Business Insurance After an ICO Fine or Data Breach UK
Can you get business insurance after an ICO fine, reprimand or data breach?
The ICO's enforcement pattern has changed. In 2024 it issued 17 monetary penalties totalling £2.5m; in 2025 it issued 14 totalling £21.7m, an average of £1.6m each, and the first five penalties of 2026 exceeded £15m between them. Capita's £14m penalty in October 2025 for a ransomware attack that exposed 6.6 million records, Advanced Computer Software's £3.07m for the 2022 attack on NHS systems, 23andMe's £2.31m for credential stuffing, LastPass's £1.2m and Reddit's £14.4m in 2026 share a theme: the Commissioner is now fining for security failures — absent multi-factor authentication, unpatched systems, slow alert response — not just for marketing consent. Alongside the penalties sit around 65 published reprimands and 49 enforcement notices over three years, each a public document a cyber underwriter will find in seconds.
The Data (Use and Access) Act 2025, most of which commenced on 5 February 2026, widened the field. Fines under the Privacy and Electronic Communications Regulations — the marketing rules — rose from a £500,000 cap to the UK GDPR ceiling of £17.5m or 4% of worldwide turnover; the Commissioner gained the power to compel interviews and demand technical reports; and from 19 June 2026 every controller must operate a formal complaints procedure. A business that receives ICO enforcement in 2026 is being regulated by a body with more powers, higher ceilings and a demonstrated appetite to use them.
This guide sets out the ICO's enforcement ladder in insurance terms, whether a fine can be insured, what a breach does to the next cyber renewal, which other policies it reaches, what must be disclosed, who can sue and how those claims are covered, and how a business with an ICO record is placed. It sits with our HSE prosecution and Environment Agency enforcement guides in the adverse-risk cluster, and connects to our cyber insurance page and our guide to cyber insurance that has been declined, where most of these enquiries begin.
Key facts at a glance
- UK GDPR fines reach £17.5m or 4% of worldwide turnover under Article 83 and section 157 of the Data Protection Act 2018. The lower tier — £8.7m or 2% — covers security and record-keeping failures; the higher tier covers the principles, individual rights and international transfers.
- PECR marketing fines rose from £500,000 to the same £17.5m ceiling on 5 February 2026 under the Data (Use and Access) Act 2025. Marketing businesses are already the ICO's most-fined sector by number.
- No UK court has decided whether an ICO fine is insurable. Every cyber wording covers regulatory fines "where insurable by law"; the prudent planning assumption is that a penalty for a breach the ICO found negligent will not be paid.
- Fines are rising and fewer. 14 penalties in 2025 totalling £21.7m (average £1.6m) against 17 in 2024 totalling £2.5m. The 2023–2026 tally: 58 penalties, 49 enforcement notices, 65 reprimands, 3 prosecutions.
- 72 hours to notify the ICO under Article 33 for any breach likely to result in a risk to individuals — and the policy's own notification condition usually runs from the moment of discovery, not from the ICO deadline.
- A breach is a "prior circumstance" on the next cyber policy. Specialist markets re-place breached businesses, but the incident already known about is excluded, and warranties on MFA, backups and endpoint detection become conditions precedent.
- Individuals can claim compensation under Article 82 for material and non-material damage — distress included — without proving financial loss. Group claims following a breach are insured under the privacy liability section of cyber cover, not under public liability.
How does The Insurability Framework™ apply after ICO enforcement?
Placing a business after a reprimand, an enforcement notice, a penalty or a notified breach is exactly what the Insurability Framework was built for.
The Insurability Framework — applied after ICO enforcement
Four pillars, one method: separate the incident from the control environment, and price the control environment.
Underwriter Intelligence
Cyber underwriters after a breach ask five questions: is MFA enforced on every remote and privileged access, is endpoint detection deployed and monitored, are backups offline and tested, are critical patches applied within fourteen days, and did the incident-response plan work when it was used? We present the ICO action alongside the answers, with the forensic report and the closure evidence, so the file is priced on the environment as it is now.
Difficult Risk Expertise
Package and scheme cyber insurers decline prior breaches and ICO action by rule. Lloyd's cyber syndicates and specialist MGAs write breached businesses on their merits — with a prior-circumstances exclusion, a retention the business can fund and warranties it can actually meet.
Risk Assessment
We find what the ICO action exposed beyond the penalty: the professional indemnity policy that also needs notifying because client data was involved, the D&O policy whose regulatory-investigation section should have been triggered, the contractual liabilities to customers that most cyber wordings exclude, the PECR exposure that the cyber policy does not touch, and the mid-term notification condition already running on the current policy.
Claims Advocacy
A breach produces a regulatory investigation, a forensic response, individual notifications, compensation claims and a possible ransom decision, all inside the same week. We coordinate the cyber insurer's panel, the legal expenses solicitor and the D&O notification so the business speaks with one voice to the Commissioner and its insurers — and has a broker who has read a penalty notice, not a helpline.
