disclosures and do not establish product availability in each jurisdiction. 22
  • CoalitionCoalition Insurance Solutions, Inc.Insurance producer, Surplus-lines broker · checked 2026-09-28Coalition’s license page lists producer and surplus-lines licenses for Coalition Insurance Solutions, Inc. in all 50 states and the District of Columbia. The page separately lists insurers; this record covers the brokerage entity only. 23
  • CorgiCorgi Insurance Services, Inc.Insurance producer · checked 2026-09-28Corgi’s company producer-license table lists 50 jurisdictions: 49 states and the District of Columbia, including DC license 3003091619. New Mexico does not appear in the table and is not included here; the omission does not establish that Corgi is unlicensed there. The company-reported table has no stated as-of date and does not establish product availability. 24
  • GallagherArthur J. Gallagher Risk Management Services, LLCInsurance producer · checked 2026-09-28Gallagher Small Business’s legal-information page gives the producer identification associated with the disclosed California license. The provider record treats this identifier as company-reported and not independently verified; no other state is recorded. 25
  • HiscoxHiscox Insurance Company Inc.Insurer · checked 2026-09-28Hiscox’s U.S. company information states that Hiscox Insurance Company Inc. is licensed in all 50 states and the District of Columbia. This is company-reported insurer authority for this entity and does not establish which company issues every Hiscox-branded product. 26
  • RiskCubeRiskCube Insurance Services, LLCInsurance producer · checked 2026-09-28RiskCube’s license page, effective February 11, 2026, lists property-and-casualty producer/broker licenses in California and Delaware and names NPN 21694336. The company says it is expanding its licensing footprint; no other states are listed. 28
  • TechInsuranceSpecialty Program Group LLCInsurance producer · checked 2026-09-28TechInsurance’s current licensing page names Specialty Program Group LLC / SPG Insurance Solutions and lists state license numbers, but labels Rhode Island “Individual licenses” rather than identifying a license for the named agency. RI is omitted because this disclosure does not establish agency authority there; this is a search limitation, not an assertion that the company is unlicensed. The remaining state entries are company-reported and are not an insurance product availability map. 29
  • The HartfordHartford Fire Insurance CompanyInsurer · checked 2026-09-28California DOI’s current company profile identifies Hartford Fire Insurance Company (NAIC 19682) as UNLIMITED-NORMAL for property and casualty, authorized since 7 January 1870. The source covers this insurer in California and does not map every Hartford product to an issuing subsidiary; no expiry/renewal date is shown. 30
  • TravelersThe Travelers Indemnity CompanyInsurer · checked 2026-09-28California DOI’s current company profile identifies The Travelers Indemnity Company (NAIC 25658) as UNLIMITED-NORMAL for property and casualty, authorized since 17 June 2002. The source covers this insurer in California and does not map every Travelers product to this issuing company; no expiry/renewal date is shown. 31
  • VouchVouch Specialty Insurance Services, LLCInsurance producer, Surplus-lines broker · checked 2026-09-28Vouch’s licenses page, effective January 16, 2025, lists producer licenses in all 50 states and DC. Its separate surplus-lines table includes Idaho number 870820, while a footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses. Because those statements conflict for Idaho, this record keeps Idaho producer-only and does not treat the table number as established agency surplus-lines authority. The page is company-reported and does not establish product availability. 32

Questions to Ask Before You Buy in California

  1. Has the incident-response plan been updated for California’s 30-calendar-day deadline and its permitted delays?
  2. Will the notification service submit a de-identified sample to the California Attorney General within 15 days when more than 500 residents need notice?
  3. Does the cyber liability coverage include defense costs for claims under California Civil Code § 1798.150?
  4. Who checks the California notice format and required headings before it is sent?

Cyber Liability in California: FAQ

How quickly must a business notify California residents after a breach? 1

Within 30 calendar days after discovery or notification, when qualifying unencrypted personal information—or encrypted personal information plus a key or security credential that could make it readable or usable—is acquired or reasonably believed acquired by an unauthorized person. A person or business conducting business in California must own or license that information; permitted investigation and law-enforcement delays may apply. 1

When must a business send a breach notice sample to California’s Attorney General? 1,2

Within 15 calendar days after consumer notice, for a single breach requiring notice to more than 500 California residents. The person or business required to issue the consumer notice sends the de-identified sample electronically. 1,2

Can California consumers sue a business after a data breach? 3,4

Yes, in a limited set of cases: specified nonencrypted and nonredacted personal information or account credentials must be subject to unauthorized access and exfiltration, theft, or disclosure because the business violated its reasonable-security duty. Statutory damages are currently $107–$799 per consumer per incident, or actual damages if greater. 3,4

