Cyber Insurance: Sensible Protection When Handling Customer Data

A hacker attack or a data breach can affect any company that processes customer data. Without cyber insurance, you bear the financial consequences alone.

In brief: cyber insurance is not a legal requirement, but it is sensible protection for all companies that process customer data or depend on functioning IT. It covers typical follow-up costs of hacker attacks and data protection breaches, such as IT forensics, recovery, notification costs, business interruption, and third-party claims. Without insurance coverage, you bear these costs entirely yourself.

Who should consider cyber insurance?

Every company that processes customer data or depends on functioning IT systems in its daily operations should assess the need for cyber insurance. This affects not only large corporations: smaller companies and self-employed people with limited reserves in particular can quickly run into financial difficulties due to the follow-up costs of a cyberattack. What matters here is less the size of the company than the actual level of protection needed: how much and how sensitive the customer data processed is, and how strongly business operations depend on functioning IT, for example with online ordering systems, cloud services, or digital order processing. A tool like Company Audit provides an overview of which obligations and risks are specifically relevant to your company.

What does cyber insurance cover?

Cyber insurance covers the typical follow-up costs of hacker attacks and data protection breaches. This includes IT forensics to investigate the incident, the recovery of systems and data, notification costs toward affected individuals and authorities, costs from business interruption, and third-party claims, for example from customers whose data was compromised. In practice, insurers usually distinguish between first-party losses, meaning costs that arise within the company itself, for example through system outages or extortion, and third-party losses, when affected customers or business partners assert claims. Many policies also include an assistance component with immediate measures in an acute incident, such as a hotline to IT security experts. GDPR fine risks remain independently in place and can reach up to 20 million euros or 4 percent of global annual turnover.

What exactly do you need to do?

Before you request a quote, you should determine your actual needs and have done your homework on IT security. The following five steps help with getting started:

1. Assess the protection needs of the customer data processed and the dependency on IT systems.
2. Document existing technical and organizational measures (TOMs); insurers require them.
3. Compare offers (scope of coverage: first-party losses, third-party losses, business interruption, assistance).
4. Choose an appropriate coverage amount and deductible.
5. Comply with policy obligations (e.g., backups, MFA, updates) so as not to jeopardize your insurance coverage.

Many insurers already require minimum standards such as multi-factor authentication and regular backups when the policy is taken out. These measures are worthwhile regardless of the insurance anyway, because they reduce the risk of an incident from the outset. When comparing offers, it is worth taking a close look at exclusions and obligations in the small print: some policies require certain security standards already at the time the contract is concluded, while others only require them in the event of a claim. If you are unsure, you should involve an independent insurance broker with experience in cyber risk, since the scope of coverage and wording can differ significantly between providers.

What happens without insurance coverage?

Without cyber insurance, you bear all follow-up costs yourself in the event of a claim, from forensic investigation and system recovery to claims from affected customers. Especially when handling customer data, such incidents can quickly reach amounts that threaten the company's existence, while GDPR fine risks remain in place on top of that. In addition, an incident without a secured crisis management plan often takes longer until systems are running again and customers are informed; every day of business interruption further affects revenue and reputation. A cyber policy does not replace security measures; it only cushions the remaining residual damage.

Frequently asked questions

Is cyber insurance legally required?

No, there is no legal requirement to take out cyber insurance. It is voluntary protection, but given the financial risks from hacker attacks and data protection breaches, it makes sense for many companies.

Who benefits most from cyber insurance?

It is especially relevant for companies that process customer data or whose business operations depend heavily on IT systems. For these companies, the follow-up costs of an incident, for example due to business interruption or third-party claims, can be particularly high.

Does cyber insurance replace technical security measures?

No. A cyber policy does not replace security measures; it only cushions the residual damage that occurs despite precautions. Measures such as backups, multi-factor authentication, and regular updates remain necessary regardless of whether insurance is in place.

What requirements do insurers set before a policy is taken out?

Many insurers require minimum standards such as multi-factor authentication and regular backups, as well as documentation of existing technical and organizational measures (TOMs). Insurers require this evidence when the policy is taken out and check it in the event of a claim.

What happens if I do not comply with agreed obligations?

If you do not comply with agreed obligations such as backups, multi-factor authentication, or regular updates, you jeopardize your insurance coverage. In the event of a claim, the insurer can then reduce the payout or refuse it entirely, because the minimum standards required under the contract were not met.

Source: no legal requirement, voluntary protection (Cybersecurity cluster of the specialist catalog). This article is general information and does not replace legal advice for individual cases. As of: July 2026.