What is the ICO's enforcement ladder — and what does each rung mean to an insurer?
| Rung | What it is | Public? | What it means to an insurer |
|---|---|---|---|
| Advice / audit | Informal advice following a self-reported breach; consensual audit; letter closing the case with recommendations | No | Disclosable if a proposal question covers reported breaches (cyber forms always do). Rarely moves the market if the recommendations are closed |
| Information / assessment / interview notice | Compulsory demands for information, an audit or — since 5 February 2026 — attendance at interview and a technical report | Not usually | Material change in risk mid-term. Legal Expenses regulatory section funds the response; cyber policies often fund it as a regulatory-investigation cost |
| Reprimand | Formal published finding of infringement without a penalty, under section 149 DPA 2018 / Article 58. The ICO's default outcome for public bodies and many SMEs | Yes | Read as a conviction-equivalent by package cyber markets; specialist markets read the reprimand's findings, which name the failed control precisely |
| Enforcement notice | Order under section 149 to take or stop specific steps within a period; breach is a further infringement carrying a penalty | Yes | Decline trigger for package markets. The steps ordered become the underwriter's warranty list |
| Notice of intent | Provisional penalty decision with the proposed sum; 21 days for representations. Often reduces the sum substantially (Advanced: £6.09m proposed, £3.07m imposed) | Usually once final | Mid-term notification required. Legal Expenses or cyber regulatory-defence cover funds the representations; the penalty itself is not funded |
| Monetary penalty notice | Final fine under section 155 DPA 2018 — up to £17.5m or 4% of worldwide turnover for UK GDPR and, since February 2026, PECR | Yes | Uninsured in practice. Disclosable for five years on most forms; drives a specialist placement with prior-circumstances exclusion |
| Criminal prosecution | Offences under sections 144 (false statements), 148 (destroying information), 170 (unlawfully obtaining personal data), 173 (altering records) DPA 2018; unlimited fine | Yes | A conviction of the company or an individual, with the consequences set out in our director conviction guide |
| Director liability | Section 198 DPA 2018 — a director, manager or officer is personally guilty of the company's offence committed with their consent, connivance or neglect | Yes | D&O defence cover responds to the investigation; the fine and any conviction are the individual's |
Can insurance pay an ICO fine — and why is nobody sure?
The starting point is the principle in Safeway Stores v Twigger [2010] EWCA Civ 1472: a company fined by a regulator for its own infringement cannot recover the fine from those whose conduct caused it, because the liability is personal to the company and allowing recovery would defeat the penalty's purpose. Insurers argue the same logic prevents indemnity. Against that, the ICO's penalties are civil, not criminal; they can be imposed for negligent as well as deliberate breaches; and there is a respectable argument that a penalty for a negligent security failure is no different from the negligence liabilities insurance covers every day. The Financial Conduct Authority resolved the equivalent question for its own fines by rule — regulated firms may not insure FCA penalties — but the ICO has no such rule and has made no statement.
In practice the wording decides. Most cyber policies written in the London market state that fines are covered "where insurable by law" and that the question is determined under the law most favourable to insurability; a minority exclude regulatory fines entirely; a few specialist wordings cover them expressly and accept the public-policy risk. Even where cover exists, it is invariably sub-limited — £100,000 to £1m on SME policies — and conditional on the insurer having been involved in the ICO representations. The penalty itself under section 155 is set by reference to the seriousness and culpability of the infringement, so an insurer that pays it is paying for the very conduct it excluded. Our advice to clients is unchanged since 2018: budget the fine as uninsured, buy the regulatory-defence cover that funds the representations which reduce it, and never let the fine question distract from the covers that reliably pay.
What happens to cyber insurance at the first renewal after a breach?
The mechanism is the claims-made basis of cyber cover. A cyber policy responds to claims and incidents first discovered and notified during the policy period; at renewal the insurer asks about known circumstances that might give rise to a claim, and a breach is the archetype. The renewal policy excludes anything arising from it — the individuals affected who have not yet claimed, the regulator's investigation that has not yet concluded, the second-stage attack that reuses stolen credentials — because those belong to the expiring policy, where they must be notified before it ends. A business that lets the expiring policy lapse without notifying every circumstance arising from the breach loses cover for all of them.
The second mechanism is the warranty. Post-breach, the underwriter's questionnaire becomes a list of conditions: is MFA enforced on all remote access, email and privileged accounts; is an endpoint detection and response tool deployed to every device and monitored 24/7; are backups immutable or offline, tested quarterly, and segregated from the production network; are critical patches applied within 14 days; is privileged access restricted and logged. Answer "yes" and the policy is written on the strength of it — and a claim where the answer proves false is declined. Answer "no" and the market narrows to insurers who will accept a remediation plan with a deadline, at a price. The Capita penalty notice's findings — 58 hours to respond to an alert, inadequate penetration testing, poor administrator access controls — are the same items on every questionnaire. The ICO and the cyber market are, increasingly, reading from the same list.
For a business whose cyber cover has already been declined or non-renewed, our guide to declined and refused cyber insurance covers the re-placement route in detail; the article you are reading covers what the ICO action adds to it.
