Cyber insurance in Germany

A cyber policy combines a service with an insurance. The service is an emergency hotline with IT forensics, lawyers and crisis communication on call around the clock. The insurance pays for restoring data and systems, for lost income while the business stands still and for claims by customers and partners whose data or systems were affected.

For a German entity the local element counts. A breach of personal data must normally be reported to the competent data protection authority within 72 hours under the GDPR, and in Germany that authority is organised by federal state. A response team that works in German and in the German time zone saves time when it matters.

What is covered?

What insurers expect from your IT security

Cyber insurers ask before they quote. Typical minimum requirements are multi-factor authentication for remote access and administrator accounts, regular backups that are kept separate from the network and tested, timely patching and trained staff. Answers in the proposal form must be accurate — incorrect statements can jeopardise the cover.

Are we covered under the group’s cyber policy?

Group policies often include subsidiaries, but check whether the German entity is named, whether the insurer may cover German risks, whether the limit is shared across the group and whether the response service is available locally and in German. Where it is not, a local German cyber policy can be placed alongside or underneath the group programme.

What does it cost?

The premium depends on turnover, sector, the limit and the state of your IT security. Small companies with turnover of up to about €2 million often pay from roughly €500 to €2,000 net a year for limits between €500,000 and €1 million. Insurance premium tax of 19% is added; only a quote is binding.