Cyber Insurance for Indian SMEs: What to Check Before Buying

Cyber insurance for business is worth considering if an incident could stop orders, block access to systems, expose customer or employee information, or trigger a claim from another party. For an Indian SME, the decision is less about finding a generic cyber policy and more about matching the policy to the systems, data, payment processes and third-party vendors that keep the business running. Cover is always subject to the insurer’s policy wording, schedule, exclusions, sub-limits and claim conditions.

Do Indian SMEs need cyber insurance? The short answer

Usually, yes, if a digital incident could create a material cash-flow, recovery or liability problem that the business would struggle to fund itself. This can apply to a manufacturer using ERP and email for procurement, a retailer taking online payments, a SaaS startup hosting client data, or a professional-services firm holding confidential files.

Insurance should sit alongside, not replace, security controls. CERT-In’s directions require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents within six hours of noticing them or being informed of them. A clear escalation path, evidence preservation process and incident-response plan can therefore matter as much as the policy itself. See CERT-In’s directions under section 70B of the Information Technology Act and its FAQ on the six-hour reporting requirement.

If your business handles digital personal data, it also makes sense to link insurance buying with data-governance work. As of 26 October 2026, section 8 of the Digital Personal Data Protection Act, 2023, which covers reasonable security safeguards and personal-data-breach notification, is scheduled to commence on 13 May 2027. Section 9 concerns the processing of children’s personal data, rather than breach notification. Rules 6 and 7 of the Digital Personal Data Protection Rules, 2025 set out reasonable security safeguards and personal-data-breach intimation respectively, and are also scheduled to take effect on 13 May 2027. See the DPDP Act commencement notification and the Digital Personal Data Protection Rules, 2025, alongside Coverbiz’s DPDP Act cyber-insurance preparation guide.

Map the cyber incidents that could disrupt your business

Before comparing corporate cyber policies, create a one-page incident map. Include the people, systems and data involved, not just the company website.

Consider these scenarios:

• Customer-data exposure: A staff mailbox, CRM, payroll file or e-commerce database is accessed without authorisation.
• Ransomware or system encryption: Staff cannot access accounting, inventory, production, dispatch or customer-support systems.
• Funds-transfer fraud: A manipulated email or compromised account leads to an unauthorised payment instruction.
• Cloud or SaaS dependency failure: Your order, billing or customer-service workflow stops because a critical provider is unavailable.
• Data corruption or deletion: Records needed for operations, reconciliation or compliance must be restored.
• Third-party allegation: A client claims that your security failure, privacy breach or online content caused financial loss.
• Website or portal outage: Customers cannot place orders, partners cannot access services, or employees cannot work remotely.

Assign each scenario an owner, likely response actions, estimated downtime, affected revenue stream and the vendors you would need in the first 24 hours. For practical prevention measures to run in parallel with insurance, see these steps to protect your organisation from cyber crime.

What corporate cyber insurance may cover after an attack

The answer to “what does cyber insurance cover?” depends on the wording selected. Typical corporate cyber insurance can address a mix of response costs, financial loss and liability. For example, an Indian commercial cyber policy wording includes business-interruption and extra-expense cover, privacy-notification expenses, crisis expenses, extortion-related loss, data or media restoration, and cyber liability, subject to the schedule and policy terms.

When comparing cyber insurance coverage for companies, ask whether the schedule expressly provides adequate limits for:

• digital forensic investigation and incident-response specialists;
• legal advice, customer or regulator communications and notification costs;
• data restoration and recovery;
• cyber-extortion response and related professional fees;
• business interruption and extra expense incurred to continue operations;
• security and privacy liability claims from customers, partners or other third parties;
• multimedia or online-content liability, where relevant to your business; and
• fraudulent electronic-transfer or social-engineering exposures, if these are important to your payment process.

A policy may provide a broad headline limit but smaller sub-limits for particular benefits. The schedule in an illustrative SME cyber wording separately identifies items such as cyber extortion, data restoration, forensics, privacy notification and business interruption, including a waiting-period field for interruption loss. Treat this as a prompt for questions, not a promise that every policy will work the same way.

For help comparing structures, exclusions and insurer options relevant to your risk profile, explore corporate cyber insurance options.

First-party losses versus third-party liability, explained

First-party cover concerns the direct cost to your own business after a covered incident. It may include forensic work, restoration, approved crisis-management costs, extortion response, extra operating expense and loss arising from a covered interruption.

Third-party liability cover concerns what others allege you owe them. A customer, vendor or other affected party may claim that a privacy breach, security failure or online activity caused damage. The relevant part of a policy can include defence costs and covered damages or settlements, subject to the wording and insurer consent. An Indian commercial cyber policy wording shows separate cyber-liability cover and a schedule for related defence-cost sub-limits.

An SME that buys only data-restoration cover may still face customer claims. Equally, a policy focused on liability may leave a business with inadequate protection for the immediate operational costs of an outage. Your comparison should therefore separate first-party limits from third-party limits and identify any shared aggregate limit.

