Welcome to the pro forma digital version of the Beazley Breach Response policy. We have designed it to save you the hassle of constantly flicking back and forth to read policy definitions. Just click on the defined term and its definition will appear in the right hand column.

THIS POLICY’S LIABILITY INSURING AGREEMENTS PROVIDE COVERAGE ON A CLAIMS MADE AND REPORTED BASIS AND APPLY ONLY TO CLAIMS FIRST MADE AGAINST THE INSURED DURING THE POLICY PERIOD OR THE OPTIONAL EXTENSION PERIOD (IF APPLICABLE) AND REPORTED TO THE UNDERWRITERS IN ACCORDANCE WITH THE TERMS OF THIS POLICY. AMOUNTS INCURRED AS CLAIMS EXPENSES UNDER THIS POLICY WILL REDUCE AND MAY EXHAUST THE LIMIT OF LIABILITY AND ARE SUBJECT TO RETENTIONS.

Please refer to the Declarations, which show the insuring agreements that the named insured purchased. If an insuring agreement has not been purchased, coverage under that insuring agreement of this Policy will not apply.

The Underwriters agree with the named insured, in consideration of the payment of the premium and reliance upon the statements contained in the information and materials provided to the Underwriters in connection with the underwriting and issuance of this Insurance Policy (hereinafter referred to as the "Policy") and subject to all the provisions, terms and conditions of this Policy:

Insuring Agreements back to top

To provide breach response services to the insured organization because of an actual or reasonably suspected data breach or security breach that the insured first discovers during the policy period.

To indemnify the insured organization for:

Business interruption loss

Business interruption loss that the insured organization sustains as a result of a security breach or system failure that the insured first discovers during the policy period.

dependent business interruption loss

dependent business loss that the insured organization sustains as a result of a dependent security breach or a dependent system failure that the insured first discovers during the policy period.

Cyber extortion loss

Cyber extortion loss that the insured organization incurs as a result of an extortion threat first made against the insured organization during the policy period.

Data recovery costs

Data recovery costs that the insured organization incurs as a direct result of a security breach that the insured first discovers during the policy period.

Data & Network Liability

To pay damages and claims expenses, which the insured is legally obligated to pay because of any claim first made against any insured during the policy period for:

  1. a data breach;
  2. a security breach;
  3. the insured organization’s failure to timely disclose a data breach or security breach;
  4. failure by the insured to comply with that part of a privacy policy that specifically:
    1. prohibits or restricts the insured organization’s disclosure, sharing or selling of personally identifiable information;
    2. requires the insured organization to provide an individual access to personally identifiable information or to correct incomplete or inaccurate personally identifiable information after a request is made; or
    3. mandates procedures and requirements to prevent the loss of personally identifiable information;
      provided the insured organization has in force, at the time of such failure, a privacy policy that addresses those subsections above that are relevant to such claim.
Regulatory Defense & penalties

To pay penalties and claims expenses, which the insured is legally obligated to pay because of a regulatory proceeding first made against any insured during the policy period for a data breach or a security breach.

Payment Card Liabilities & Costs

To indemnify the insured organization for PCI fines and expenses and costs which it is legally obligated to pay because of a claim first made against any insured during the policy period.

Media liability

To pay damages and claims expenses, which the insured is legally obligated to pay because of any claim first made against any insured during the policy period for media liability.

To indemnify the insured organization for any direct financial loss sustained resulting from:

  1. fraudulent instruction;
  2. funds transfer fraud; or
  3. telephone fraud;

that the insured first discovers during the policy period.

To indemnify the insured organization for criminal reward funds.

Exclusions back to top

The coverage under this Policy will not apply to any loss arising out of:

  1. physical injury, sickness, disease or death of any person, including any mental anguish or emotional distress resulting from such physical injury, sickness, disease or death; or
  2. physical injury to or destruction of any tangible property, including the loss of use thereof; but electronic data will not be considered tangible property;

Any actual or alleged false, deceptive or unfair trade practices, antitrust violation, restraint of trade, unfair competition (except as provided in the media liability insuring agreement), or false or deceptive or misleading advertising or violation of the Sherman Antitrust Act, the Clayton Act, or the Robinson-Patman Act; but this exclusion will not apply to:

