Errors & Omission Policy (Professional Indemnity Insurance)

Are your data losses covered under an Errors & Omission Policy or Cyber Security Policy? (Two-minute read for #CISOs, #Directors, #CFOs, #CTO, #Cyber Consultants, #Startups)

An Errors & Omission policy (Professional Indemnity Insurance) is taken to cover business service lapses where a customer incurs a loss due to negligence in offering professional services. In the event of a contractual breach or privacy breach, the legal expenses for fighting the case and subsequent compensation charges will also be paid by this E&O policy.

Intellectual Property Rights (IPR) infringement is an important factor that many MNCs require as a contractual obligation cover during a new IT project takeover; it is part of E&O insurance. If a client sues your company for data loss that was in your custody, it gets covered under E&O.

For example, if a disgruntled employee destroys a client’s database, which is unrecoverable, the cost of recovering or rebuilding the client’s data gets covered under E&O through the Employee Dishonesty clause. Additionally, if the client’s data is lost due to a cyber hack, the data restoration cost can be claimed under E&O through the Unauthorised Access extension.

However, the unauthorised access cover (linked to cyber attacks) is an extension to the E&O policy, meaning it’s not a full-fledged cover. The protection offered under this clause is sub-limited to 10% or 20% of the full policy limit. Therefore, first-party data losses are not covered under an E&O policy, which only covers third-party (i.e., client) data losses for which you are responsible as per a business contract.

Cyber Security Insurance covers data breaches leading to both first-party and third-party data losses. For data stored in cloud platforms (whether yours or your clients’), like AWS or Google, the cloud provider is legally responsible for paying for data losses in case of a breach.

In today’s Big Data world, every business relies on and revolves around data. It’s inevitable to hold both policies to fully secure any company’s data