For Indian businesses that depend on data, uptime and digital payments
Cyber Insurance in India for Businesses
9 min read · Last reviewed
Also called cyber liability insurance or cyber security insurance, cyber insurance helps a business respond — financially and operationally — when a data breach, ransomware attack, cyber fraud or system outage hits. It doesn’t stop the attack. It helps you recover when one gets through. Explained plainly, for the people who have to decide.
For startups, SMEs, MSMEs, SaaS companies, IT / ITeS firms, healthcare, fintech, e-commerce, manufacturing and professional-services businesses.
20 minutes with a Growth Advisor to understand your exposure, your current cover, and where the gaps are. No obligation.
Cyber insurance at a glance
- Best for
- Businesses that hold data, depend on uptime, take digital payments, or have client contracts that require cyber cover.
- May cover
- Breach response, forensics, legal support, ransomware response, business interruption, data restoration and third-party claims — subject to the policy wording.
- Watch closely
- Ransomware conditions, social-engineering sub-limits, vendor breaches, exclusions and regulatory-penalty wording.
- Doesn’t replace
- MFA, backups, endpoint security, staff training or an incident-response plan — insurance helps you respond, it doesn’t prevent attacks.
- First step
- Review your current controls, contracts and likely downtime exposure before choosing a limit. Talk to us.
Is cyber insurance worth considering for your business?
If a few of these are true, it’s worth a conversation. None of them means you definitely need cover — they’re simply the signs it’s worth looking at.
What is cyber insurance?
Cyber insurance is a policy a business buys to help it recover from a cyber incident — a data breach, a ransomware attack, online fraud, or a system outage caused by an attack. Depending on the policy wording, it can help pay for things like forensic investigation, legal advice, telling affected customers, restoring data, lost income while you’re down, and claims brought against you by others after an incident.
You’ll see the same cover called a few names: cyber liability insurance, cyber security insurance, cyber risk insurance, or simply a cyber policy. They broadly mean the same thing — a business policy for digital risk.
A cyber insurance policy is built for digital risks such as data breaches, ransomware, cyber fraud and business interruption caused by cyber events — not the physical or professional risks other business policies handle.
You may also see searches for data breach insurance, cyber crime insurance or cyber fraud insurance. In practice these are usually cover areas within a broader business cyber insurance policy, rather than separate products.
Here’s the distinction that matters most:
Cyber insurance does not prevent cyberattacks. Your IT tools — firewalls, antivirus, multi-factor login — do the preventing. Cyber insurance is what responds when something gets past them anyway, so a single incident doesn’t have to put the business on the floor.
Think of it as the difference between locks on your doors and the cover that pays to put things right after a break-in. You want both. One reduces the chance of an incident; the other limits the damage when one happens.
Why cyber insurance matters now for Indian businesses
A few things have shifted at the same time, and together they’ve moved cyber cover from “nice to have” to a real board-level question.
- The attacks are more frequent — and they hit smaller firms too. Ransomware, phishing, and business email compromise (a fake-invoice scam aimed at your finance team) are no longer a big-company problem. Smaller businesses are often easier targets precisely because they have leaner security teams.
- Almost everything now runs on data and uptime. Cloud tools, SaaS platforms, digital payments, customer databases, vendor integrations — the more a business depends on them, the more an outage or a breach costs.
- There are now legal duties when a breach happens. A real breach can start two clocks at once — a short window to report a cyber incident to CERT-In, and a separate window to notify the Data Protection Board of India under the DPDP regime, plus the affected individuals. Getting this wrong carries its own consequences, separate from the breach itself.
- The damage isn’t only the ransom. After an incident there’s downtime, data recovery, legal and forensic bills, customer notification, and the harder-to-measure hit to reputation and trust. Cyber cover is designed to take the financial weight of that response.
A careful line on what insurance does here: cyber insurance may help with breach-response costs, legal advice and notification costs, depending on the wording. Whether it can pay a statutory penalty is a separate, unsettled legal question — covered honestly below. We don’t claim cyber insurance pays government fines.
Who needs cyber insurance?
If your business holds customer or employee data, takes digital payments, or would lose money the day your systems went down — cyber cover is worth a serious look. It tends to matter most for:
Startups and SaaS companies
You hold user data, you live or die by uptime, and investors or enterprise customers increasingly ask whether you carry cyber cover before they sign. An outage or a breach early on can cost both money and trust you can’t easily rebuild.
