Cyber insurance for SMEs under the PDPA: what a policy pays after a breach
By the TRS broking team24 Oct 20266 min read
The short answerA cyber policy pays for incident response, data restoration, business interruption and claims from third parties after a breach or attack. Under the PDPA, the maximum financial penalty is S$1 million or 10% of annual Singapore turnover for organisations above S$10 million, whichever is higher.
What does a cyber policy pay?
Cover is split between the business's own losses and its liability to others.
| Cover | Examples |
|---|---|
| Incident response | Forensic investigators, legal advice, notifying affected people |
| Data and systems | Restoring data and rebuilding systems |
| Business interruption | Lost profit while systems are down |
| Liability | Claims from customers and partners whose data was exposed |
| Regulatory | Defence in regulatory investigations; penalties where insurable |
How does the PDPA change the risk?
Since 1 October 2022, the PDPC can impose a financial penalty of up to S$1 million, or 10% of annual turnover in Singapore for organisations with local turnover above S$10 million, whichever is higher.
Want this checked against your own policies?Talk to a broker
What do insurers ask before quoting?
Multi-factor authentication, backups kept offline, patching, endpoint protection, staff training and an incident response plan. Weak controls can mean exclusions or no offer.
Frequently asked questions
Does cyber insurance pay ransoms?
Some policies cover extortion payments where lawful; many add conditions. Check the wording.
Is cyber covered under a property policy?
Usually not. Property policies commonly exclude cyber events.
Related cover
Cyber insuranceResilience against digital disruptions and breachesProfessional indemnity insuranceDefend your expertise and professional advice
Sources
General information only, not advice on any particular policy. Cover depends on the policy wording and the insurer's terms.