DPDP Act Cyber Insurance: How SMEs Should Prepare Before 14 May 2027

Why the DPDP Act matters for cyber insurance now

If your business stores customer phone numbers, employee records or vendor bank details, the countdown has started. The Digital Personal Data Protection (DPDP) Rules, 2025 were notified on 14 November 2025 with an 18-month phase-in, and most obligations land on 14 May 2027. That makes DPDP Act cyber insurance planning a board-level task for Indian SMEs, startups and mid-size companies this year, not next.

This guide explains what changes, what a breach could cost, and where a corporate cyber insurance policy fits. It is written for founders, CFOs and risk heads, not lawyers, so treat it as a starting point and confirm specifics with your legal counsel.

What the DPDP Rules require and when

The DPDP Act, 2023 regulates how organisations collect and use digital personal data. A data fiduciary is any business that decides why and how personal data is processed. A data principal is the individual the data belongs to, such as your customer or employee.

According to an analysis of the enforcement notification by Shardul Amarchand Mangaldas (accessed 21 October 2026), the rollout has three stages:

The same analysis notes that all data fiduciaries must keep personal data, traffic data and processing logs for at least one year. The full text is available on the MeitY website.

Breach reporting gets stricter

The PIB explainer on the Rules says a business must inform all affected individuals without delay, in plain language, explaining what happened, the likely impact and what it is doing about it. A note by S.S. Rana & Co. (accessed 21 October 2026) adds that the Rules set a 72-hour limit for a detailed breach report covering its nature, extent, timing and impact.

This sits on top of an existing duty. Under CERT-In's April 2022 directions, specified cyber incidents must already be reported to CERT-In within 6 hours of noticing them.

The penalties: what a breach could cost

The DPDP Act sets out penalties by type of failure. As summarised by the Press Information Bureau (November 2025):

• Up to ₹250 crore for failing to maintain reasonable security safeguards.
• Up to ₹200 crore for failing to notify the Board or affected individuals of a breach.
• Up to ₹200 crore for violating obligations relating to children's data.
• Up to ₹50 crore for any other violation of the Act or Rules.

These are maximums. The Data Protection Board decides the actual amount based on the facts of each case. Penalties are also only one part of the bill. A business that suffers a breach typically pays for forensic investigation, legal advice, customer notification, call centres, system restoration and lost revenue while operations are down.

The threat is not theoretical. CERT-In handled over 29.44 lakh cyber incidents in 2025, according to a PIB backgrounder published on 23 January 2026.

Cyber insurance is not a legal requirement under the DPDP Act, and buying a policy does not make a business compliant. Compliance needs real safeguards, processes and governance. Insurance helps pay for the consequences when something still goes wrong.

How DPDP Act cyber insurance supports compliance

A corporate cyber policy is designed around the costs that follow a data breach or cyber attack. Cover for DPDP-related regulatory investigations, notification costs and claims by affected individuals varies substantially between insurers and wordings, so compare these sections side by side when placing a policy. All claims are subject to policy terms, conditions and exclusions. Typical sections include:

First-party costs (your own losses)

• Incident response and forensics: experts to contain the attack, find the cause and confirm what data was exposed.
• Notification costs: drafting and sending the plain-language notices the DPDP Rules require, and running a helpline.
• Data restoration: rebuilding systems and recovering data after ransomware or corruption.
• Business interruption: lost income while systems are down, after the waiting period in the policy.
• Cyber extortion: negotiation support and related costs, where the law and policy allow.

Third-party liability (claims against you)

• Privacy and data liability: claims by customers or partners whose data was exposed.
• Regulatory defence: legal costs of responding to an inquiry by the Data Protection Board or another regulator. Some policies also cover fines and penalties, but only where they are insurable under Indian law. Check this clause carefully.
• Network security liability: claims if malware spreads from your systems to a client's.

For most SMEs, the most valuable part is often the incident response panel. When the 72-hour clock starts, having forensic, legal and PR experts pre-approved by the insurer saves time you will not have.

Common exclusions and conditions to check

Cyber wordings differ more than most commercial covers. Before you buy, ask your relationship manager to walk you through these points:

• Known or prior incidents: breaches discovered, or circumstances known, before the policy start or retroactive date are usually excluded.
• Minimum security conditions: some policies expect controls such as multi-factor authentication, patching and offline backups. Gaps disclosed wrongly in the proposal form can reduce or defeat a claim.
• Contractual liability: penalties or service credits you agreed to in a client contract, beyond what you would owe at law, are often excluded.
• Fines and penalties: regulatory penalties may not be legally insurable, so cover is usually limited to defence costs.
• Infrastructure and war: failures of power, internet or telecom providers, and acts of war, are commonly excluded or sub-limited.
• Betterment: the cost of upgrading systems beyond their condition before the incident is generally not paid.

A practical checklist before 14 May 2027

Use the months before the deadline to get both compliance and insurance in order:

1. Map your personal data. List what you collect, where it is stored, who can access it and which vendors process it.
2. Fix your safeguards. Encryption, access controls, multi-factor authentication, backups and log retention of at least one year.
3. Review vendor contracts. Data processors such as payroll, CRM and cloud providers should have clear security and breach-reporting terms.
4. Write a breach response plan. Name the decision-makers, the 6-hour CERT-In step and the DPDP notification steps, and test it with a tabletop exercise.
5. Review your cyber cover. Check the sum insured against a realistic breach cost, the business interruption waiting period, regulatory defence cover, exclusions and the insurer's incident response panel.
6. Align related covers. Leadership can be named in claims after a major breach, so review your directors and officers liability insurance. IT and consulting firms should also check their professional indemnity insurance for data-handling errors.

Which businesses face the most DPDP exposure

Every data fiduciary must comply, but some businesses hold more personal data and face higher stakes:

• E-commerce and D2C brands with large customer databases and payment flows.
• Startups in fintech, healthtech and edtech, where investors increasingly ask about data governance during due diligence. See our page on insurance for startups.
• BFSI, NBFCs and lenders handling identity and financial data.
• IT services, BPO and SaaS firms processing data on behalf of clients.
• Manufacturers and logistics firms with large workforces, where employee data is personal data too.

How Coverbiz helps

Coverbiz compares cyber insurance from leading Indian insurers and places a policy built around your data, systems and contracts. Your dedicated relationship manager helps you size the cover, read the exclusions and align it with your D&O and liability programme. If an incident happens, our claims team works with you and the insurer from first notification onwards. The policy is issued by the insurer, and the insurer decides claims under its terms.

The 14 May 2027 deadline is a good reason to review your cover now, before renewal season and before the rules bite. Talk to Coverbiz for a business insurance quote.