SMEs and MSMEs
One ransomware event or one fake-invoice fraud can hit cash flow hard — and smaller firms are targeted because defences are usually lighter. Cyber cover also gives you access to breach-response specialists you wouldn’t keep on staff.
IT, ITeS and professional-services firms
You handle clients’ confidential data and files, and your contracts often carry liability if something goes wrong. A cyber incident can quickly become a client dispute as well as an internal one.
Healthcare, fintech and e-commerce businesses
You handle sensitive personal, financial or transaction data — exactly the data attackers and regulators care most about. The cost and scrutiny after a breach are higher here.
Manufacturing and logistics companies
Downtime, ERP disruption and vendor or payment fraud can create large losses even without any customer data being involved. When the line stops or the system locks, the bill adds up fast.
A special note for startups, SMEs and MSMEs
If you’re a smaller business, the case for cover is often stronger, not weaker — smaller firms are frequently easier targets, rarely have a full-time security team, and feel the cash-flow hit faster. A single incident can stall operations quickly, and a policy brings breach-response specialists you couldn’t otherwise keep on call. Clients and investors increasingly ask for cyber cover before they commit, too.
This page is about business cyber insurance. Personal or individual cyber cover is a different product and is outside the scope of this guide.
What does cyber insurance cover?
A business cyber policy is usually built from a set of cover areas. Which ones you get — and the limits and conditions on each — depend on the policy you choose. Here’s what a policy may include (always subject to the wording, sub-limits and exclusions):
| Cover area | What it may help with |
|---|---|
| Data breach response | Forensic investigation, legal advice, notifying affected customers, and PR / crisis support |
| Ransomware & cyber extortion | Specialist negotiation and recovery expenses — subject to policy terms and applicable sanctions rules |
| Business interruption | Lost income or extra operating costs caused by a covered cyber event |
| Data restoration | The cost to recover or recreate data damaged in a covered incident |
| Cyber fraud / social engineering | Loss from certain fraud or impersonation events — often with conditions and sub-limits |
| Third-party liability | Claims from clients, customers, vendors or partners after an incident affects them |
| Privacy liability | Defence costs and settlements arising from a privacy or data-handling claim |
| Network & media liability | Certain network-security failures and online-content claims |
| Incident response | Access to forensic, legal and crisis-management experts when an incident hits |
Cyber policies vary significantly. What any one policy actually pays is decided by its wording, exclusions, sub-limits, deductibles and conditions — which is exactly where a broker earns their keep. (We’ll keep this short from here: later sections simply say subject to policy terms.)
The common grey area: cyber fraud & social engineering
A fake vendor invoice, changed bank details, or a “CEO” payment instruction isn’t treated like a data breach. Many policies cover this only under a specific social-engineering extension — often with a sub-limit and conditions such as call-back verification or dual approval. It’s one of the first things worth checking in any wording.
First-party vs third-party cyber cover
Most business cyber policies have two halves. The plain-English difference:
First-party cover — your own costs
Pays for what the incident costs your business directly, such as:
- forensic investigation to find out what happened
- breach response and customer notification
- restoring or recreating lost data
- lost income during downtime (business interruption)
- ransomware response and recovery
- PR and crisis communication
Third-party cover — claims from others
Responds when someone else brings a claim against you after an incident, such as:
- clients and customers whose data was exposed
- vendors or business partners affected downstream
- regulators — where the matter is legally insurable and covered by the policy
Most business cyber policies combine both halves — but the split, the limits on each and the conditions differ. Subject to policy terms.
Common cyber claim scenarios
A few realistic situations a cyber policy is built for. These are illustrative examples, not specific cases or any promise of how a claim would be settled — every real claim turns on its own facts and the policy wording.
A ransomware hit at an SME
Attackers lock a company’s ERP and demand payment. Operations stop, and the firm faces forensic, recovery and business-interruption costs while it gets back online. A cyber policy may help fund parts of that response, depending on the wording.
Business email compromise (the fake invoice)
A finance team receives a convincing email — appearing to be from a supplier or a senior colleague — and pays a fraudulent invoice. This is “social engineering” fraud, and whether it’s covered usually depends on the policy terms and the verification controls the business had in place.
A customer data breach
Personal data is exposed because of a misconfigured cloud setting. The business now has legal, forensic, notification and possible third-party-claim costs — and reporting duties to meet.
A vendor-related breach
A third-party software or service provider is compromised, and the exposure flows downstream to the insured business. Cyber cover is increasingly written with this supply-chain risk in mind — though the wording matters a great deal here.
