A cyber policy has two halves. First-party cover pays for your own costs after an incident including costs you are obliged to incur as per prevalent privacy laws. Third-party cover pays claims that others bring against you because of it including government or regulators.
| Cover | What it can pay | Who it protects |
|---|---|---|
| Breach response | Forensic investigators, legal advice, notifying affected people and regulators, credit monitoring | Your business from regulatory privacy breach actions |
| Data restoration and hardware damages | Restoring or recreating corrupted or destroyed data including hardware and public relations expenses. | Your business |
| Business interruption | Lost profit and extra costs while systems are down, after a waiting period | Your business |
| Cyber extortion | Specialist negotiators and, subject to conditions, extortion payments | Your business |
| Privacy and security liability | Claims from customers, employees or partners whose data was exposed | Claims against your business |
| Regulatory proceedings | Defence costs and, where insurable, civil fines | Claims against your business |
| Media liability | Defamation or infringement claims from your websites and digital content | Claims against your business |
| Payment card (PCI) liability | Assessments and defense costs under card-industry obligations | Claims against your business |
Not every policy includes all the covers and if they do they could have limitations which impair your ability to recover the losses.
Many cyber policies cover extortion, but a ransom is never paid automatically. The insurer's prior written consent and confirmation from the company that paying would not breach sanctions or similar laws. The same wording also covered the expenses of responding to the threat. If ransomware is your main concern, check three things before you buy: whether extortion payments are covered or only response costs, the sublimit for extortion, and which response firm you must call first.
Business interruption cover pays lost profit and extra operating costs while your systems are disrupted. Two limits shape every claim:
Common exclusions in Indian cyber wordings include:
Fines need care. The wording we reviewed covers civil fines only where the breach was not knowing, wilful or criminal and where the fine is insurable under the law that imposed it. Whether Indian statutory penalties, including those under the Digital Personal Data Protection Act, can be insured is a legal question to put to counsel; do not assume they will be paid.
A fake invoice or a spoofed email from your "CEO" can lead staff to transfer money to a fraudster. Many cyber policies do not pay for that lost money. The wording we reviewed excludes loss of money and fraudulent transfers by employees from its business interruption cover.
This loss is usually insured under commercial crime and fidelity cover, or under a specific social-engineering extension where an insurer offers one. If your finance team makes payments on email instructions, check which of your policies would respond before it happens.
After a cyber incident, three separate clocks can run at once.</p>
| Who you tell | Deadline | Applies from | Source |
|---|---|---|---|
| CERT-In | Within six hours of noticing the incident | 2022 | CERT-In Directions of 28 April 2022, under Section 70B(6) of the IT Act |
| Data Protection Board of India | A description without delay, then a detailed report within 72 hours | 13 May 2027 | Rule 7(2), Digital Personal Data Protection Rules, 2025 |
| Affected individuals | Without delay | 13 May 2027 | Rule 7(1), Digital Personal Data Protection Rules, 2025 |
| Your insurer | As set in your policy; one wording requires written notice of a privacy event within 72 hours | Now | Your policy wording |
The CERT-In Directions also require logs to be kept within India for 180 days, and investigators will ask for them. The DPDP duties only apply where personal data is involved. Late notice to the insurer can cost you cover, so tell your broker at the same time as your IT team.
Keep a record of extra costs and lost revenue from the start of the outage.
Any business that holds customer or employee data, takes digital payments or cannot trade without its systems. Firms most often buy or review cover when they:
We are not aware of any general legal requirement for Indian businesses to buy cyber insurance. Client contracts, lenders and group policies may require it, so check your agreements.
There is no standard price. Insurers rate each business on:
When setting the limit, estimate one serious incident: forensic and legal fees, notifying everyone in your largest database, a week or more of downtime, and the claims that could follow. Expect a security questionnaire as part of the proposal; weak controls can raise the premium or narrow cover.
Edify Insurance Brokers Private Limited is registered with IRDAI as a direct (life and general) insurance broker, Registration No. 607. For cyber insurance, we:
Support notification and follow-up if an incident occurs.
Many policies cover ransomware response costs, and some cover extortion payments. Payments usually need the insurer’s prior consent and must be legal under sanctions rules.
Often not as standard. Money lost when staff are tricked into paying a fraudster is usually insured under crime cover or a specific social-engineering extension.
Do not assume so. Fine cover depends on the wording and on whether the penalty is legally insurable. The DPDP Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, and its breach duties apply from 13 May 2027.
Security reduces the chance of an incident but not the cost of one. Strong controls also make cover easier to obtain and may lower the premium.
Only if your policy includes system-failure cover, which may be a separate or optional section. Without it, the policy may respond only to downtime caused by a security or privacy event.
To CERT-In within six hours where the Directions apply, and to your insurer within the deadline in your policy, which can be as short as 72 hours for a privacy event.
reviewed, require you to call a nominated response service, and costs from other firms may not be paid without the insurer’s consent.
Tell us your industry, annual revenue, the data you hold and whether you have a policy today. We will come back with the questions insurers will ask and the clauses worth checking.
