Potentially, but fines and penalties should never be assumed to be insured.

Cyber Insurance can provide cover for certain costs associated with regulatory or privacy matters following a cyber incident.

What costs can be relevant? #

Depending on the policy:

• Legal advice
• Regulatory investigation costs
• Defence costs
• Privacy advice
• Data-breach response costs
• Notification costs
• Certain fines or penalties where legally insurable

A policy can cover investigation or defence costs without covering the actual fine or penalty.

What determines whether a fine is covered? #

Factors can include:

• Policy wording
• Applicable law
• Jurisdiction
• Regulator involved
• Conduct giving rise to the penalty
• Whether the penalty is legally insurable
• Exclusions
• Sub-limits
• Conditions

Criminal fines and penalties connected with deliberate or dishonest conduct are commonly excluded or may not be legally insurable.

Businesses experiencing an eligible data breach may also have notification obligations under the Privacy Act and the Notifiable Data Breaches scheme.

Contact our team if you need help reviewing how a Cyber policy treats regulatory investigations, fines or penalties.