Cyber Insurance in India: The Complete Business Guide

Key Takeaways

• Cyber insurance is a commercial policy that pays a company’s own costs after a security or privacy incident, such as forensics, data restoration, notification and lost income, and also answers third‑party claims arising from it, subject to the policy wording, exclusions and sub‑limits.
• No general statute in India requires private companies to buy cyber insurance; the pressure to hold it comes from incident‑reporting law, data protection penalties and customer contracts.
• CERT‑In’s directions of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, require specified cyber incidents to be reported within 6 hours of noticing them and ICT system logs to be kept within India for a rolling 180 days.
• The Schedule to the Digital Personal Data Protection Act, 2023 sets penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a personal data breach.
• Under the DPDP Rules, 2025 (G.S.R. 846(E), dated 13 November 2025), breach intimation to the Data Protection Board, including a detailed report within 72 hours, applies from 13 May 2027; a proposal to shorten that timeline had not been notified as of October 2026.
• Insurers accept and price cyber risk largely on security controls, so an inaccurate proposal‑form answer about multi‑factor authentication or backups can put the whole policy at risk when a claim is made.

Cyber insurance in India is a business policy that funds the response to a cyber incident and the claims that follow it. A typical corporate wording combines first‑party cover for the company’s own costs of forensics, restoration, notification, extortion response and lost income with third‑party cover for claims brought by customers, partners and regulators. What it actually pays depends on the wording, its exclusions and sub‑limits, and the security controls the company declared when it bought it. For a first‑time buyer, the real work lies in matching that wording to Indian reporting duties, existing contracts and how long the business can survive offline.

What is cyber insurance?

Cyber insurance is a commercial general insurance product built for losses that start in a computer system rather than in the physical world. Ransomware that encrypts your servers, a misconfigured cloud bucket that exposes customer records, a denial‑of‑service attack on your website and a supplier‑impersonation email that diverts a payment can all fall within its scope, depending on the sections purchased. The product exists because older policies were not written for these events. Property insurance is designed around fire, flood and physical damage to tangible assets, and general liability answers bodily injury and property damage suffered by third parties. Neither was built to pay a forensic firm at two in the morning, or to compensate a company whose premises are intact but whose systems are locked. Many traditional wordings now carry express cyber exclusions, which makes the gap explicit rather than accidental. Cyber cover is one component of a corporate liability programme, not a substitute for it. It sits alongside directors and officers cover, professional indemnity and crime insurance within the Liability Insurance range, and the boundaries between those policies matter more in cyber than anywhere else, because one incident can trigger several of them at once.

What does a cyber insurance policy cover?

Corporate cyber wordings in India are usually modular, with each section carrying its own limit or sub‑limit.

Section	What it pays for	Typical trigger
Incident response	Forensics, legal advice, breach coach, crisis communications	Discovery of a security or privacy incident
Data restoration	Recovering or rebuilding data and software	Data corrupted, encrypted or deleted by an attack
Business interruption	Lost net profit and extra expense while systems are down	A network outage from a covered event, after a waiting period
Cyber extortion	Specialist negotiators and, where wording and law allow, the payment	A threat to encrypt, leak or disrupt unless paid
Notification costs	Informing affected individuals and authorities	A personal data breach
Privacy and network liability	Defence costs and damages in third‑party claims	A claim alleging a data breach or security failure
Regulatory proceedings	Defence costs and, where insurable, fines and penalties	An inquiry or proceeding by a regulator

Two extensions are often sold separately. Social engineering or funds transfer fraud cover responds when an employee is deceived into making a payment, usually under a low sub‑limit, while dependent business interruption responds when an outage at a cloud host or critical supplier takes you offline.

Every section operates subject to the policy wording, exclusions, sub‑limits and endorsements actually issued, and the same label can mean different things across insurers. The Cyber Liability Insurance page sets out how these sections are typically assembled into one programme. Knowing what is included only helps if you also read what is taken out.

What does cyber insurance usually exclude?

Exclusions are where most cyber coverage disputes begin, and some version of each of these appears in most corporate wordings.

• Prior known incidents. Events known, or reasonably knowable, before inception or the retroactive date.
• State action. War and, in many current wordings, cyber operations attributed to a state, with definitions that vary widely.
• Infrastructure failure. Outages of power, telecommunications or internet backbone outside your control.
• Physical harm. Bodily injury and damage to tangible property, which belong to other policies.
• Betterment. Upgrading systems beyond their pre‑incident condition.
• Contractual penalties. Service credits agreed in a contract, beyond what you would owe at law.
• Unmaintained controls. Losses traced to a failure to maintain declared security measures, where the wording makes them a condition.

That last exclusion ties directly to how the policy was bought, and to the Indian rules that apply the moment an incident is discovered.

Which Indian laws shape a cyber claim?

Two regimes govern what a company must do after an incident. Neither makes insurance compulsory, but both make speed and evidence compulsory.

CERT‑In reporting directions

On 28 April 2022, the Indian Computer Emergency Response Team issued directions under Section 70B(6) of the Information Technology Act, 2000. Service providers, intermediaries, data centres, body corporates and government organisations must report the listed incident types to CERT‑In within 6 hours of noticing them, and must keep ICT system logs securely within India for a rolling 180 days. A company that discovers an attack on a Friday evening needs its reporting route agreed well before that evening arrives.

DPDP Act obligations

Under the Digital Personal Data Protection Act, 2023, a data fiduciary must take reasonable security safeguards to prevent a personal data breach under Section 8(5), and must notify the Data Protection Board and affected individuals of a breach under Section 8(6). Its Schedule allows penalties of up to ₹250 crore for the first failure and up to ₹200 crore for the second. Rule 7 of the DPDP Rules, 2025, notified as G.S.R. 846(E) on 13 November 2025, requires an initial intimation without delay and a detailed report to the Board within 72 hours, and commences with most substantive obligations on 13 May 2027. A proposal floated in early 2026 to compress that runway to 12 months had not been notified as of October 2026, so recheck the date before fixing any compliance plan.