Common cyber insurance exclusions and policy conditions to check

Cyber insurance exclusions in India are not identical across insurers. Read the full policy wording and your schedule, particularly these points:

1. Known events, prior claims and retroactive dates. Claims or circumstances known before inception, previously notified elsewhere, or events occurring before the stated retroactive date may not be covered. The commercial cyber wording states that cyber-liability claims must arise from wrongful acts after the retroactive date and be first made during the policy or applicable reporting period.

2. Business-interruption restrictions. Check the waiting period before loss starts accruing, how lost income is calculated, and whether cloud-provider or telecom interruptions are included. The illustrative SME cyber wording includes a business-interruption waiting-period field and defines the applicable waiting period in its cyber section.

3. Upgrade, maintenance and vulnerability-remediation costs. A policy can pay to restore covered loss without paying to modernise an old system. Check whether the proposed wording distinguishes restoration from betterment, system upgrades, maintenance or remediation work.

4. War, terrorism, sanctions, bodily injury, property damage and trading losses. These may be excluded or tightly defined. Read the actual exclusion wording and ask how it applies to your business, especially if you operate across borders or rely on a large number of connected vendors.

5. Consent and claims handling. Do not appoint vendors, admit liability, settle a third-party claim or incur significant response expenditure without understanding the policy’s notification and consent requirements. The commercial cyber wording requires prior written consent for certain crisis expenses and for settlements, defence costs or admissions of liability.

6. Territory, jurisdiction and vendors. Ask whether the policy responds to overseas customers, foreign claims, subsidiaries, outsourced processors and the cloud platforms named in your technology stack.

How to choose a cyber sum insured and deductible

Start with an estimate of your plausible severe incident, not annual turnover alone. Build the estimate from:

• forensic and legal support in the first days;
• notification, call-centre and communication costs where relevant;
• restoring data and systems from clean backups;
• gross-profit loss during a realistic downtime period;
• extra expense to run operations manually or through an alternate provider;
• potential customer, contractual or third-party claim costs; and
• the cost of a ransomware insurance for business response, if extortion is a credible exposure.

Then test the overall sum insured against every sub-limit, waiting period and shared aggregate limit in the proposed schedule. A limit can be inadequate if a benefit central to your response, such as forensic work, data restoration or business interruption, has a lower separate cap. An illustrative Indian SME cyber schedule lists separate sub-limits for several cyber-response costs and a business-interruption waiting period.

The deductible, also called a retention or excess in some wordings, is the amount specified in the schedule that the insured bears before the insurer pays covered loss above that amount. The policy wording states that the insurer pays loss only to the extent it exceeds the applicable deductible. Choose an amount your business can fund without delaying recovery work, while recognising that a higher deductible can change the policy’s pricing and claims economics.

Ask for scenarios rather than a single premium comparison: “What happens if our ERP is unavailable for five days?” “What if a payroll file is exposed?” “What if our cloud provider is down?” “Which response vendors can we use?” Confirm the answers against the proposed wording and schedule.

What to ask before buying cyber insurance: FAQs

Is cyber insurance enough for DPDP compliance?

No. Insurance can support the financial and operational response to a covered incident, but it does not itself meet data-governance, security or breach-handling requirements. Section 8 of the DPDP Act contains the reasonable-security-safeguard requirement and the obligation to notify the Board and affected Data Principals of a personal data breach. Rule 6 sets out the required reasonable security safeguards, while rule 7 specifies breach intimation. Section 9 separately addresses children’s personal data. These provisions are scheduled to commence on 13 May 2027. Businesses that will be in scope should prepare safeguards, vendor oversight, incident-response procedures and records alongside the policy. See the DPDP Act commencement notification and the Digital Personal Data Protection Rules, 2025.

What should we disclose to the insurer?

Answer proposal-form questions fully and accurately. Be prepared to describe your revenue, business activities, data types, payment processes, security controls, backups, prior incidents, critical vendors and overseas exposure. The illustrative SME policy wording identifies the proposal, declarations, policy schedule and endorsements as parts of the insurance contract.

How quickly should we notify the insurer after an incident?

Follow the policy’s stated reporting requirement immediately and preserve evidence. Separately, assess whether the incident triggers a CERT-In report. CERT-In’s directions require reporting specified incidents within six hours of noticing them or being informed of them, while its FAQ says initial reporting may be made with the information available and supplemented later. See CERT-In’s directions and the related CERT-In FAQ.

Can a startup buy cyber insurance before it has a large customer base?

Yes, the decision can be sensible even at an early stage if the startup stores customer or employee data, depends on a cloud platform, processes payments, or has contractual cyber obligations. The appropriate scope and sum insured should reflect current exposure, anticipated growth and the insurance requirements in customer contracts.

A well-chosen policy cannot prevent an incident, and it will not cover every loss. It can still give an SME a clearer financial and response framework when systems, data or customer relationships are under pressure. Get a business insurance quote for corporate cyber cover tailored to your data exposure, vendor reliance and incident-response needs.