The one sector where the product delivered takes up no space, the damage leaves no physical trace and the claim arrives, almost always, as purely financial loss.
A technology company has the risk profile of an industrial one turned inside out. Its physical assets are modest and replaceable; what is valuable is the code, the data it holds on behalf of third parties and the continuity of the service it has promised under contract. Classic property covers therefore protect very little of what can actually go wrong, and the weight of the programme shifts towards cyber risk and towards liability for the service delivered.
The second particularity is its legal position. In most B2B contracts the technology company acts as processor of its client's personal data: it does not decide about that data, but it answers for how it is handled and for what happens to it. That status moves part of the regulatory risk of every client served onto its own balance sheet, multiplied by the number of clients.
Speak to a technical adviser: 932 419 400
A technology company inverts the usual risk profile. Its physical assets are modest and replaceable; what is valuable is the code, the data it holds on behalf of third parties and the continuity of a service promised under contract. Classic property covers therefore protect very little of what can actually go wrong.
In most B2B contracts the technology company acts as processor: it does not decide about the personal data, but it answers for how it is handled. That has a counter-intuitive consequence: a single breach in its infrastructure triggers the notification obligation of each and every affected client.
The General Data Protection Regulation allows 72 hours from becoming aware to notify the supervisory authority, and requires communication to the data subjects without undue delay where the risk to them is high. That clock runs for the controller —the client— but the party holding the facts and the forensic evidence is the supplier. Processing agreements tend to pass the consequence back up the chain.
It is also worth separating two penalty tiers that most commercial content conflates: failing to notify is sanctioned under article 83(4), up to €10 million or 2% of worldwide turnover; infringing the principles or data subjects' rights falls under 83(5), up to €20 million or 4%.
A failed implementation, a calculation error in an algorithm or a badly executed migration produce pure financial loss: cost overruns, delays, processes that have to be redone. No general liability policy responds to that, because it excludes it by definition.
And there is a boundary better written into the contract than into the policy: penalties for breaching a service-level agreement are commercial risk, not insurable loss, and policies exclude them. What is insurable is the loss the failure causes beyond the agreed penalty.
When the company bids for a public tender, three requirements arrive together and to a deadline: compliance with the National Security Framework, the definitive guarantee, and a liability certificate with minimum limits and the exact wording the tender documents call for. The last two are resolved within the insurance programme; the first is not, but it arrives in the same envelope.
As a broker registered with the Spanish Directorate-General for Insurance and Pension Funds under reference J0140, New Brokers works on the client's mandate, not on behalf of any insurer.
In technology the work starts before the policy: in the client contracts. That is where it is settled what liability is assumed, which penalties are accepted and which data protection obligations are passed on. An insurance programme that has not been read alongside those contracts covers a different risk from the one the company has signed up to.
Compromise of information the company holds on behalf of third parties. It multiplies regulatory risk by the number of clients served and triggers very short deadlines.
The downtime that breaches a service-level agreement, with contractual penalties a policy rarely covers and which should be told apart from insurable loss.
The functional failure that causes the client a financial loss with no physical damage. It is the central exposure and the one general liability excludes.
Encryption that halts not only the company's own operation but that of the businesses depending on the service, with a cascading effect.
The outage of an infrastructure provider the whole service relies on, which does not happen on the company's own premises and calls for an express extension.
Claims for improper use of code, incompatible licences in dependencies or trademark infringement in the delivered product.
Management decisions in companies with funding rounds and a board, where the arrival of a fund usually brings a requirement for directors' cover.
The subscription model concentrates recurring revenue in a few accounts, and one significant non-payment hits cash before it shows in the income statement.
The obligations that, in this sector, trigger the purchase of a specific cover.