What cyber insurance does not cover
This is the most important section to read before you buy — because cyber policies have real grey areas, and a shallow comparison can leave you exposed. Common exclusions and limitations include:
- Known prior incidents — something you were already aware of before taking the policy
- Poor security the business ignored — failing to maintain the controls you told the insurer you had
- Intentional or dishonest acts by senior management
- Bodily injury or property damage — unless specifically endorsed
- Infrastructure or hardware failure not caused by a covered cyber event
- Contractual penalties your business agreed to, where the policy doesn’t cover them
- War, terrorism and state-backed (nation-state) attacks — a fast-evolving exclusion area
- Fines or penalties that are not legally insurable
- Cryptocurrency loss — unless specifically covered
- Social-engineering loss where required verification steps weren’t followed (e.g. no call-back to confirm a payment change)
The grey areas above — ransomware payment limits, social-engineering conditions, vendor breaches, state-backed-attack exclusions — are exactly the clauses a broker reads closely on your behalf.
Not sure whether your current cyber wording handles ransomware, social engineering or vendor breaches properly?
Talk to usCyber insurance and Indian law: DPDP, CERT-In and reporting duties
This is the part most insurer pages skim — and it’s where cyber cover connects to a real legal duty. Treat everything here as the current position, to be confirmed with counsel before you rely on it.
You may have to report a breach — fast. Under the CERT-In Directions of April 2022 (made under the Information Technology Act, 2000), certain cyber incidents must be reported to CERT-In within 6 hours of noticing them.
The DPDP regime adds a second duty. Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified 13 November 2025), a business that suffers a personal-data breach must give the Data Protection Board of India a detailed report within 72 hours of becoming aware (Rule 7(2)), and must notify each affected individual without delay, with prescribed details (Rule 7(1)). This sits alongside — not instead of — the CERT-In duty.
| Report to | When | Roughly what’s required |
|---|---|---|
| CERT-In | Within 6 hours of noticing | Notice of the cyber incident |
| Data Protection Board of India | Within 72 hours of becoming aware (Rule 7(2)) | A detailed breach report |
| Affected individuals | Without delay (Rule 7(1)) | Nature, likely impact and what you’re doing about it |
Scroll sideways to view the full table.
The penalties are significant. The DPDP framework provides for substantial penalties for failures such as not maintaining reasonable security safeguards, or not reporting a breach. We deliberately don’t print figures here, because the amounts, triggers and enforcement timing are matters for counsel — and because the next point is the one that matters for insurance.
Can cyber insurance pay a DPDP fine? Be very careful here. Whether a statutory fine or penalty is insurable depends on Indian law, the nature of the penalty and the policy wording. Businesses should take legal advice before assuming such penalties are covered.
What cyber insurance is more reliably built to help with is the cost of responding — the forensic, legal and notification work the law effectively forces you to do well, and quickly. Good documentation and a tested incident-response plan don’t just help with the regulator; they help with the claim too.
Is cyber insurance mandatory in India? No single law currently requires a business to buy cyber insurance. But the reporting and data-protection duties above are mandatory when an incident happens — and customers, investors and enterprise contracts increasingly require cyber cover even though the law doesn’t.
Sources: CERT-In Directions, April 2022 (under the IT Act, 2000); Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025.
How a cyber insurance claim works
If an incident hits, the order of the first few hours matters — both for containing the damage and for the claim. A typical path looks like this:
- Spot the incident — recognise that something is wrong (locked systems, unusual access, a suspicious payment).
- Notify your insurer or broker straight away — cyber policies usually require prompt notification, and early help is the most valuable help.
- Preserve the evidence — don’t delete logs or wipe systems; forensics will need them.
- Bring in the approved experts — many policies have a panel of forensic, legal and incident-response specialists to call on.
- Contain it — stop the spread and secure what’s still safe.
- Assess the impact — what data, systems and money were affected, and who needs to be told.
- Meet your reporting duties — CERT-In / Data Protection Board / affected individuals, as applicable.
- Submit the claim and coordinate recovery — documentation, communication, and getting the business back to normal.
Two things to know early: many cyber policies require quick notification, and many use approved vendor panels for forensics, legal support and ransomware response. Calling your broker first — before you start changing systems — usually leads to a smoother claim.
What insurers check, what affects premium, and how much cover you need
Three questions sit at the heart of buying cyber cover — what insurers want to know, what moves the price, and how big a limit to choose. They’re linked, so here they are together.
