Cyber Insurance Policy
In 2026, Cyber Insurance has transitioned from an optional business expense to a critical necessity in India, largely driven by the strict enforcement of the Digital Personal Data Protection (DPDP) Act, 2023 and a record surge in digital transactions.
Key Coverage Areas (First & Third-Party)
Policies are generally split into two categories to cover both internal losses and legal responsibilities to others:
First-Party (Own Losses)
Theft of Funds
Coverage for financial losses due to unauthorized digital transactions, phishing, or spoofing.
Data Restoration
Reimburses costs for recovering or decontaminating lost data after a malware attack.
Cyber Extortion
Covers ransom payments and professional negotiation costs for ransomware incidents.
Business Interruption
Compensates for lost revenue during downtime caused by a cyber event.
Third-Party (Liability to Others)
Privacy & Data Breach Liability
Covers legal defense and settlement costs if third-party data (clients/employees) is leaked.
Regulatory Fines
Under the DPDP Act, fines can reach up to ₹250 crore for serious offenses; policies now focus on covering the legal costs and penalties associated with these compliance breaches.
Multimedia Liability
Protects against claims of defamation or copyright infringement in digital content.
2026 Trends & Market Status
DPDP Compliance Focus
As of 2026, regulators have moved into an era of strict enforcement. Policies now specifically include support for mandatory 72-hour breach reporting to the Data Protection Board.
Identity-First Underwriting
Insurers in 2026 mandate "identity security" (like Multi-Factor Authentication) as a non-negotiable condition for coverage eligibility.
AI Governance
New policy clauses address liability arising from AI-based decision-making and algorithmic transparency.
Common Exclusions
Policies typically do not cover:
Not Covered Under the Policy
Review these standard exclusions before purchasing Cyber Insurance.
Intentional Acts
Fraudulent or dishonest acts committed by the insured person or management.
Prior Knowledge
Breaches that occurred or were known before the policy was purchased.
Physical Infrastructure
Failures in power supply, mechanical malfunctions, or damage to tangible property (unless directly caused by a cyberattack on critical systems).
Cryptocurrency
Losses or theft of digital currencies and crypto-assets are standardly excluded.
Estimated Costs (2026)
Premiums have stabilized after past surges but remain dependent on a company's "cyber hygiene score".
Individuals/Small Sachet Plans
Starting as low as ₹2/day for basic personal protection.
SMEs
Annual premiums for ₹1 crore cover typically range from ₹80,000 to ₹3,00,000.
Large Enterprises
Highly customized; costs scale significantly based on revenue and data volume.