Every business that stores customer information, takes payments or relies on email has cyber exposure. The six biggest are data breaches, claims over your online content, damage to someone else’s systems, data loss, ransomware and extortion, and lost income while your systems are down. Most of these fall outside a standard commercial liability or property policy, which is why cyber coverage is usually a separate policy.
Why your regular business policy doesn’t respond
A commercial general liability policy is written for bodily injury and physical damage to property. A property policy covers things you can touch: the building, equipment, stock. Electronic data isn’t physical, and most policies now say so directly with data and cyber exclusions. Some property policies include a small amount of data restoration coverage, but it’s rarely enough to deal with a real incident.
So when a laptop full of client files goes missing, or a staff member clicks a bad link and your server locks up, the cost of fixing it usually lands outside the policies you already have.
The six exposures
1. Data breaches
If you hold personal information (names, addresses, birthdates, banking or card details, health information, social insurance numbers), you’re responsible for protecting it. A breach doesn’t need a hacker. A stolen laptop, a lost phone, an email sent to the wrong person or an employee looking at records they shouldn’t can all count.
The law has also changed since this topic first came up. Under PIPEDA, the federal private-sector privacy law, mandatory breach reporting has been in force since November 1, 2018. If a breach creates a real risk of significant harm to someone, you must report it to the Office of the Privacy Commissioner of Canada, notify the people affected, and keep a record of every breach for two years, reported or not. The costs add up quickly: forensic investigators, legal advice, notification letters, credit monitoring for the people affected, and defence if someone sues.
2. Online content and intellectual property
Your website, blog, newsletters and social media accounts make you a publisher. That brings a publisher’s risks: copyright or trademark infringement (a photo you didn’t licence, a logo that’s too close to someone else’s), and defamation if a post or review response crosses a line.
3. Damage to someone else’s systems
If an email from your account carries malware into a client’s network, or software or files you provide cause a loss for a customer, they may hold you responsible for their costs.
4. Data loss and system failure
A fire, flood or power surge can destroy hardware. Your property policy may pay to replace the computer, but recreating the data and programs on it is usually a separate cost, and often not covered by the property policy.
5. Ransomware and cyber extortion
Criminals lock up your systems or data and demand payment to release it, sometimes threatening to publish what they’ve taken. Even if you never pay, rebuilding systems and restoring from backups takes time and outside help.
6. Business interruption
If you can’t take orders, invoice, schedule or reach your files, revenue stops while expenses keep going. Downtime after a ransomware attack or a denial-of-service attack (where your website or systems are flooded with traffic until they stop working) can run from days to weeks. If a client depends on your services, their losses can become your problem too.
What a cyber policy is built to do
A cyber policy is designed around these risks. Depending on the insurer and the wording, it can include breach response (forensics, legal advice, notification costs), restoring data, extortion response, lost income from downtime, and liability if clients or regulators come after you. Policies vary a lot in what they include and what they require of you, such as multi-factor authentication or regular backups, so the details matter more than the policy name.
Where your business and family overlap
This is where a lot of owners have a gap and don’t know it. Many small businesses run partly from home. The laptop that holds client files might also be the one your kids use for homework. Your spouse might answer business email from a personal phone. The home Wi-Fi router may never have had its default password changed.
A few questions worth asking:
- Which devices touch business data? If family devices access business email or files, check whether your cyber policy covers devices the business doesn’t own.
- What does your home policy say? Home policies generally exclude business data and business liability, so a breach that starts on a family computer won’t be picked up there.
- Who has access? Shared passwords and shared logins make it harder to show what happened after an incident, and some policies have conditions about access controls.
Having one broker look at both your business and home policies makes these gaps easier to spot, because the question of whose device it is and which policy applies comes up at the same time.
Next step
If you’d like to go through your cyber exposure, including the devices at home, book a review and we’ll walk through it together.
Common questions
Does my general liability policy cover a data breach?
Usually not. A commercial general liability policy is built around bodily injury and physical property damage, and most now carry specific data and cyber exclusions. Some property policies include a small amount of data restoration coverage, but it's rarely enough for a real breach. Read the exclusions, or have your broker walk you through them.
Do I have to report a privacy breach in Canada?
Yes, if you're covered by PIPEDA and the breach creates a real risk of significant harm to someone. Since November 1, 2018, you must report it to the Privacy Commissioner of Canada, notify the affected people, and keep a record of every breach for two years, whether or not you reported it.
I'm a small business. Am I really a target?
Most attacks aren't personal. They're automated phishing emails and password attacks sent to thousands of businesses at once, and smaller businesses tend to have fewer defences. A lost laptop or a misdirected email can also cause a breach without any hacker involved.
Does cyber insurance cover devices my family uses for the business?
It depends on the policy wording. Some policies cover any device used to access your business systems; others are limited to devices the business owns. If your spouse or kids share a laptop you also use for work, raise it with your broker so the wording matches how you actually work.