Cyber Insurance vs Professional Indemnity Insurance: Do Australian Businesses Need Both?
Cyber Insurance and Professional Indemnity Insurance protect different business risks. A business may need one, the other, or both—particularly if it provides professional services and stores client information digitally.
The simple distinction is:
Professional Indemnity Insurance may protect against claims that your professional advice, services, errors or omissions caused a client financial loss.
Cyber Insurance may protect against losses arising from cyber attacks, data breaches, ransomware, online fraud and other digital-security incidents.
Many businesses incorrectly assume Professional Indemnity Insurance automatically covers a data breach or cyber attack. It often does not. The answer depends on the policy wording, endorsements and circumstances of the incident.
Does Professional Indemnity Insurance cover cyber attacks?
Not necessarily.
Professional Indemnity Insurance is generally designed for claims alleging professional negligence, errors, omissions, misleading advice or breaches of professional duty. It may not automatically cover a cyber incident such as ransomware, phishing, business-email compromise, system hacking, data restoration or privacy-notification costs.
Some PI policies may include limited cyber-related extensions, while others exclude cyber events entirely. Businesses should check the wording rather than assume.
What does Cyber Insurance cover?
Cyber Insurance may help a business respond to a cyber incident. Depending on the policy, this can include:
Data breaches and privacy incidents
Ransomware and cyber extortion
Hacking and malware attacks
Business-email compromise
Incident-response specialists
Forensic IT investigation
Legal and regulatory response costs
Customer-notification costs
Data restoration
Business interruption caused by a cyber event
Third-party claims arising from a covered breach
Crisis-management and public-relations support
Coverage differs between insurers and policies. Limits, exclusions, security requirements and sub-limits all matter.
Professional Indemnity vs Cyber Insurance: key differences
Risk | Professional Indemnity Insurance | Cyber Insurance |
Incorrect professional advice | May respond, subject to policy terms | Usually not the primary cover |
Errors or omissions in professional services | May respond | Usually not the primary cover |
Ransomware attack | Often not covered or limited | May respond, subject to policy terms |
Client data breach | May be excluded or limited | May respond, subject to policy terms |
Business-email compromise | Often not covered | May respond, subject to policy terms |
Legal costs from professional-negligence allegation | May respond | Usually not the primary cover |
Data restoration and incident response | Often not covered | May respond, subject to policy terms |
Lost income after a cyber attack | Often not covered | May respond, subject to policy terms |
Professional Indemnity Insurance helps cover legal action arising from claims about professional advice or services. business.gov.au guidance
Do consultants need Cyber Insurance?
Consultants should consider Cyber Insurance if they store, access, transmit or manage client information electronically.
This can include:
Client financial data
Identity documents
Payroll and employee information
Health information
Property, legal or commercial records
Passwords and system-access credentials
Cloud-based files
Email correspondence
Payment details
This is relevant for business consultants, IT providers, mortgage brokers, accountants, bookkeepers, property managers, digital agencies, recruiters, architects, engineers and professional service firms.
Even a small business can be affected by a cyber incident if it relies on email, cloud software, online banking or client databases.
Can a cyber incident create both PI and Cyber Insurance issues?
Yes. Some incidents can involve both professional liability and cyber risk.
For example, an IT consultant may be accused of providing negligent cybersecurity advice after a client suffers a data breach. The client’s allegation about the consultant’s professional service may engage PI considerations. The consultant’s own systems may also be compromised, creating separate cyber-response costs.
The policy response will depend on the facts, definitions, exclusions and interaction between the two policies. This is why businesses should avoid assuming one policy covers every technology-related risk.
What businesses should consider both PI and Cyber Insurance?
Businesses that are most likely to need both include:
IT consultants, software developers and managed-service providers
Mortgage brokers, finance brokers and financial professionals
Accountants, tax agents and bookkeepers
Legal and professional service firms
Management, HR and recruitment consultants
Real estate agencies and property managers
Marketing, digital and creative agencies
Health and allied-health businesses
Architects, engineers and design professionals
E-commerce and online service businesses
Questions to ask before arranging Cyber and PI Insurance
Before arranging cover, ask:
Do we provide advice or professional services that could cause client financial loss?
Do we hold personal, financial, health or confidential client information?
Would a ransomware event interrupt our operations?
Does our PI policy exclude cyber events or privacy breaches?
Are we required by contract to hold Cyber Insurance, PI Insurance or both?
Do we have adequate controls around email, MFA, passwords, backups and payment verification?
Do our policy limits reflect the potential cost of a cyber incident or professional claim?
Cyber Insurance and Professional Indemnity Insurance for Australian businesses
Cyber and professional liability exposures are increasingly interconnected, but they are not the same risk. A properly structured insurance program should address the professional services you provide as well as the data and systems your business relies on.
Clarke Lyons Insurance helps Australian businesses assess Professional Indemnity Insurance, Cyber Insurance and related cover requirements based on their actual services, data exposure, contracts and operations.
Contact Clarke Lyons Insurance for a tailored Cyber and Professional Indemnity Insurance review.
Comments