What insurers usually ask for
Cyber underwriting is really a security-maturity check. Before quoting, an insurer typically wants to understand:
- your industry, revenue and size, and where your customers are
- the data you hold — customer, employee, health, card or bank details — and roughly how much
- whether you have a written information-security and privacy policy, and how often it’s reviewed
- multi-factor authentication (MFA), plus your firewalls, antivirus and email security
- access control — unique logins, and removing access when someone leaves
- your backups — how often, kept separate, and whether you’ve tested restoring them
- encryption of sensitive data, including on laptops and portable media
- a tested disaster-recovery and business-continuity plan
- how fast downtime would start costing you money
- your vendor / outsourcing controls and payment-approval steps (the defence against invoice fraud)
- any past incidents, outages or claims, and any open issues
This is why two companies with similar revenue can be offered very different terms. A business with MFA, segregated backups and a real incident-response plan is usually viewed as a better risk, which may help it receive broader terms or more competitive pricing. Getting these basics in place before you approach the market is some of the best-value work a broker can guide you through.
What affects the premium
There’s no single price for cyber insurance, and we don’t publish figures — a realistic number depends entirely on your business. The main things that move it:
- business size, revenue and industry (and how attractive a target it is)
- data sensitivity — how much, and how sensitive, the data you hold is
- security maturity — MFA, backups, patching, training, response plan
- claims and incident history
- the cover limit, your deductible / retention, and any sub-limits (e.g. ransomware, social engineering)
- ransomware exposure and third-party / vendor dependence
How to choose a cyber insurance limit
Choosing a limit is a conversation, not a fixed number — anyone who quotes a “standard” figure without understanding your business is guessing. The factors that shape it:
- your revenue and how digital your operations are
- the number of customers or records you hold
- how long you could survive downtime before it really hurt
- likely breach-response costs for a business your size
- client contract requirements (some customers specify a minimum)
- your regulatory exposure under DPDP / sector rules and your business-interruption exposure
To understand what limit and structure may suit your business — and how to improve your security profile so insurers may view the risk more favourably — speak with an advisor.
Talk to usGet quote-ready: what to have before you go to market
Insurers ask broadly the same things, so a little preparation means faster, more accurate quotes — and often better terms. Here’s the short list.
Information to gather
- what your business does, your revenue, employee count and where your customers are
- the data you hold (customer, employee, health, card, bank) and roughly how many records
- your security controls — MFA, firewalls, antivirus, email security and encryption
- your backup routine, and whether you’ve tested restoring from it
- your disaster-recovery and business-continuity status
- your vendor and payment-approval controls
- a rough estimate of what one day of downtime would cost you
- any past incidents, outages or claims in the last few years
- the cover limit any client contract requires
Documents to have handy
- your current or expiring cyber policy, if you have one
- your information-security or network-security policy
- your incident-response plan, if you have one
- any recent security assessment or certification
This is exactly the groundwork we do with you — we turn it into a clean submission and take it to the market on your behalf. When you’re ready, talk to us.
We can also turn this into a one-page “cyber quote-ready checklist” you can download and work through.
Cyber insurance vs other business covers
Cyber insurance overlaps with — but doesn’t replace — several other business policies. Knowing the boundaries stops you from assuming you’re covered when you’re not.
| Policy | What it mainly covers | How it differs from cyber insurance |
|---|---|---|
| Crime insurance | Employee dishonesty, theft, internal fraud | May not cover data-breach response or ransomware |
| D&O insurance | Claims against directors and officers personally | Usually doesn’t pay for cyber incident response |
| E&O / professional indemnity | Mistakes in professional services you provide | May not cover a cyberattack’s costs unless endorsed |
| Property insurance | Physical assets and damage | Cyber events are often excluded or tightly limited |
| General liability | Bodily injury and property damage to others | Not designed for data-breach or ransomware losses |
Directors & Officers (D&O) insurance · Crime / Fidelity · Errors & Omissions (Professional Indemnity) · Commercial General Liability
A growing business often carries several of these together. The point isn’t to buy everything — it’s to make sure the gaps between them are covered, not falling between two policies. That’s a conversation worth having before renewal.
