IT & software · cyber · DPDP
Cyber Insurance for IT & Software Companies
An IT services firm holds two kinds of risk at once: its own systems, and its clients' data sitting on them. The second is usually the larger liability, and it is the one a standard cyber policy is most likely to be silent on.
Key takeaways
- The Digital Personal Data Protection Act creates statutory obligations for data fiduciaries and processors, with penalties that are not insurable as fines but whose response costs are.
- For a services firm, the damaging claim is usually contractual: a client alleging your breach caused their loss. That is where cyber and professional indemnity meet, and where the wording of both needs to be read together.
- Business interruption from your own outage is a first-party cyber cover and is often the largest single head of claim.
- Funds transfer fraud and invoice redirection sit in a grey zone between cyber and crime policies; which one responds depends entirely on the wording.
First party and third party are different problems
First-party cyber covers your own costs: forensics, restoration, notification, extortion response, and the income lost while systems are down. Third-party covers what you owe others when their data was in your care.
Software firms consistently under-buy the third-party side, because the exposure is invisible until a client's lawyer writes. Your contracts define that exposure, so we read the master services agreements alongside the policy.
Where cyber ends and professional indemnity starts
A defect in code that causes a client loss is a professional liability question. A breach of the system that code runs on is a cyber question. Real incidents rarely arrive in one box, and two policies with mismatched retroactive dates and definitions will each point at the other.
DPDP and the cost of responding
Regulatory penalties are generally not insurable. The cost of responding to an investigation, notifying affected people and defending the position is, and for most firms that response cost arrives long before any penalty does.
Frequently asked questions
Do we need cyber if the data sits with a cloud provider?
Yes. Your contracts with clients usually make you responsible for their data regardless of where it is hosted, and the provider's own liability to you is typically capped well below your exposure.
Is a ransom payment covered?
Extortion cover exists in most cyber policies subject to sanctions screening and insurer consent. The larger cost is usually the interruption, not the ransom.
Does cyber cover a client suing us over a coding error?
That is professional indemnity territory. Firms doing bespoke development generally need both, written so they interlock rather than overlap.
Related: The DPDP Act and cyber insurance · Cyber Insurance · Professional Indemnity · IT & software · Group medical cover for hospitals · Shopkeeper policy quote