Cyber Liability in Other States

Other Coverage in California

Sources

  1. SB-446 - Data Breaches: Customer Notification. California Legislature; Chapter 319, Statutes of 2025; Civil Code § 1798.82, as amended. Accessed 2026-09-28.
  2. Data Security Breach Reporting. California Department of Justice, Office of the Attorney General; Business breach reporting instructions; sample notice threshold. Accessed 2026-09-28.
  3. California Civil Code § 1798.150 - Personal Information Security Breaches. California Legislature; Civil Code § 1798.150(a)(1)(A), (b)–(c); limited claim trigger and adjustment cross-reference; current amount confirmed by CPPA. Accessed 2026-09-28.
  4. Updated Monetary Thresholds in CCPA. California Privacy Protection Agency; Effective January 1, 2025: Civil Code § 1798.150(a)(1)(A) per-consumer statutory damages range. Accessed 2026-09-28.
  5. California Insurance Code §1763. California Legislature; §1763(a): diligent search; (h)(1): defined commercial-insured written disclosure and subsequent request; (h)(2): broker eligibility responsibility and reasonable good-faith reliance. Accessed 2026-09-28.
  6. California Insurance Code §1760.1. California Legislature; §1760.1(b): commercial-insured definition at placement, risk manager, prior premiums and size criteria with periodic monetary adjustments; (o): qualified risk manager. Accessed 2026-09-28.
  7. California Department of Insurance. California Department of Insurance; Official agency homepage. Accessed 2026-09-28.
  8. Company and Agent/Broker Information. California Department of Insurance; State page linking license-status checks, company information, and surplus-line insurer resources. Accessed 2026-09-28.
  9. Consumer Complaint Center. California Department of Insurance; Consumer Complaint Center entry point to file an insurance complaint. Accessed 2026-09-28.
  10. Commercial Insurance Guide (Form 700, revised June 14, 2024). California Department of Insurance; Form 700 revision beneath heading; What Should I Expect from a Broker-Agent: CDI licensing role (line 333); Surplus Line Insurance: broker disclosure, limited CDI jurisdiction and CIGA exclusion (lines 448–449); Talk to Us: consumer hotline (line 942). Page retrieved September 28, 2026; revision date is not an access date. Accessed 2026-09-28.
  11. 2024 Annual Report of the Commissioner. California Department of Insurance; Page 169: surplus-line brokers pay 3.00% of surplus-line premiums under CIC § 1775.5. Accessed 2026-09-28.
  12. California Insurance Code § 1775.5. California Legislature; §1775.5(a) 3% of gross premiums less returns and specified exclusions; (b) entire-premium rule and separate interstate-motor-transit deductions; (e) defined blended finite-risk and risk-financing terms. Accessed 2026-09-28.
  13. 15 U.S.C. §8201: Reporting, payment, and allocation of premium taxes. U.S. House of Representatives, Office of the Law Revision Counsel; §8201(a) exclusive home-State premium-tax authority; (b)(1) interstate allocation procedures; (c) allocation reporting. Accessed 2026-09-28.
  14. 15 U.S.C. § 8205: Streamlined application for commercial purchasers. U.S. House of Representatives, Office of the Law Revision Counsel; §8205(1)-(2): broker disclosure that admitted insurance may or may not be available with greater protection and oversight, then purchaser written request; ECP eligibility separately defined in §8206(5). Accessed 2026-09-28.
  15. 15 U.S.C. § 8206, Definitions. U.S. House of Representatives, Office of the Law Revision Counsel; §8206(5) ECP eligibility including qualified risk manager, prior premiums and adjusted size/other criteria; (6) home State and affiliated-insured rules; (13) qualified risk manager. Accessed 2026-09-28.
  16. California Insurance Code § 1760.5. California Legislature, Legislative Counsel; §1760.5(g): premiums placed under the special-lines license are not subject to the §1775.5 broker tax. Accessed 2026-09-28.
  17. CDI FS-006, Surplus Line Broker and Special Lines Surplus Line Broker Insurance (Premium) Tax Return Instructions, revised 2025-11, calendar-year 2025. California Department of Insurance; Calendar-year 2025 instructions revised November 2025; page 2, lines 1–4: fees, outside-US risks, returns and 3%; page 5: allocation percentages informational. Accessed 2026-09-28.
  18. Association Constitution. Surplus Line Association of California; ArticleXV(1) Stamping Office filing function; XV(4) Commissioner-delegated duties subject to approved Plan of Operations. Accessed 2026-09-28.
