What Insurance Covers Privacy Lawsuits?

A claim that a business exposed, misused, or failed to protect personal information may fall under a cyber policy’s third-party privacy or security liability section. FTC guidance describes third-party cyber coverage as potentially addressing claims, legal proceedings, settlements, and regulatory inquiries after an incident. AIG’s specimen calls its relevant section Security and Privacy Liability and makes it claims-made-and-reported coverage. This is illustrative policy wording, not a statement that all privacy lawsuits are covered.

The allegation and remedy matter. A demand for damages, a class action, a regulator’s investigation, costs to notify affected people, and a statutory fine may be subject to different grants, definitions, limits, and insurability rules. Coverage may also depend on whether the event was accidental, involved a system-security failure, arose from a vendor, or was known before the policy began. Cyber liability is distinct from the company’s own breach-response costs.

Read the privacy-liability insuring agreement, definition of privacy event and personal information, who qualifies as an insured, claims-made reporting requirements, consent and defense provisions, vendor language, and exclusions for prior acts or intentional conduct. Check separate limits for regulatory costs and confirm with counsel whether a particular penalty is legally insurable.