Covers what happens after a breach: forensic investigation, data restoration, regulatory fines, ransom, business interruption, and claims from customers whose data you lost. Available for businesses and, increasingly, for individuals facing UPI fraud and identity theft.

Premiums and claim-settlement ratios are illustrative until sourced from the insurer of record.

Read this before you buy.

• Breaches that began before the policy started, even if discovered later
• Unencrypted data on a lost laptop, where encryption was a policy condition
• Failure to apply a patch that was available for more than 45 days
• Loss of intellectual property value, and reputational harm itself
• Fines that are uninsurable by law in the relevant jurisdiction

The first 72 hours decide both the loss and the claim. Every cyber policy includes an incident-response hotline — using it immediately is a policy condition, not a convenience.

1. 01

   Call the incident hotline

   · hour 1

   Before you wipe anything. The insurer appoints forensics and legal counsel; acting alone first can void the cover.

2. 02

   Contain and notify

   · hours 1–72

   Forensics isolate the breach. Under the DPDP Act you must notify the Data Protection Board and affected individuals within 72 hours.

3. 03

   Restore and quantify

   · days 2–14

   Data restoration costs and business-interruption loss are measured against your pre-incident trading. Good books make this claim far larger.

4. 04

   Third-party claims follow

   · months

   Customer claims and regulatory penalties arrive long after the systems are back. The policy defends these on a claims-made basis, so it must still be live.