Which other policies does a data breach reach — PI, D&O, crime and legal expenses?
| Consequence | Cyber | PI | D&O | Crime | Legal Expenses |
|---|---|---|---|---|---|
| Forensics, containment, notification, credit monitoring | Yes — first-party incident response | Rarely | No | No | No |
| ICO investigation — legal representation, representations against a notice of intent | Yes — regulatory defence, sub-limited | Sometimes, if arising from professional services | Yes — for directors and officers investigated | No | Yes — regulatory prosecution/investigation section |
| The UK GDPR or PECR penalty | "Where insurable by law" — assume no | No | No | No | No |
| Article 82 compensation claims from individuals | Yes — privacy liability | Yes, if data of clients held in the course of professional services | No | No | No |
| Client contractual claims — breach of data-processing terms, SLA credits | Partial — contractual liability often excluded beyond what would exist at law | Yes, subject to the contractual-liability exclusion | No | No | No |
| Business interruption during outage | Yes — network interruption, after a waiting period | No | No | No | No |
| Ransom payment and negotiation | Yes — cyber extortion, sub-limited, subject to sanctions checks | No | No | No | No |
| Funds diverted by a fraudulent instruction that started the incident | Sometimes — social-engineering sub-limit | No | No | Yes — funds transfer fraud | No |
| Shareholder or creditor claim that directors failed to oversee security | No | No | Yes | No | No |
| Section 198 prosecution of a director | No | No | Defence costs only — the fine is the individual's | No | Sometimes |
The professional indemnity overlap catches professional services firms most often — accountants, solicitors, recruiters, IT consultants, architects — because their PI policy already covers liability for client data lost in the course of the work, and the PI insurer expects to be notified of the circumstance whether or not a cyber policy also exists. A breach notified to the cyber insurer and not the PI insurer, discovered when a client sues eighteen months later, is a late-notification dispute the business will lose. Our guide to professional indemnity after a claim covers what that notification then does to the PI renewal; our D&O guide covers the regulatory-investigation section that funds directors compelled to interview under the ICO's new powers.
Which cover do you need after each type of ICO action?
Post-Breach & ICO Enforcement Cover Checker
Select the situation your business is in to see the programme and disclosure position that go with it
Breach reported to the ICO — case closed with advice or no further action
- LEGAL Employers' Liability £10m — maintain without a gap
- ESSENTIAL Notify every circumstance arising from the breach to the expiring cyber policy before it ends — unclaimed individuals, open regulatory correspondence, credential reuse risk
- ESSENTIAL Disclose the breach at cyber, PI and D&O renewal — "reported to the ICO" is a yes on every form regardless of outcome
- ESSENTIAL Close the ICO's recommendations in writing and keep the closure letter — it is the best document in the file
- RECOMMENDED Independent penetration test and controls attestation before renewal
- CONSIDER Legal Expenses with regulatory-investigation scope — cheaper before the next contact than after it
Reprimand published
- CRITICAL Package cyber markets read a reprimand as an infringement finding — expect referral or decline
- LEGAL Employers' Liability £10m — no gap
- ESSENTIAL Mid-term notification to cyber, PI and D&O insurers — the reprimand is a material change
- ESSENTIAL Remediation file built around the reprimand's own findings — each named failure closed, evidenced and dated
- ESSENTIAL Specialist cyber re-placement with prior-circumstances exclusion negotiated as narrowly as possible
- RECOMMENDED Privacy liability limit reviewed against the number of individuals affected — Article 82 claims follow published reprimands
- RECOMMENDED D&O with regulatory-investigation cover for directors
Enforcement notice
- CRITICAL Breach of the notice is a further infringement carrying a penalty — the steps ordered are now the underwriter's warranty list as well as the regulator's
- LEGAL Employers' Liability £10m — no gap
- ESSENTIAL Mid-term notification to every liability insurer
- ESSENTIAL Legal Expenses or cyber regulatory-defence claim to fund compliance advice and any appeal to the First-tier Tribunal within 28 days
- ESSENTIAL Written confirmation from the ICO that each step in the notice is complete — obtain it before renewal
- ESSENTIAL Specialist cyber and PI re-placement presented with the compliance evidence
- RECOMMENDED Contractual review — customers' data-processing terms usually require notification of regulatory action
Notice of intent received — penalty proposed, 21 days for representations
- CRITICAL The representations window is where penalties halve — Advanced's fell from £6.09m to £3.07m. Instruct specialist data-protection counsel inside the window
- ESSENTIAL Notify the cyber insurer's regulatory-defence section and the Legal Expenses insurer now — costs incurred before notification are usually excluded
- ESSENTIAL Notify D&O — directors' conduct will be examined and the new interview powers may be used
- ESSENTIAL Budget the proposed penalty as wholly uninsured; do not assume the fines sub-limit responds
- ESSENTIAL Mid-term notification to PI and any other liability insurer whose sections could be reached
- RECOMMENDED Begin the re-placement file now — the final penalty notice will be public and the renewal will follow it
Monetary penalty notice imposed
- CRITICAL Decline trigger for package cyber, PI and D&O markets — specialist placement only
- LEGAL Employers' Liability £10m — no gap
- ESSENTIAL Pay or appeal within 28 days; a 20% early-payment discount is available on UK GDPR penalties where no appeal is lodged
- ESSENTIAL Full remediation pack keyed to every finding in the penalty notice — underwriters will read the notice, not the press release
- ESSENTIAL Specialist cyber re-placement: expect prior-circumstances exclusion, higher retention, ransomware sub-limit and MFA/EDR/backup warranties as conditions precedent
- ESSENTIAL Privacy liability limit sized to the affected population — group Article 82 claims follow penalty notices
- RECOMMENDED D&O re-placement through the same specialist route; disclose the penalty on every future form for five years
PECR marketing fine — calls, texts, emails or cookies
- CRITICAL PECR fines are outside almost every cyber wording — the policy covers data security, not marketing consent. Since 5 February 2026 the ceiling is £17.5m or 4% of turnover
- LEGAL Employers' Liability £10m — no gap
- ESSENTIAL Disclose on every liability form — a PECR penalty is regulatory action whatever the policy it does not touch
- ESSENTIAL Consent and suppression evidence rebuilt: TPS/CTPS screening, opt-in records, list provenance — the ICO's director-liability powers for PECR apply
- ESSENTIAL D&O — the ICO can pursue directors personally for PECR breaches, and disqualification has followed
- RECOMMENDED Legal Expenses with regulatory-investigation scope for the next contact
- CONSIDER Media and advertising liability extension for content-based claims — a separate exposure from consent
Are you ready to present a post-breach risk to a cyber underwriter?
