Cyber insurance

What is cyber insurance?

Cyber insurance is a policy that pays for losses caused by attacks on, or failures of, computer systems and data. A business policy typically covers two kinds of loss: the firm's own costs of responding to an incident (first-party loss) and its legal liability to customers, partners and regulators whose data or systems were affected (third-party loss). Individual cyber policies in India focus on personal losses such as money stolen through phishing or identity theft.

Cyber cover exists because traditional property and liability policies were not written with data and networks in mind. Some older wordings neither include nor clearly exclude cyber losses, a problem the industry calls "silent cyber".

What cyber insurance covers

Exclusions commonly include war and state-backed attacks (with varying definitions), failure of public infrastructure such as power grids, known vulnerabilities left unpatched, and losses from the insured's own dishonesty.

How cyber insurance works in India

Cyber is a non-tariff, insurer-filed product under the IRDAI (Insurance Products) Regulations, 2024. In 2021 an IRDAI working group studied cyber liability insurance and IRDAI then issued guidance on the structure of individual cyber products, encouraging simple covers for the risks individuals face online. At the time, IRDAI said it had no plan to impose a single standard cyber product, and insurers continue to file their own wordings.

Two legal developments shape demand from businesses:

• CERT-In directions of 2022 require service providers and other entities to report specified cyber incidents within six hours. Fast reporting needs ready incident response support, which most policies now bundle through panel vendors.
• The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, notified in November 2025, set duties for organisations handling personal data and penalties of up to ₹250 crore per breach. Most obligations take effect in phases, with the bulk applying about 18 months after notification, that is around May 2027.

Underwriters price on the insured's security controls: multi-factor authentication, backups kept offline, patching, endpoint protection and employee training. Proposal forms are long, and inaccurate answers can defeat a claim.

What cyber insurance means for distribution

• The DPDP timeline is a selling window. Firms preparing for 2027 compliance are reviewing data risk now. Intermediaries who can explain which DPDP-related costs a cyber policy can and cannot cover (penalties may not be insurable in every case) add real value.
• MSMEs are the protection gap. Large companies buy cyber through brokers; small firms rarely do, though they face ransomware and payment fraud. Simple packaged covers sold through banks, payment platforms and accounting software can reach them.
• Individual cover fits digital journeys. Low-premium individual cyber policies bundled with bank accounts, cards, wallets or phones suit embedded distribution. The adviser should explain conditions such as reporting the fraud to the bank and police within set timelines.
• The proposal form is the claim. Overstating security controls is the commonest cause of cyber claim disputes. Distributors should help clients answer accurately and record what was disclosed.
• Incident response is the product. Clients value the 24-hour breach hotline and forensic panel as much as the money. Partners that understand how the insurer's response service works sell and renew better.
• Distributors are buyers too. Brokers, corporate agents and insurtechs hold large volumes of customer data. Their own cyber cover, and the cyber security expectations IRDAI places on regulated entities, deserve board attention.