Corporate Liability Insurance in India: D&O, Cyber, PI and More Explained

Key Takeaways

• Corporate liability insurance is not one policy but a set of separate covers, each triggered by a different kind of allegation, and the gaps between them are where uninsured losses live.
• Directors and officers insurance responds to claims against individuals for wrongful acts in managing the company, and Section 197(13) of the Companies Act, 2013 provides that the premium is not treated as part of a covered officer’s remuneration unless that person is proved guilty.
• D&O cover is mandatory for all independent directors of the top 1,000 listed entities by market capitalisation under Regulation 25(10) of the SEBI LODR Regulations, 2015, a requirement effective from 1 January 2022.
• The Digital Personal Data Protection Act, 2023 carries penalties of up to 250 crore rupees for failure to take reasonable security safeguards, and the DPDP Rules were notified on 14 November 2025, which has made cyber liability a board level exposure rather than an IT one.
• The Public Liability Insurance Act, 1991 requires every owner handling a hazardous substance to hold insurance before handling begins, making it one of the few genuinely compulsory liability covers in India.
• Employer liability for workplace injury now sits under the Code on Social Security, 2020, brought into force on 21 November 2025, which repealed and subsumed the Employee’s Compensation Act, 1923.

Corporate liability insurance covers the money a company or its people become legally liable to pay when a third party alleges they were harmed by what the business did, decided, published, built or failed to secure. Indian companies buy it as separate policies rather than as one contract, because the allegations are different in kind. A customer injured on your premises, a regulator penalising your board, a client suing over a botched implementation and a data subject whose records leaked are four different claims requiring four different triggers. Building the programme means deciding which of those exposures you actually carry, and in what order to cover them.

What is corporate liability insurance?

Corporate liability insurance is the family of third party covers that respond to allegations against the company or its people, as distinct from first party covers that pay for damage to your own assets. Property insurance pays when your factory burns. Liability insurance pays when someone else says your factory harmed them. That division determines which policy answers a given event, and it is the first thing to establish before comparing quotations.

Every liability policy is built from the same components. There is an insuring clause that defines the trigger, a limit of indemnity expressed per claim and in the aggregate, a deductible or retention the insured bears, a set of exclusions, and a claims notification condition that is more important than most buyers realise. Late notification is one of the most common reasons a liability claim fails, and the deadline is set in the wording rather than by custom.

Liability policies also differ on how the trigger works in time. Commercial general liability in India is usually written on an occurrence basis, where the policy in force when the injury happened responds. Directors and officers, professional indemnity and cyber covers are usually written on a claims‑made basis, where the policy in force when the claim is first made responds, subject to a retroactive date. Switching insurers on a claims‑made cover without preserving continuity of the retroactive date can quietly delete years of protection.

Which liability covers do Indian companies actually need?

Match the cover to the allegation rather than to the job title of whoever is buying it. The table below sets out the standard trigger for each cover in an Indian corporate programme.

Cover	Responds when someone alleges
Directors and officers liability	A director or officer committed a wrongful act in managing the company
Commercial general liability	Your premises or operations caused third party injury or property damage
Professional indemnity	Your professional advice or service was negligent and caused financial loss
Cyber liability	A breach, outage or privacy failure in your systems caused loss to others
Product liability	A defective product you made, serviced or sold caused harm
Product recall	A defective product must be withdrawn from the market
Employer liability	An employee suffered injury or disease arising out of employment
Public liability under the 1991 Act	An accident involving a hazardous substance injured a member of the public
Commercial crime and fidelity	An employee or third party stole money or property from the business
Employment practices liability	An employee alleges wrongful dismissal, discrimination or harassment

Every entry above is subject to the wording, exclusions, sub‑limits and endorsements of the policy actually issued. The Liability Insurance range is organised along these lines precisely because no single contract carries all ten triggers.

What does directors and officers insurance cover?

D&O responds to claims against individuals, not against the company’s balance sheet in the first instance. It funds legal defence costs, settlements and awards where a director or officer is alleged to have committed a wrongful act in their capacity as a manager of the company. Claimants are typically shareholders, regulators, creditors, employees, customers or a liquidator.

The Indian statutory context has sharpened the exposure. Section 166 of the Companies Act, 2013 codifies directors’ duties, while Section 149(12) gives independent and non‑executive directors a partial safe harbour, limiting their liability to acts of omission or commission that occurred with their knowledge, were attributable through board processes, involved their consent or connivance, or where they had not acted diligently. That is protection, but it is protection that has to be argued, and arguing it costs money before any finding is made. D&O funds that argument.

Two further provisions matter commercially. Section 197(13) provides that where a company takes insurance for its managing director, whole‑time director, manager, chief executive officer, chief financial officer or company secretary against liability for negligence, default, misfeasance, breach of duty or breach of trust, the premium is not treated as part of that person’s remuneration, unless the person is proved guilty, in which case it is. Separately, Regulation 25(10) of the SEBI LODR Regulations, 2015 requires listed entities in the top 1,000 by market capitalisation to hold D&O cover for all independent directors, effective 1 January 2022.

Private companies frequently assume the exposure is a listed company problem. It is not. Investor rights agreements, down rounds, insolvency proceedings, statutory notices and employee claims all generate D&O allegations against unlisted boards, and a company approaching an IPO faces a distinct prospectus liability exposure that a standard Directors and Officers Insurance policy does not automatically absorb.

What does cyber liability insurance cover?

Cyber liability covers the third party and first party consequences of a security or privacy failure. The third party side answers claims from customers, partners and regulators. The first party side funds incident response, forensics, notification, business interruption and, where the wording allows, extortion related costs.