Post-Breach Cyber Readiness Self-Check
Click each item you can evidence. Ten or more and the risk is presentable; fewer than six and it is not ready to go to market.
- Every ICO document in date order — breach report, correspondence, information notices, reprimand or notice of intent, penalty notice, closure letter
- Independent forensic report — initial access vector, dwell time, data exfiltrated, systems affected, and why the control failed
- Written closure of every finding in the reprimand, enforcement notice or penalty notice, each dated and evidenced
- MFA enforced on all remote access, email, cloud admin and privileged accounts — with a screenshot or attestation from the identity provider
- Endpoint detection and response deployed to every device and monitored 24/7, in-house or by a managed provider
- Immutable or offline backups segregated from production, with a dated restore test
- Patch management record showing critical vulnerabilities closed within 14 days, and no end-of-life systems exposed
- Incident-response plan updated after the breach, with the 72-hour ICO decision tree, insurer notification and named roles — and a tabletop exercise since
- Penetration test or Cyber Essentials Plus certificate dated after the remediation
- Data inventory and retention schedule — what personal data is held, where, why, and for how long; the ICO's first request in every investigation
- Board minute recording the incident, the actions, the budget approved and the director accountable for information security
- Five-year claims experience and prior insurer position — including every decline or non-renewal, with the reason
How hard will your business be to place?
Post-Breach Cyber Placement Assessor
Select the most serious ICO action and the state of remediation to see how the market will read the risk
What must you disclose to your insurer after ICO contact or a breach?
Cyber proposal forms are more direct than most. A typical set of questions asks whether the business has suffered any security incident, data breach, ransomware event or system outage in the last three or five years; whether any regulator has investigated, reprimanded or fined it; whether any claim or circumstance has been notified to any insurer; and whether any insurer has declined, cancelled or imposed special terms. Each is a question the answer to which is a public record — the ICO publishes reprimands, enforcement notices and penalty notices, and its quarterly data-security incident trends dataset records notified breaches by sector — so an inaccurate answer is discoverable at claim stage in minutes.
The harder judgement is the breach that was not reported. Article 33 of the UK GDPR requires notification to the ICO only where a breach is likely to result in a risk to individuals; a business that concluded, on advice, that a lost encrypted laptop or a misdirected internal email did not meet the threshold is entitled to that conclusion. But the proposal form does not ask "have you had a reportable breach"; it asks "have you had a breach". Under section 3 of the Insurance Act the business must disclose every material circumstance it knows or ought to know after a reasonable search, and a security incident that senior management investigated and documented is known. Disclose it, with the reasoning that it was not reportable; underwriters read that as maturity, not as a problem. Our guide to policies voided for non-disclosure sets out the remedies an insurer has when it finds out later.
Mid-term, the clocks run separately. The cyber policy's incident condition requires notification of a suspected breach "as soon as practicable" or within a fixed number of days — often 72 hours, sometimes less — and usually before any third-party vendor is instructed, because the insurer's panel forensic firm and breach counsel are part of what the premium buys. The ICO's Article 33 clock runs 72 hours from awareness. The PI policy's circumstances condition runs from when the business becomes aware of a circumstance that might give rise to a claim. The D&O policy's runs from when a director becomes aware of an investigation. Four clocks, one breach, and the most expensive error we see is a business that meets the ICO's deadline and misses the insurer's.
Who can sue you after a breach — and are Article 82 claims insured?
The Supreme Court's decision in Lloyd v Google [2021] UKSC 50 closed the door on "loss of control" damages without proof of individual harm, and on representative actions where damage varies between claimants. What it did not close is the ordinary group claim: individuals who can each show distress, anxiety or actual loss, joined together on a group litigation order or simply issued in parallel by the same claimant firm. The post-breach pattern is now settled — a published reprimand or penalty notice, followed within weeks by advertisements from claims-management firms inviting affected individuals to register, followed by letters of claim in batches of hundreds. Each claim is small; each costs more to defend than to settle; and the defence costs and settlements are met under the privacy liability section of a cyber policy up to its limit, which is why that limit has to be sized to the affected population rather than to the business's turnover.