  19. About the Department. California Department of Insurance; Department overview: insurer solvency oversight, agent/broker licensing, company market-conduct reviews, complaints, and insurance-industry regulation. Accessed 2026-09-29.
  20. California Insurance Code §1763.1. California Legislature; §1763.1(a): Commissioner order after public hearing and statutory findings; Export List exemptions retain confidential written report; restricted classes and continuing review. Accessed 2026-09-29.
  21. Licenses. At-Bay; Current producer introduction and state table; At-Bay Insurance Services LLC; P&C and surplus-lines identifiers. Accessed 2026-09-21.
  22. Licenses and Carriers. Coalition; Licenses and Carriers, re-read 22 September 2026: Insurance Licenses table for Coalition Insurance Solutions, Inc., national producer number 18419475, with producer and surplus-lines numbers for all 50 states and DC including California 0L76155, Georgia 196479, Texas 2199630 and 2205589, Pennsylvania 815731 and 817452, Colorado 539028 and Wisconsin 3000108852. Insurance Carriers table naming, with NAIC numbers, Allianz Underwriters Insurance Company 36420, Arch Specialty Insurance Company 21199, Ascot Specialty Insurance Company 45055, Ascot Insurance Company 23752, Aspen Specialty Insurance Company 10717, Chaucer Insurance Company DAC, Coalition Insurance Company 29530, Fireman's Fund Indemnity Corporation 11380, Fortegra Specialty Insurance Company 16823, Lloyd's of London, MSIG Specialty Insurance USA Inc. 34886, MS Transverse Specialty Insurance Company 41807, Steadfast Insurance Company 26387, Vantage Risk Specialty Insurance Company 16275 and Zurich American Insurance Company 16535. Accessed 2026-09-22.
  23. Insurance Producer Licenses. Corgi Insurance; Current complete Insurance Producer Licenses table for Corgi Insurance Services, Inc.; 50 rows covering 49 states and DC (DC 3003091619); no New Mexico row; no NPN or as-of date shown. Accessed 2026-09-28.
  24. Legal Information. Gallagher Small Business; Producer identification immediately above Quick Links. Accessed 2026-09-16.
  25. About Hiscox US Insurance. Hiscox; Hiscox Insurance Company Inc. NAIC 10200 as Chicago, IL domiciled insurer admitted or licensed in all 50 states and D.C.; Hiscox Inc. as general agent and Lloyd’s coverholder for Syndicates 33 and 3624; surplus-lines placements through licensed surplus-lines brokers; A.M. Best rating statement. Accessed 2026-09-16.
  26. Licenses. ERGO NEXT Insurance; Current entity-by-state license table reopened 28 September 2026: 50 rows under Next First Insurance Agency, Inc., including Washington, DC; New York rows instead list Next Insurance Services PC-1423070 and AP Intego BR-1198885. Accessed 2026-09-28.
  27. Licenses & Disclosures. RiskCube; Property & Casualty Producer/Broker Licenses; February 11, 2026 version. Accessed 2026-09-16.
  28. Insurance Licenses by State. TechInsurance; Current state table; identifies TechInsurance as a division of Specialty Program Group LLC d/b/a SPG Insurance Solutions; lists DC 3000041536 and labels Rhode Island “Individual licenses,” without an agency license number. Accessed 2026-09-28.
  29. Hartford Fire Insurance Company. California Department of Insurance; NAIC 19682; California Company ID 0085-1; authorized 01/07/1870; license status UNLIMITED-NORMAL; property and casualty; Connecticut domicile. No expiry/renewal field. Accessed 2026-09-28. Accessed 2026-09-28.
  30. Company Profile — Travelers Indemnity Company (The). California Department of Insurance; NAIC 25658; California Company ID 4772-0; authorized 06/17/2002; license status UNLIMITED-NORMAL; property and casualty; Connecticut domicile. No expiry/renewal field. Accessed 2026-09-28. Accessed 2026-09-28.
  31. Licenses. Vouch; Effective 16 January 2025: Vouch Specialty Insurance Services, LLC, NPN 19926463; P&C table (50 states and DC); surplus-lines table includes Idaho 870820; footnote says Georgia and Idaho do not issue agency-level surplus-lines licenses; Idaho retained as producer-only due to conflict. Accessed 2026-09-15.

Updated .

This guide is informational and does not determine whether a policy is available or meets your needs. Editorial policy. To suggest a correction, contact Spot with a supporting source.

Get Help With Insurance Buying and Renewals.

Get help buying coverage and managing renewals, with less paperwork for your team. Start with a free consultation.

Talk to Spot