The Indian regulatory position changed materially with the Digital Personal Data Protection Act, 2023 and the DPDP Rules notified on 14 November 2025. The Act’s penalty schedule reaches up to 250 crore rupees for failure to take reasonable security safeguards to prevent a personal data breach, and up to 200 crore rupees for failures relating to breach notification or children’s data. Penalties of that scale move data protection from an IT budget question to a board agenda item, which is also why cyber and D&O increasingly get bought together.

One boundary is worth stating plainly, because it causes disputes. Cyber liability and technology errors and omissions cover adjacent but distinct exposures. The first answers a security or privacy failure, while the second answers an allegation that your product or service simply did not perform as promised. A software company can face both from a single incident, and the comparison of cyber insurance and technology errors and omissions cover sets out where each responds.

What does professional indemnity insurance cover?

Professional indemnity, also written as errors and omissions, responds where a client alleges that your professional advice or service was negligent, inadequate or late, and that the failure caused them financial loss. There is no bodily injury or property damage in a typical PI claim, which is exactly why commercial general liability does not answer it.

The cover matters most to firms whose deliverable is judgement rather than a physical good: consultancies, technology and engineering services, architects, accountants, clinical and healthcare services, recruitment firms and marketing agencies. It matters commercially even where the risk feels low, because client contracts increasingly specify a professional indemnity limit as a condition of engagement, and the limit demanded by a large customer is often higher than the firm would have chosen for itself.

PI is almost always written on a claims‑made basis with a retroactive date. Firms that change insurers should confirm the new policy preserves the original retroactive date, and firms that wind down a service line should consider run‑off cover, because a claim can arrive years after the work was delivered.

What do general and product liability cover?

Commercial general liability answers third party bodily injury and property damage arising from your premises and operations. It is the base layer of a liability programme and the cover most often demanded by landlords, principal contractors and enterprise customers.

Product liability sits next to it and answers harm caused by a defective product. Chapter VI of the Consumer Protection Act, 2019, at Sections 82 to 87, permits a product liability action against a product manufacturer, a product service provider or a product seller. Section 84 makes a manufacturer liable in a product liability action even where it proves it was not negligent or fraudulent in making an express warranty about the product, which is a meaningfully strict standard. Base general liability wordings usually treat products through a separate extension rather than as core cover, so any business placing goods in the market should confirm the extension is present and adequately sub‑limited. The difference between product liability and general liability is the single most common coverage misunderstanding among first‑time buyers.

Recall is a third, separate cover. A product liability policy pays for the harm a defective product caused. It does not pay the cost of withdrawing the remaining stock from the market, which is what product recall insurance is for.

Which liability covers are required by law in India?

Most corporate liability cover is contractual rather than compulsory, which surprises buyers who assume the opposite. Three obligations are genuinely statutory or regulatory.

• Hazardous substances. Section 4(1) of the Public Liability Insurance Act, 1991 requires every owner to take out one or more insurance policies before beginning to handle a hazardous substance, and to keep them renewed throughout the period of handling.
• Employee injury. Employer liability for injury and occupational disease arising out of employment now sits under the Code on Social Security, 2020, brought into force on 21 November 2025, which repealed the Employee’s Compensation Act, 1923 along with eight other enactments. Central and state rules were still being finalised at the time of writing.
• Listed company boards. Regulation 25(10) of the SEBI LODR Regulations, 2015 requires the top 1,000 listed entities by market capitalisation to hold D&O cover for all independent directors.

Beyond those, the practical compulsion comes from contracts. Customer master agreements, lease deeds, tender conditions, lender covenants and construction subcontracts routinely specify liability limits and certificate requirements, and those obligations bind just as tightly as a statute in commercial terms.

How should a company sequence its liability programme?

Sequence by exposure, not by premium. Start with what is compulsory, then cover what your contracts require, then cover the exposure that would be existential if it materialised, then fill in the remainder.

For most Indian companies the order runs like this. Statutory obligations first, because non‑compliance is not an insurance question. Contractual requirements second, because an uninsured contractual breach can cost you the customer as well as the claim. General liability third, since it is the broadest base layer. Then the covers matched to how your company actually earns money: professional indemnity for a services firm, product liability and recall for a manufacturer, cyber for a data‑heavy business, D&O once there are outside investors or an independent board.

Edify Insurance Brokers works across this whole map. It is a Bengaluru based corporate broking and risk consulting practice, founded in 2015 by insurance professionals, structuring programmes from employee benefits through property and transit, liability and specialty lines, and matching each submission to the insurers whose underwriting appetite genuinely fits the risk rather than sending it to the whole market and hoping.

Budget for the tax position while you sequence. Corporate and group policies continue to attract 18% GST, since the exemption effective 22 September 2025 applies only to individual life and health policies. Whether input tax credit is available depends on Section 17(5) of the CGST Act and your own facts, which is a question for your chartered accountant.

Conclusion

A corporate liability programme is a set of deliberate decisions about which allegations your business could face and which policy answers each one. The covers do not overlap neatly, the exclusions in one are often the insuring clause of another, and the gaps only become visible when a claim lands in one of them. Statutory duties under the Public Liability Insurance Act, the Code on Social Security and the SEBI listing regulations set the floor. Your contracts, your sector and your balance sheet set everything above it.

If you are mapping corporate liability cover for the first time and want the exposures ordered before you go to market, Contact Edify with your sector, headcount, turnover and the insurance clauses your customer contracts currently impose.

---

Frequently Asked Questions