Three exclusions matter. Contractual liability: most cyber wordings exclude liability assumed under contract beyond what would exist at law, so a customer's data-processing agreement that promises indemnity for "all losses" arising from a breach is only partly insured. Prior circumstances: claims from a breach already known at inception are excluded from the renewal policy and must go to the expiring one. And the insured-versus-insured and employee-claims position: claims from the business's own employees whose payroll or HR data was exposed are sometimes excluded or sub-limited, and an employee breach is the most common kind. For professional services firms the PI policy is also engaged — client data lost in the course of the work is a professional liability — and the two insurers will look to each other; the broker's job is to make sure both were notified. Our SaaS business insurance guide covers the processor-side exposure where the data belongs to customers' customers.
Why are marketing businesses the ICO's most-fined sector — and what changed on 5 February 2026?
The Privacy and Electronic Communications (EC Directive) Regulations 2003 govern direct marketing by phone, text, email and automated call, and the use of cookies and similar technologies. Regulation 22 requires prior consent for unsolicited electronic mail to individual subscribers unless the soft opt-in applies; regulation 21 prohibits live marketing calls to numbers registered with the Telephone Preference Service; regulation 19 bans automated calls without specific consent; regulation 6 governs cookies. Since 2018 the ICO has been able to hold directors personally liable for PECR fines where the company cannot pay, and it has used the power against lead-generation and energy-switching businesses whose directors dissolved the company to avoid the penalty.
For insurance the PECR exposure is close to uninsured. Cyber policies cover the security of personal data, not the lawfulness of its use for marketing; the regulatory-defence section may fund the response to an ICO investigation, but the fine is outside it on every wording we have placed. Professional indemnity does not respond to the company's own marketing. Media liability extensions cover defamation and intellectual property in content, not consent. What remains is Legal Expenses for the investigation, D&O for directors pursued personally, and — since the penalty ceiling rose thirty-five-fold — a compliance programme that treats consent evidence, TPS screening and list provenance as the survival items they now are. A business with a PECR penalty on its record is placeable for its other covers; the disclosure follows it for five years, and the penalty itself is paid from cash.
How does the ICO calculate a fine?
| Step | What the ICO assesses | What moves the number |
|---|---|---|
| 1 — Seriousness | Nature, gravity and duration; whether intentional or negligent; categories and volume of data; number of individuals; damage suffered | Special-category data, children's data, financial data and long dwell times push the starting point towards the top of the band |
| 2 — Turnover adjustment | The starting point as a percentage of the applicable maximum is applied to the undertaking's worldwide turnover — including the group, as LastPass UK discovered | Group structure matters; a UK subsidiary can be fined on the parent's revenue |
| 3 — Aggravating and mitigating factors | Action taken to mitigate damage; degree of responsibility; previous infringements; cooperation with the ICO; how the breach came to light; adherence to codes and certifications | Prompt, complete cooperation and a documented incident response reduce; a previous reprimand and slow alert response aggravate. Notifying inside 72 hours is expected, not mitigating |
| 4 — Effectiveness, proportionality, dissuasiveness | Whether the sum would achieve the regulatory purpose without being disproportionate to the organisation's means | Evidence of financial hardship, properly presented, can reduce; the ICO's public-sector approach substitutes reprimands for fines |
| 5 — Early payment | 20% reduction where the penalty is paid within 28 days and not appealed | Appeal to the First-tier Tribunal (Information Rights) forfeits the discount |
The representations window is the point at which insurance earns its keep. The ICO's notice of intent sets out the provisional findings and the proposed sum; the organisation has 21 days, extendable, to respond. Advanced Computer Software's proposed £6.09m became £3.07m after representations and a voluntary settlement; Capita's proposed £45m became £14m. The lawyers who make those representations are funded under the cyber policy's regulatory-defence section or a Legal Expenses policy, subject to the sub-limit and to notification before instruction. A business that cannot fund specialist representations pays the provisional figure.
What drives the cost of insurance after a breach or ICO action?
| Rating factor | Why it moves the premium | What reduces it |
|---|---|---|
| ICO rung reached | A closed breach report is a note; a reprimand is a finding; a penalty notice is a decline trigger for package markets | Nothing changes the rung; the file changes how it reads |
| Root cause of the incident | Missing MFA, unpatched systems and phishing are priced as control failures; a zero-day in a vendor product is priced as bad luck | Forensic report that attributes the cause and shows it closed |
| Data sensitivity and volume | Special-category, financial and children's data and large populations drive both the ICO's seriousness assessment and the privacy liability exposure | Data minimisation and retention schedule evidenced; population still able to claim quantified |
| Control environment now | MFA, EDR, immutable backups, patching cadence and privileged-access management are the five questions on every questionnaire | Attestations, screenshots, Cyber Essentials Plus, penetration test after remediation |
| Incident-response quality | Insurers price how the business behaved during the incident — alert response time, containment, notification, cooperation | Timeline showing hours not days; panel vendors used; ICO cooperation documented |
| Time since the incident | Recent breaches carry the heaviest weighting; each clean year discounts | Clean renewals; diary the three- and five-year points on each form |
| Sector | Healthcare, legal, financial services, recruitment, education and managed IT carry the heaviest data and the most claimant-firm attention | Sector-specific controls; contractual exposure mapped |
| Prior-circumstances exposure | The insurer prices the risk that unnotified matters from the breach surface under its policy | Notify every circumstance to the expiring policy; present the list to the new insurer |
| Disclosure history | An undisclosed breach or ICO action discovered later reads as concealment | Voluntary disclosure with written acknowledgement |
| Director involvement | An ICO interview notice or section 198 exposure is priced as management quality on D&O and cyber alike | Governance changes; named accountable director; board minute |
| Claims record | A paid cyber claim alongside the ICO action doubles the concern | Present the claim as resolved; show the same fix addresses both |
| Retention appetite | Specialist markets trade a self-insured layer for a lower rate | Take a realistic retention the business can fund from cash |
What do real post-breach placements look like — and how should you manage the process?
