What Insurance Covers Data Breaches?

Cyber policies commonly distinguish the company’s breach-response costs from liability to customers, employees, or other affected parties. FTC guidance lists forensic investigation, legal advice about notification obligations, customer notification, call centers, data recovery, and interruption among possible first-party costs. It describes third-party coverage as potentially addressing consumer payments, claims, settlements, litigation, and regulatory inquiries. These are categories to examine, not guaranteed benefits in every quote.

A data breach may involve personal information held by your business or a vendor. The policy’s definition of a security or privacy event, the covered data, and any vendor extension determine whether the incident qualifies. AIG’s specimen cyber wording treats security and privacy liability as a separate third-party coverage section and imposes claims-made-and-reported conditions. Other policies can use different triggers.

Review whether the policy covers investigation and notification expenses, consumer claims, defense costs, and regulatory proceedings; whether fines or penalties are covered where legally insurable; and whether vendors’ systems are included. Check the retroactive date, notice requirements, approved response providers, retention, aggregate limit, sublimits, and whether defense costs erode the limit.