Why doesn't general liability cover a data breach?

Standard GL policies are built around bodily injury and property damage from premises and operations exposure — a customer slipping in your office, a contractor damaging a client's property. Most GL policies include a broad cyber/data exclusion that specifically carves out anything arising from a data breach, unauthorized access, or loss of electronic data, since that risk category is meant to be covered by a separate cyber policy entirely.

What's the difference between cyber liability and technology E&O?

Cyber liability covers the costs that follow a data breach or network security failure — forensics, breach notification, credit monitoring, regulatory defense, and third-party claims. Technology E&O covers professional liability when a client claims your software or service failed to perform as promised and caused them a financial loss, regardless of whether a breach was involved. Most technology companies need both, often written together in a single package.

Does a business owners policy (BOP) include cyber coverage?

Rarely in any meaningful way. Some BOPs include a small cyber endorsement with limited sub-limits — often in the range of a few thousand to $25,000 — which is far below what an actual breach response costs. Treating a BOP's cyber endorsement as adequate coverage is one of the more common and more expensive mistakes we see technology companies make.

What does a data breach actually cost a small company?

Costs vary by the volume and sensitivity of data involved, but typically include forensic investigation, legal counsel, breach notification to affected individuals, credit monitoring services, regulatory defense, and potential third-party claims. For companies handling any meaningful volume of customer data, these costs commonly reach well into six figures even for a contained incident, before accounting for business interruption or reputational impact.

Do I need cyber insurance if I don't store much customer data?

Yes, in most cases. Even businesses that handle relatively little data are exposed to ransomware, business email compromise, and social engineering fraud, none of which require large data volumes to cause serious financial loss. Cyber policies typically cover these scenarios alongside traditional data breach response, which is why even data-light service businesses carry it.

Does General Liability Cover a Data Breach? (No — Here's What Does)

We hear a version of this question constantly from technology company founders: "Don't I already have this covered under my general liability policy?" The answer is almost always no, and the reason is worth understanding, because it's not a technicality — it's a fundamental mismatch between what GL policies are built to cover and what a data breach actually is.

What General Liability Is Actually Built For

Standard general liability policies are built around bodily injury and property damage arising from premises and operations — a customer who slips and falls in your office, a contractor who damages a client's property while on site. That's the risk model the policy, the pricing, and the underwriting are all built around. A data breach doesn't fit that model at all: no one is physically injured, and no physical property is damaged.

Because of this mismatch, most GL policies include an explicit cyber or data exclusion — language that specifically carves out any claim arising from a data breach, unauthorized access, or loss of electronic data. This isn't an oversight or a loophole; it's a deliberate exclusion, because that risk category is meant to live in a separate, purpose-built policy.

The BOP Cyber Endorsement Trap

Some business owners policies include a small cyber endorsement bundled in, and we regularly meet technology company founders who believe this endorsement means they're covered. In most cases it doesn't come close. These endorsements typically carry sub-limits in the range of a few thousand dollars up to perhaps $25,000 — far below what an actual breach response costs once forensics, legal counsel, notification, and credit monitoring are all factored in. Treating a BOP cyber endorsement as real cyber coverage is one of the more expensive assumptions a growing tech company can make.

What a Real Cyber Program Actually Covers

A properly structured cyber liability policy addresses both sides of a breach event:

First-party costs — the expenses your business incurs directly: forensic investigation, breach notification, credit monitoring for affected individuals, business interruption from the outage, and system restoration.
Third-party claims — when a customer, partner, or regulator brings a claim against you because of the breach, covering defense costs and settlements.

A complete program includes both, since a single breach event can trigger direct response costs and third-party claims simultaneously — covering only one side leaves a real gap.

Where Technology E&O Fits In

Cyber liability and technology E&O are related but distinct, and most technology companies need both. Cyber liability responds to a data breach or network security failure. Technology E&O responds when a client claims your software or service failed to perform as promised and caused them a financial loss — a bug that corrupts a client's data, an outage that costs a customer revenue — regardless of whether a breach was actually involved. These are frequently written together in a single package policy, which is usually the more efficient structure.

What This Actually Costs Versus What a Breach Costs

The math here isn't close. Cyber liability premiums for most small and mid-sized technology companies represent a small fraction of what even a contained data breach costs to respond to — and that's before accounting for the reputational and customer-retention impact of a breach handled without proper coverage in place. We size the limit to your actual data footprint, revenue, and customer contract obligations rather than defaulting to a generic number, since a policy that's too thin defeats the purpose and one that's oversized wastes premium.

Does General Liability Cover a Data Breach? (No — Here's What Does.)