Case study 1 — The recruitment agency, the ransomware attack and the reprimand (composite, illustrative)
Situation: A £4.8m-turnover recruitment agency suffered a ransomware attack through a remote-access account without multi-factor authentication. 41,000 candidate records including passport scans and bank details were exfiltrated. The business notified its cyber insurer within six hours and the ICO within 48. The insurer's panel handled forensics, notification and a negotiated non-payment. The ICO issued a published reprimand citing the absence of MFA and a 19-month-old unpatched VPN appliance. Cyber costs paid: forensics £62,000, notification and credit monitoring £88,000, legal £41,000, network interruption £54,000 — total £245,000. Its cyber insurer non-renewed.
What we did: Notified every circumstance arising from the breach — the 41,000 candidates, the open ICO correspondence, the two client contracts under review — to the expiring cyber policy and to the PI policy before expiry. Built the file around the reprimand's own two findings: MFA enforced on every account with identity-provider attestation, the VPN appliance replaced, EDR deployed and monitored by a managed provider, immutable backups tested, Cyber Essentials Plus achieved, and a board minute naming the accountable director. Approached three Lloyd's cyber facilities.
Outcome: Placed at £19,400 against £8,900 expiring (+118%), £25,000 retention, a prior-circumstances exclusion limited to "the incident notified to the ICO on [date]" rather than any matter known, ransomware sub-limited to £500,000 and MFA/EDR/backup warranties as conditions precedent. PI renewed with a 20% loading and the same specific exclusion. 214 candidate claims were subsequently settled under the expiring policy's privacy liability section at an average of £1,150 plus costs.
Lessons: Every circumstance notified to the expiring policy is a claim that policy pays. The reprimand's findings are the renewal file; close them, evidence them, and the exclusion narrows.
Case study 2 — The lead-generation company and the PECR penalty (composite, illustrative)
Situation: A £2.1m-turnover lead-generation business sent 2.4 million marketing texts for home-improvement and debt-management clients using purchased lists with no valid consent. The ICO received 1,300 complaints via the 7726 reporting service and the carriers' data. A notice of intent proposed £180,000; after representations funded by the business, a monetary penalty notice of £120,000 was imposed under the pre-February 2026 regime. The business held a commercial combined policy with PL, a small cyber policy and no Legal Expenses.
What we did: Reviewed every policy for a response. The cyber policy's regulatory-defence section responded only to investigations of data-security matters — the PECR investigation was expressly outside it. PL excluded fines and regulatory action. The representations had cost £22,000 in legal fees, paid from cash. We confirmed there was no indemnity available for either the fine or the costs, and turned to the renewal: the PECR penalty was disclosed on every form, the two directors' personal exposure was addressed with a D&O policy carrying regulatory-investigation cover, and a Legal Expenses policy with regulatory scope was added.
Outcome: £142,000 borne by the business. Commercial combined renewed with a 15% loading — the PECR penalty read as management quality rather than physical risk; D&O placed at £2,400; Legal Expenses £680. The business rebuilt its consent evidence and list provenance before the £17.5m ceiling took effect.
Lessons: A PECR fine is the most completely uninsured penalty a business can receive. Legal Expenses is bought before the notice of intent or not at all, and the same conduct after 5 February 2026 is exposed to a ceiling thirty-five times higher.
Case study 3 — The accountancy practice, the misdirected data and the enforcement notice (composite, illustrative)
Situation: A six-partner accountancy practice with £3.6m turnover discovered that a client portal misconfiguration had allowed any logged-in client to view other clients' documents for eleven months. 640 clients' tax returns and bank statements were accessible; access logs showed 38 had been viewed by the wrong client. The practice reported to the ICO within 72 hours. The ICO issued an enforcement notice requiring an independent security review, access-control testing before any portal change, and a data-protection officer appointment within 90 days. 300 clients joined a group claim organised by a claimant firm.
What we did: Notified the cyber insurer on discovery and the PI insurer the same day, on the basis that client data in the course of professional services engaged both. The cyber insurer's panel handled the forensic review and client notification; the group claim was notified to both insurers, and the PI insurer led the defence under an agreed cost-sharing arrangement. Each step in the enforcement notice was completed with the ICO's written confirmation obtained before renewal, and the file was presented to both markets with the confirmation letter at the front.
Outcome: Cyber incident costs £71,000 paid. Group claim settled at £96,000 plus £48,000 defence costs, split between cyber privacy liability and PI. Cyber renewed at £14,200 against £6,100 (+133%) with the incident excluded; PI renewed at £31,000 against £24,500 (+27%) with a portal-security warranty. The enforcement notice was closed by the ICO fourteen months after the breach.
