Your cyber insurance policy likely includes privacy coverage. But if you think coverage only applies when data leaks, you're missing how privacy litigation has evolved in 2024.
Many insurers are now limiting privacy coverage or adding exclusions. Privacy litigation is increasing even without data breaches. Regulatory changes in the U.S. and abroad have created liability scenarios that traditional cyber policies weren't designed to handle. If your renewal is coming up, this checklist will help you verify that your coverage still matches your actual exposure.
What This Checklist Covers
This checklist addresses the gap between traditional breach-triggered privacy coverage and the regulatory reality your organization faces today. You'll verify whether your policy covers wrongful collection claims, regulatory actions without breach events, and privacy litigation from compliance failures rather than security incidents.
Use this before your renewal conversation. If you find gaps, you'll have time to negotiate endorsements or coverage buybacks instead of discovering exclusions mid-claim.
Prerequisites
Before working through this checklist, gather:
- Your current Stand-Alone Cyber Policy declarations page and policy form
- Any cyber endorsements attached to your property or general liability policies
- A list of jurisdictions where you collect, process, or store personal data
- Your most recent Underwriting Questionnaire responses related to data handling practices
- Documentation of your privacy compliance program (policies, training records, vendor agreements)
You'll also need input from your broker and your privacy or compliance lead. Coverage interpretation requires both policy expertise and operational context.
Checklist Items
1. Verify your privacy coverage trigger language
Review your policy's insuring agreement for privacy coverage. Does it require a "data breach event" or "security incident" to trigger coverage, or does it cover "wrongful collection" or "privacy violations" more broadly?
✓ Good looks like: Coverage that responds to "actual or alleged violation of privacy regulations" or "wrongful collection, use, or disclosure of nonpublic information" without needing proof of a security incident. The trigger should be regulatory action or litigation, not breach confirmation.
2. Check for new privacy exclusions added at last renewal
Compare your current policy form to your prior year's version. Look specifically for exclusions related to biometric data collection, tracking technologies, consent violations, or regulatory compliance failures.
✓ Good looks like: No new exclusions, or if exclusions exist, they're narrow and you've negotiated a buyback endorsement for the specific privacy risks relevant to your operations.
3. Confirm coverage for regulatory defense costs and fines
Identify whether your policy covers both defense costs for regulatory investigations and the fines or penalties that result. Some policies cover defense but exclude the penalty itself.
✓ Good looks like: Explicit coverage for "regulatory defense expenses" and "civil fines and penalties" arising from privacy violations, with sublimits clearly stated. Your broker should be able to point to the specific policy provision.
4. Review your Breach Notification Requirement coverage scope
Check whether your policy covers notification costs only when triggered by a breach, or whether it extends to regulatory-mandated notices for non-breach privacy violations (such as consent failures or unauthorized tracking).
✓ Good looks like: Coverage for notification and credit monitoring expenses triggered by "regulatory requirement" rather than only "security breach." This matters when regulators require notice even if no data was exfiltrated.
5. Assess coverage for class-action privacy litigation
Determine whether your policy covers class-action lawsuits alleging wrongful data collection, unauthorized tracking, or consent violations when no breach occurred.
✓ Good looks like: Your policy's third-party liability section explicitly includes "privacy claims" or "wrongful collection claims" without requiring a breach event. Defense costs should be outside the limit, not eroding it.
6. Verify underwriting alignment with your data practices
Review your most recent Underwriting Questionnaire. Did you disclose all jurisdictions where you operate, all categories of personal data you collect, and your use of tracking technologies or biometric data?
✓ Good looks like: Your questionnaire responses match your actual data handling practices. Misrepresentation creates grounds for denial under the Application Fraud Warranty. If your practices have changed since you last applied, notify your broker immediately.
7. Check for coverage of Contingent Business Interruption from cloud provider failures
Review your Business Interruption Coverage and Contingent Business Interruption provisions. Do they cover income loss when a cloud provider's non-security system failure disrupts your operations?
✓ Good looks like: Coverage that includes "dependent system failure" or "non-malicious system failure" at third-party service providers, not just breach-related outages. Your policy should define "system" broadly enough to include cloud infrastructure.
8. Document Insurer Consent Requirements for privacy-related settlements
Identify whether your policy requires insurer consent before you settle a privacy claim or respond to a regulatory demand. Some policies void coverage if you settle without consent.
✓ Good looks like: Clear consent procedures documented in your policy, with reasonable timelines for insurer response. You should know who to contact and how quickly they must respond during an active regulatory investigation.
Common Mistakes
Assuming all privacy coverage is the same. Not all wrongful collection endorsements are created equal. Some only cover claims arising from a breach. Others cover regulatory violations regardless of breach status. Read the trigger language, not just the coverage label.
Failing to update underwriting responses when your data practices change. If you started collecting biometric data, expanded into new jurisdictions, or changed your consent mechanisms after your last renewal, your policy may not respond. Notify your broker of material changes mid-term.
Ignoring sublimits on regulatory coverage. A policy with a $5 million limit might have a $500,000 sublimit for regulatory fines. If your exposure is higher, negotiate a higher sublimit or a separate regulatory liability endorsement.
Not coordinating with your breach coach before responding to regulators. Many policies require you to use panel counsel or obtain Insurer Consent before retaining outside counsel. Violating this requirement can void coverage. Know your panel options before an incident occurs.
Next Steps
If you found gaps in items 1, 2, or 5, contact your broker before your renewal. Carriers are restricting this coverage, but some will add it back if you can demonstrate strong privacy controls and compliance documentation.
If your Underwriting Questionnaire responses are outdated (item 6), prepare an updated disclosure now. Waiting until renewal creates time pressure and increases the risk of misrepresentation.
If you lack documentation of your privacy program, start building it. Insurers underwriting privacy risk want evidence of consent management, vendor oversight, and breach response planning. The stronger your program, the more leverage you have to negotiate broad coverage terms.
Your policy should match the regulatory environment you operate in, not the one that existed when cyber insurance was purely breach-focused. Use this checklist to verify that match exists.
