Cyber Insurance for Indian Businesses: What It Covers and What It Does Not
If your invoices, customer records or payment systems sit on computers, a cyber incident is a business risk, not an IT problem. Cyber insurance helps pay for the response and the fallout. It does not replace good security, and insurers will ask how well you practise it.
Key Takeaways for Policyholders
- ✓Cyber policies commonly combine first-party cover (your own costs) and third-party cover (claims against you).
- ✓CERT-In's 2022 directions require covered entities to report certain cyber incidents within six hours.
- ✓The DPDP Act, 2023 introduces penalties for failures to protect personal data, which raises the stakes.
- ✓Proposal answers on backups, multi-factor authentication and patching affect cover and price.
What a cyber policy usually pays for
| Type of cost | Examples |
|---|---|
| First-party: response | IT forensics, legal advice, notifying affected people, call-centre support, public relations |
| First-party: loss | Data restoration, business interruption, cyber extortion, such as a ransom demand, where permitted |
| Third-party: liability | Claims from customers or partners over a data breach or security failure, with defence costs |
| Regulatory | Costs of responding to regulatory inquiries, and in some cases penalties where insurable by law |
The wording differs by insurer, and sub-limits are common. For example, ransom payments, regulatory fines and business interruption may carry separate limits.
The legal backdrop in India
Two rules shape how Indian businesses think about cyber risk. CERT-In's directions of April 2022 require service providers, intermediaries, data centres and bodies corporate to report specified cyber incidents within six hours of noticing them. The Digital Personal Data Protection Act, 2023 sets duties on those who handle personal data and provides for penalties, which can run into hundreds of crores for serious failures to maintain reasonable security safeguards. Whether a penalty can be insured depends on the policy and law, so ask your insurer.
Common exclusions and conditions
- Incidents that occurred, or were known, before the policy began.
- War and certain state-linked attacks, as defined in the wording.
- Losses linked to a failure to maintain security measures stated in the proposal.
- Costs of improving systems beyond their pre-incident state ("betterment").
- Physical damage to equipment, which is usually handled by other policies.
What insurers ask before they quote
Expect questions on multi-factor authentication for email and remote access, regular offline or immutable backups, patching routines, endpoint protection, staff awareness, and incident response plans. Strengthening these is good practice and may make cover easier to obtain.
A practical starting point
Test whether you can restore your key systems from a backup within a day. If you cannot, fix that first, then talk to your Advisor about cover that matches your real exposure.
Who should look at it first
Technology firms, e-commerce sellers, healthcare providers, professional services and anyone holding customer data or relying on online systems to bill and ship. You can read about wider business protection on our SME insurance page.
Frequently asked questions
Does cyber insurance cover ransomware?
Many policies cover response costs and, within limits and subject to law, extortion payments. Read the extortion and sub-limit clauses carefully.
Is cyber insurance mandatory in India?
No. It is optional, although lenders, customers or contracts may ask for it.
Will cyber insurance pay if I did not use multi-factor authentication?
It depends on what you declared and the policy conditions. Misstatements or failure to maintain declared controls can affect a claim.
Does it cover loss of reputation?
Some policies cover public-relations costs after an incident. Lost future sales due to reputation are normally limited or excluded.
Talk to a Distroo Advisor
Want to see how this applies to your own situation? A Distroo Advisor can walk you through the options in plain language. Read more about SME Insurance or send us your question. Advice from Distroo is free for customers; any policy you buy is issued by the insurer at its standard premium.
This article is general information for awareness. It is not insurance, tax, legal or investment advice, and it does not guarantee any outcome. Product features, premiums, underwriting and claim decisions depend on the respective insurer’s policy wording and applicable IRDAI regulations. Always read the policy document before you buy.