Lessons: Client data is a PI circumstance as well as a cyber incident; notify both. An enforcement notice's own steps, completed and confirmed in writing, are the strongest renewal file a breached business can present.
How to manage your insurance after an ICO fine, reprimand or data breach — the eight-step process
- Notify the cyber insurer before anyone else. On discovery of a suspected breach, notify the cyber insurer's incident line before instructing any vendor, paying any ransom or contacting the ICO. The panel forensic firm and breach counsel are what the premium buys, and instructing outside the panel forfeits cover on most wordings.
- Notify every other policy that could be reached the same day. Client data engages professional indemnity; an investigation of directors engages D&O; a fraudulent instruction engages crime; ICO notices engage legal expenses. Each has its own clock. Notify all of them as circumstances, in writing, and keep the acknowledgements.
- Make the Article 33 decision inside 72 hours with insurer-funded counsel. Decide with breach counsel whether the incident is reportable and document the reasoning either way. Report inside 72 hours where it is. Prompt notification is expected rather than mitigating, but late notification is aggravating and a reprimand in its own right.
- Fund the ICO representations from the regulatory-defence cover. If a notice of intent arrives, instruct specialist data-protection counsel inside the 21-day window under the cyber policy's regulatory-defence section or a legal expenses policy. Representations routinely halve proposed penalties. Budget the penalty itself as uninsured.
- Fix the failed control and document every pound spent. Underwriters price the probability of recurrence. Commission the forensic report, close every finding in any reprimand or notice with dated evidence, deploy MFA, EDR and immutable backups, obtain a post-remediation penetration test or Cyber Essentials Plus, and minute it at board level.
- Notify every remaining circumstance to the expiring policy before it lapses. Individuals who have not yet claimed, open ICO correspondence and second-stage attack risk all belong to the policy in force when the breach occurred. List them and notify them before expiry, or the renewal policy's prior-circumstances exclusion leaves them uninsured.
- Go to specialist markets with the file, not to package markets with the form. Package and scheme cyber insurers decline prior breaches and ICO action by rule, and each decline is disclosable. A specialist broker with Lloyd's and MGA access presents the control environment first and the incident second, and negotiates the prior-circumstances exclusion to the specific event.
- Diary the three- and five-year points and present the clean record at every renewal. Cyber forms ask about incidents in the last three or five years; liability forms about regulatory action in the last five. Present the clean record and the current controls at each renewal, challenge the loading as clean years accumulate, and remove the disclosure when the period expires.
Glossary of ICO enforcement and cyber insurance terms
- Article 33 notification
- The UK GDPR duty on a controller to notify the ICO of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Article 34 adds a duty to tell affected individuals without undue delay where the risk is high.
- Article 82 claim
- A claim by an individual for compensation for material or non-material damage — including distress — caused by an infringement of the UK GDPR, given effect by section 168 of the Data Protection Act 2018. Covered by the privacy liability section of a cyber policy.
- Article 83 penalty
- The administrative fine the ICO may impose for UK GDPR infringements: up to £8.7m or 2% of worldwide turnover for the lower tier (security, records, processor obligations) and £17.5m or 4% for the higher tier (principles, individual rights, transfers). Given effect by sections 155–157 of the DPA 2018.
- Claims-made
- The basis on which cyber, PI and D&O policies are written: the policy in force when a claim or circumstance is first notified responds, not the policy in force when the incident happened. The reason unnotified matters must go to the expiring policy before it lapses.
- Condition precedent
- A policy term that must be satisfied before the insurer is liable at all — commonly the MFA, EDR and backup warranties on post-breach cyber policies. Breach entitles the insurer to decline the claim regardless of whether the breach caused the loss, subject to section 11 of the Insurance Act 2015.
- Data (Use and Access) Act 2025 (DUAA)
- The Act, commenced in the main on 5 February 2026, that raised PECR penalties to UK GDPR levels, gave the ICO interview and technical-report powers, required a controller complaints procedure from 19 June 2026, and provides for the ICO to become the Information Commission.
- Enforcement notice
- A notice under section 149 of the DPA 2018 requiring a controller or processor to take, or refrain from taking, specified steps. Failure to comply is itself an infringement carrying a penalty. Appealable to the First-tier Tribunal within 28 days.
- Fining guidance
- The ICO's Data Protection Fining Guidance, setting out the five-step method for calculating a penalty: seriousness, turnover adjustment, aggravating and mitigating factors, effectiveness and proportionality, and early-payment reduction.
- Information Commission
- The body corporate that will replace the office of the Information Commissioner under the DUAA, with a chair and board structure. Commencement date to be confirmed; enforcement powers are unchanged by the transition.
- Notice of intent
- The ICO's provisional decision to impose a penalty, setting out the findings and the proposed sum, with 21 days for written representations. The stage at which most penalties are reduced — Advanced's from £6.09m to £3.07m, Capita's from £45m to £14m.
- PECR
- The Privacy and Electronic Communications (EC Directive) Regulations 2003, governing direct marketing by phone, text, email and automated call, and the use of cookies. Since 5 February 2026 breaches carry the same £17.5m / 4% maximum penalty as the UK GDPR.
- Prior-circumstances exclusion
- The clause on a renewal cyber, PI or D&O policy excluding claims arising from any incident, circumstance or investigation known before inception. After a breach it should be negotiated to the specific incident rather than "any matter of which the insured was aware".