How the policy fits

A cyber policy carries its own notice condition, separate from both statutory duties. Most wordings require prompt notice to the insurer, often through a hotline, and the insurer’s consent before you appoint vendors, admit liability or make any extortion payment. Whether a DPDP penalty would actually be paid depends on the wording and on whether that penalty is insurable under Indian law, which is not settled, so confirm the position with the insurer in writing and with your own counsel. None of this is theoretical. According to a written reply in the Lok Sabha on 20 August 2025, CERT‑In recorded 20,41,360 cyber security incidents in 2024, up from 15,92,917 in 2023. With volumes at that level, underwriters look hard at controls before they quote.

How do insurers underwrite cyber risk in India?

Cyber underwriting is closer to a security review than a rating exercise. Alongside revenue, sector, data volume and past incidents, insurers send a detailed controls questionnaire, and those answers decide whether terms are offered at all. Proposal forms commonly probe the following.

• Multi‑factor authentication. Whether it protects email, remote access and privileged accounts.
• Backups. Whether they are offline or immutable, segregated and tested by restoration.
• Endpoint detection. Whether monitoring runs on all endpoints and servers, and who watches the alerts.
• Patching cadence. How quickly critical vulnerabilities are fixed on internet‑facing systems.
• Privileged access. How administrator rights are granted, reviewed and logged.
• Vendor connections. Which third parties connect to your network, and on what terms.
• Response planning. Whether a written incident response plan exists and has been rehearsed.

Answers on the proposal form become the basis of the contract. Suppose a company declares multi‑factor authentication across all remote access and an attacker later enters through an account that never had it: the insurer may dispute the claim for misrepresentation or breach of a condition, depending on the wording. An honest answer with a remediation plan attached is almost always worth more than an optimistic one. Premium is risk‑rated and specific to each insurer, moving with revenue, sector, data volume, controls, claims history, the limit purchased and the retention accepted, so no reliable published price exists for a given company size. Most of the levers in our guide to reducing cyber insurance premiums come down to improving the controls insurers ask about.

How much cyber cover should a company buy?

There is no standard limit, and a round figure tends to be wrong in one direction or the other. A better method builds the limit from a realistic worst incident. Start with business interruption: the net profit lost and extra cost incurred for each day core systems are down, multiplied by a realistic restoration period for a full encryption event, usually measured in days or weeks. Then add incident response costs, notification costs scaled to the number of individuals whose data you hold, and an allowance for third‑party claims from customers your incident affects. Three details change what that limit is worth. Sub‑limits for extortion, social engineering and regulatory proceedings can sit far below the headline figure. The business interruption waiting period, often expressed in hours, decides when lost income starts to count. Customer contracts increasingly specify a minimum cyber limit too, and where one does, treat it as a floor rather than an assessment of your exposure.

What happens when you make a cyber claim?

A cyber claim runs on a different clock from most insurance claims, because the insurer is often involved while the incident is still live. The sequence below is typical; your own wording takes precedence.

Stage	What happens	What to watch
First hours	Incident confirmed, insurer hotline notified, CERT‑In report filed within 6 hours	No vendors engaged or attacker contact without insurer consent
Containment	Panel forensic and legal firms appointed, systems isolated	Preserve logs and evidence; avoid wiping affected machines
Assessment	Affected data scoped, notification duties assessed	DPDP intimation from 13 May 2027 and contractual notice to customers
Recovery	Data restored, business interruption loss measured	Record extra expenses and lost revenue as they occur
Settlement	Loss adjusted against the wording, third‑party claims handled	Sub‑limits, retention and any exclusion raised

Documentation and timelines are covered in our step‑by‑step cyber insurance claim process. For a first‑time buyer, the lesson is simpler: a cyber claim is largely won or lost on decisions made before the policy was bound.

How should a first‑time buyer structure cyber cover?

Treat the first purchase as a design exercise rather than a quote comparison. Begin by mapping what the business depends on: which systems earn revenue, where personal data sits, which cloud and software providers you cannot operate without, and what your contracts require. Next, check what existing property, crime and professional indemnity wordings say about cyber, since they may exclude it, stay silent or give limited cover, and that answer decides whether a standalone policy, an extension or both is the right structure. Decide whether you need dependent business interruption and where social engineering fraud belongs, and set a retention the business can absorb without strain. This is the stage at which a broker changes the outcome. Edify Insurance Brokers is a Bengaluru‑based corporate broking and risk‑consulting practice founded in 2015 by insurance professionals, placing liability, specialty, property and employee benefits programmes for Indian businesses. On cyber, that work means reading competing wordings side by side, matching the submission to insurers whose underwriting appetite fits the risk, and checking that the controls declared on the proposal form match what the company actually runs. The insurer still underwrites the risk and settles the claim. Finally, connect the policy to your incident response plan, which should name the insurer’s hotline, the owner of the CERT‑In report and the people authorised to approve vendor appointments.

Conclusion

Cyber insurance in India is less about buying a limit than about aligning three things: what the wording promises, what Indian law requires in the hours after an incident, and what the company declared about its own security. CERT‑In’s six‑hour window is already in force and the DPDP breach regime is scheduled to apply from 13 May 2027, so the time to align them is before an incident rather than during one. If you are buying cyber cover for the first time and want the exposures mapped before approaching the market, Contact Edify with your sector, revenue, the personal data you hold and any cyber clauses in your customer contracts.

FAQs