| Rule | What it requires |
|---|---|
| General Data Protection Regulation, arts. 33 and 34 — View the legislation | Requires notification of a security breach to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to rights and freedoms, and communication to the data subjects without undue delay where the risk to them is high. |
| General Data Protection Regulation, art. 83 — View the legislation | It draws a distinction between two penalty tiers that are routinely conflated: failing to notify a breach is sanctioned under article 83(4), up to €10 million or 2% of total worldwide annual turnover; infringing the principles of processing or data subjects' rights falls under 83(5), up to €20 million or 4%. The higher amount applies. |
| Royal Decree 311/2022, National Security Framework — View the legislation | Governs the Spanish National Security Framework (ENS) in the field of electronic administration. It reaches technology suppliers serving the public sector, whose certification or compliance conditions access to those contracts. |
| Act 34/2002, on information society services — View the legislation | Sets out the information, commercial communications and electronic contracting duties of information society service providers, along with the liability regime for intermediaries. |
| Directive (EU) 2022/2555, NIS2 — View the legislation | It does not require anyone to buy insurance. It raises cybersecurity risk-management requirements and reinforces the responsibility of the management bodies of entities within its scope, which is what connects cyber risk to the directors' policy. |
New cover
We analyse your activity and your real exposure before approaching the market.
Request a proposalExisting client
Your certificates, policies and requests are available in the client area.
Go to the client areaAn incident in the technology company's infrastructure exposes personal data belonging to several of its clients, who are the ones holding controller status.
What it means
The 72-hour clock runs for the controller, but the party holding the facts is the processor. The quality and speed of the forensic work determine whether the client can meet its obligation, and the contract between them usually passes that consequence back to the technology company.
A badly executed migration forces the client to redo processes, buy in external hours and delay its own launch.
What it means
There is no physical damage, so general liability does not respond. This is professional indemnity territory, and the most disputed item is usually whether the policy covers only the loss caused or also the rectification of the supplier's own work.
The company bids for a public tender requiring compliance with the National Security Framework and, in the same tender documents, a definitive guarantee and minimum liability limits.
What it means
The three requirements arrive together and to a deadline. The guarantee is arranged through surety without consuming a bank line, and the liability certificate must be issued with the exact wording the tender documents call for.
The central line for the sector: data breach, ransomware, business interruption and access to a forensic and legal team in the first hours.
It answers for the financial loss a development or implementation error causes the client, which general liability excludes by definition.
The arrival of an investor or a fund almost always brings a requirement for board cover as a condition of joining.
It covers offices and equipment, but normally requires prior physical damage: an interruption of IT origin does not trigger it.
It protects collection in subscription models with concentrated billing, and covers the guarantees public-sector tender documents demand.
A product sold in several countries exposes the company to very different data protection and liability regimes.
The core is two contracts: cyber risk, covering data breach, ransomware and business interruption, and professional indemnity, which answers for the financial loss a development or implementation error causes the client. On top of that come D&O where there is a board or investors, credit and surety where the company sells to the public sector or has concentrated billing, and property cover for the offices. The scope of each is governed by the specific terms of each policy.
Yes, and in a particular way: the notification deadline runs for the controller —your client— but the party holding the facts and the forensic evidence is you. In practice, processing agreements pass much of that consequence to the supplier, so a breach in your infrastructure becomes a contractual exposure towards as many clients as you have. That is why regulatory risk multiplies in this sector.
Normally not. Agreed contractual penalties are commercial risk, not insurable loss, and policies tend to exclude them expressly. What can be covered is the financial loss the failure causes the client beyond the penalty, and the costs of responding to the incident. Telling the two apart when negotiating client contracts matters as much as the policy itself.
Royal Decree 311/2022 governs the National Security Framework in the field of electronic administration, and its scope reaches technology suppliers serving the public sector. In practice, compliance or certification becomes a condition of access to those contracts, and it arrives in the same tender documents as the guarantees and the minimum liability limits.
No. Directive (EU) 2022/2555 does not require anyone to buy insurance. What it does is raise cybersecurity risk-management requirements and reinforce the responsibility of the management bodies of entities within its scope. That heavier duty on management is precisely what connects cyber risk to the directors' policy.
A description of the services and the product, the volume and type of personal data processed and on behalf of how many clients, the infrastructure and cloud providers relied on, the security measures and backup policy, standard client contracts with their service-level agreements, and turnover with its concentration by client.
Facing a data breach, the GDPR requires notifying the AEPD within 72 hours and, where there is high risk, the data subjects. We explain the obligations and how cyber insurance funds the response.
Read→
Cyber insurance protects the company against a cyberattack in two blocks: first-party losses and third-party liability. Here is how far it reaches.
Read→This information is for guidance only and is not binding. Covers, limits and exclusions are governed in all cases by the specific terms of each policy. New Brokers Correduría de Seguros, S.L., registered with the DGSFP under reference J0140.