- Privacy liability
- The section of a cyber policy covering the insured's liability to third parties — individuals, customers, partners — for a breach of personal or confidential data, including Article 82 claims, defence costs and settlements. The limit should be sized to the affected population.
- Regulatory-defence cover
- The section of a cyber or legal expenses policy that funds legal representation in an ICO investigation, including representations against a notice of intent. Usually sub-limited; distinct from cover for the penalty itself.
- Reprimand
- A published formal finding by the ICO that an organisation has infringed the UK GDPR or DPA 2018, issued without a penalty under Article 58(2)(b). The ICO's default outcome for public bodies since 2022 and widely used for SMEs; disclosable as regulatory action.
- Section 198 DPA 2018
- The provision under which a director, manager, secretary or similar officer is personally guilty of an offence under the Act committed by the company with their consent or connivance or attributable to their neglect. D&O funds the defence; the fine is the individual's.
- "Where insurable by law"
- The qualification attached to fines and penalties cover on almost every cyber wording. Whether a UK GDPR or PECR penalty is insurable under English public policy has not been decided by any court; the prudent planning assumption is that it is not.
Frequently asked questions
Yes. Package and scheme cyber insurers usually decline or non-renew a business with a reported breach or ICO action in the last three to five years, but Lloyd's cyber syndicates and specialist MGAs write breached businesses on evidence. Expect a prior-circumstances exclusion for the incident already known about, a higher retention, a ransomware sub-limit and warranties on multi-factor authentication, endpoint detection and backups as conditions precedent.
Almost every cyber policy covers regulatory fines only where insurable by law, and no English court has decided whether a UK GDPR or PECR penalty is. English public policy prevents indemnity for the consequences of deliberate or reckless wrongdoing, and a penalty for negligence is disputed territory. Plan as though the fine is uninsured. What the policy reliably funds is the legal representation that reduces it.
Yes. A reprimand is published regulatory action and every cyber, professional indemnity and directors' and officers' proposal form asks about it. Under the Insurance Act 2015 it is a material circumstance to be disclosed at renewal whether or not the form asks, and under most policies' change-in-risk conditions it should be notified mid-term. Answering no because there was no fine is a misrepresentation.
Usually, yes. Cyber proposal forms ask whether you have had a security incident or breach, not whether you had a reportable one. A security incident that senior management investigated is a known circumstance under the Insurance Act 2015 duty of fair presentation. Disclose it with the reasoning that it did not meet the Article 33 threshold; underwriters read a documented decision as maturity.
Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for higher-tier UK GDPR infringements, and £8.7 million or 2% for lower-tier infringements including security failures. Since 5 February 2026 the same £17.5 million or 4% maximum applies to breaches of the PECR marketing rules under the Data (Use and Access) Act 2025, replacing the previous £500,000 cap.
A reported breach closed with advice and the controls evidenced typically adds 10–25%. A reprimand or enforcement notice with a full remediation pack adds 30–60%. A penalty notice moves the placement to specialist markets at 60–150% over the pre-breach premium in year one, with a retention of £10,000 to £50,000. The loading falls with each clean year and with evidence such as Cyber Essentials Plus.
Yes. Article 82 of the UK GDPR and section 168 of the Data Protection Act 2018 give any affected individual a right to compensation for material or non-material damage, including distress, without proving financial loss. Individual awards are usually modest; the exposure is volume, as claimant firms build group claims from published reprimands and penalty notices. The privacy liability section of a cyber policy responds; public liability does not.
If client data was involved, yes. A breach of client data in the course of professional services is a circumstance under the PI policy as well as an incident under the cyber policy, and the PI insurer expects to be notified whether or not cyber cover exists. Notify both on discovery. At renewal the PI insurer will ask about the breach and may impose a loading or a specific exclusion.
No, on every wording we have placed. Cyber policies cover the security of personal data, not the lawfulness of marketing; the regulatory-defence section may fund the response to an ICO investigation, but the penalty is outside it. Since 5 February 2026 PECR penalties can reach £17.5 million or 4% of turnover, and the ICO can pursue directors personally where the company cannot pay.
Notify your cyber insurer's incident line before instructing any vendor, paying any ransom or contacting the ICO, so the panel forensic firm and breach counsel are engaged under the policy. Then notify any other policy that could be reached — professional indemnity, D&O, crime, legal expenses — the same day. Make the Article 33 decision with counsel inside 72 hours and document the reasoning either way.
For the criminal offences in the Data Protection Act 2018, yes: section 198 makes a director, manager or officer personally guilty where the company's offence was committed with their consent or connivance or was attributable to their neglect. For PECR penalties the ICO can hold directors personally liable where the company cannot pay. D&O cover funds the defence and the response to the ICO's new interview powers; it does not pay a fine.
Look for a broker whose first questions are your control environment — MFA, endpoint detection, backups, patching — and what the ICO's findings said, not just what the incident was, and who places through Lloyd's cyber syndicates and specialist MGA markets with PI and D&O alongside. Miller & Partner places businesses after reported breaches, reprimands, enforcement notices and penalties using The Insurability Framework, and confirms every disclosure in writing at placement.
Instagram
LinkedIn