What Ethika reviews in a cyber policy
When we compare cyber wordings for you, these are the clauses we read closely — because they decide what a policy is actually worth on a bad day:
- ransomware and cyber-extortion wording, and any sanctions conditions
- social-engineering and funds-transfer-fraud terms, sub-limits and verification conditions
- the business-interruption trigger and waiting period
- vendor and supply-chain wording
- retroactive date and prior-known-circumstance exclusions
- the incident-response vendor panel and notification requirements
- regulatory-defence wording
- war and state-backed-attack exclusions
- deductibles, retentions, and the overall and per-cover limits
Subject to policy terms — but this is the checklist that turns “we have cyber cover” into “we have the right cyber cover.”
Why work with a broker before buying cyber insurance?
Cyber is one of the hardest policies to compare on your own, because the differences hide in the wording. A broker earns their place by:
- comparing multiple insurers on cover, not just price
- explaining the exclusions and sub-limits that decide real claims
- checking the ransomware and social-engineering terms closely
- aligning the cover with your customer contracts
- helping with claim notification when speed matters most
- negotiating policy wording, not just accepting the standard form
- reviewing what changes at renewal (cyber terms shift fast)
- spotting and closing underinsurance before it’s tested
As an IRDAI-licensed broker, Ethika’s role is to help you compare options, understand the wording, and place suitable cover with insurers based on your requirements — so the focus stays on your exposure, not a product we’re trying to push.
Key cyber insurance terms, explained
Open the cyber insurance glossary
Plain-English definitions of the terms you’ll meet when buying cyber cover.
- Cyber insurance
- A business policy that helps you respond to and recover from a cyber incident.
- Cyber liability / cyber security insurance
- Other common names for the same business cover.
- First-party cover
- Pays for your own business’s costs after an incident.
- Third-party cover
- Responds to claims others bring against you after an incident.
- Data breach
- Unauthorised access to, or loss of, personal or business data.
- Ransomware
- Malicious software that locks your systems or data until a ransom is paid.
- Cyber extortion
- A demand for payment under threat of a cyberattack or data release.
- Business interruption
- Lost income or added costs while your operations are disrupted.
- Social engineering / business email compromise (BEC)
- Fraud that tricks staff into making payments or sharing access.
- Incident response
- The coordinated work (forensic, legal, technical, PR) of handling a cyber incident.
- Sub-limit
- A cap on a specific cover that sits below the overall policy limit.
- Deductible / retention
- The portion of each claim the business pays itself.
- CERT-In
- India’s national agency for reporting and responding to cyber incidents.
- Data Protection Board of India
- The body under the DPDP regime that breaches are reported to.
- DPDP
- The Digital Personal Data Protection Act, 2023 and its 2025 Rules.
Cyber insurance: common questions
What is cyber insurance?
Is cyber insurance mandatory in India?
What does cyber insurance cover?
Does cyber insurance cover ransomware?
Does cyber insurance cover cyber fraud or phishing?
Does cyber insurance cover data-breach costs?
Does cyber insurance cover DPDP penalties?
What is not covered by cyber insurance?
How does a cyber insurance claim work?
How much cyber insurance does my business need?
What affects cyber insurance premium?
Is cyber insurance useful for SMEs and startups?
Is cyber insurance tax-deductible for businesses?
What information is needed to get a cyber insurance quote?
Go deeper: plain-English explainers
Longer reads on cyber cover — written to be useful on their own. Still general; where the honest answer is “it depends on your policy,” they say so.
Cyber insurance is a conversation, not a quote
Not sure what cyber cover your business actually needs? That’s the normal starting point — and it’s exactly what a 20-minute conversation is for. We’ll help you understand your real exposure, compare options on wording and not just price, and identify the policy terms that matter before you buy.
No jargon, no pressure, no obligation.
What happens when you talk to us
A 20-minute video call with a Growth Advisor — no obligation, and no hard sell. In that first call we usually look at:
- Your industry, size and how much you depend on data and uptime
- The data you hold and your current security controls (MFA, backups, email security)
- Whether your current wording has gaps — ransomware, social engineering, business interruption or third-party cover
- What information insurers will need to quote
You’ll leave with an honest read on your current cover and where the gaps are, and a straight answer on whether we can genuinely help.
20 minutes with a Growth Advisor. No obligation.
Directors & Officers (D&O) insurance · Crime / Fidelity · Errors & Omissions (Professional Indemnity) · Commercial General Liability · Business insurance
A note on this page. This page is general information about cyber insurance, not insurance, legal, financial or tax advice, and nothing on it is an offer of cover. The right policy for your business is determined through a conversation and the formal mandate process.
Sources. Statutory references: the Digital Personal Data Protection Act 2023 & DPDP Rules 2025; CERT-In Directions, April 2022; and the Information Technology Act 2000.