  1. the Breach response insuring agreement; or
  2. coverage for a data breach or security breach, provided no member of the control group participated or colluded in such data breach or security breach;
  1. the unlawful collection or retention of personally identifiable information or other personal information by or on behalf of the insured organization; but this exclusion will not apply to claims expenses incurred in defending the insured against allegations of unlawful collection of personally identifiable information; or
  2. the distribution of unsolicited email, text messages, direct mail, facsimiles or other communications, wire tapping, audio or video recording, or telemarketing, if such distribution, wire tapping, recording or telemarketing is done by or on behalf of the insured organization; but this exclusion will not apply to claims expenses incurred in defending the insured against allegations of unlawful audio or video recording;
  1. any act, error, omission, incident or event committed or occurring prior to the inception date of this Policy if any member of the control group on or before the continuity date knew or could have reasonably foreseen that such act, error or omission, incident or event might be expected to be the basis of a claim or loss;
  2. any claim, loss, incident or circumstance for which notice has been provided under any prior policy of which this Policy is a renewal or replacement;


  1. any actual or alleged violation of the Organized Crime Control Act of 1970 (commonly known as Racketeer Influenced and Corrupt Organizations Act or RICO), as amended;
  2. any actual or alleged acts, errors or omissions related to any of the insured organization’s pension, healthcare, welfare, profit sharing, mutual or investment plans, funds or trusts;
  3. any employer-employee relations, policies, practices, acts or omissions, or any actual or alleged refusal to employ any person, or misconduct with respect to employees; or
  4. any actual or alleged discrimination;
but this exclusion will not apply to coverage under the breach response insuring agreement or parts 1., 2. or 3. of the data & Network Liability insuring agreement that results from a data breach; provided no member of the control group participated or colluded in such data breach;

  1. the ownership, sale or purchase of, or the offer to sell or purchase stock or other securities; or
  2. an actual or alleged violation of a securities law or regulation;

Any criminal, dishonest, fraudulent, or malicious act or omission, or intentional or knowing violation of the law, if committed by an insured, or by others if the insured colluded or participated in any such conduct or activity; but this exclusion will not apply to:

  1. claims expenses incurred in defending any claim alleging the foregoing until there is a final non-appealable adjudication establishing such conduct; or
  2. with respect to a natural person insured, if such insured did not personally commit, participate in or know about any act, error, omission, incident or event giving rise to such claim or loss.
    For purposes of this exclusion, only acts, errors, omissions or knowledge of a member of the control group will be imputed to the insured organization;
  1. infringement, misuse or abuse of patent or patent rights;
  2. infringement of copyright arising from or related to software code or software products other than infringement resulting from a theft or unauthorized access or use of software code by a person who is not a past, present or future employee, director, officer, partner or independent contractor of the insured organization; or
  3. use or misappropriation of any ideas, trade secrets or third party information (i) by, or on behalf of, the insured organization, or (ii) by any other person or entity if such use or misappropriation is done with the knowledge, consent or acquiescence of a member of the control group;

A claim brought by or on behalf of any state, federal, local or foreign governmental entity, in such entity’s regulatory or official capacity; but this exclusion will not apply to the Regulatory Defense & penalties insuring agreement;

A claim made by or on behalf of:

  1. any insured; but this exclusion will not apply to a claim made by an individual that is not a member of the control group under the data & Network Liability insuring agreement, or a claim made by an additional insured; or
  2. any business enterprise in which any insured has greater than 15% ownership interest or made by any parent company or other entity which owns more than 15% of the named insured;
  1. any trading losses, trading liabilities or change in value of accounts;
  2. any loss, transfer or theft of monies, securities or tangible property of the insured or others in the care, custody or control of the insured organization
  3. the monetary value of any transactions or electronic fund transfers by or on behalf of the insured which is lost, diminished, or damaged during transfer from, into or between accounts; or
  4. the value of coupons, price discounts, prizes, awards, or any other valuable consideration given in excess of the total contracted or expected amount;
    but this exclusion will not apply to coverage under the eCrime insuring agreement;

With respect to the media liability insuring agreement:

  1. any contractual liability or obligation; but this exclusion will not apply to a claim for misappropriation of ideas under implied contract;
  2. the actual or alleged obligation to make licensing fee or royalty payments;
  3. any costs or expenses incurred or to be incurred by the insured or others for the reprinting, reposting, recall, removal or disposal of any media material or any other information, content or media, including any media or products containing such media material, information, content or media;
  4. any claim brought by or on behalf of any intellectual property licensing bodies or organizations;
  5. the actual or alleged inaccurate, inadequate or incomplete description of the price of goods, products or services, cost guarantees, cost representations, contract price estimates, or the failure of any goods or services to conform with any represented quality or performance;
  6. any actual or alleged gambling, contest, lottery, promotional game or other game of chance; or
  7. any claim made by or on behalf of any independent contractor, joint venturer or venture partner arising out of or resulting from disputes over ownership of rights in media material or services provided by such independent contractor, joint venturer or venture partner;

With respect to the First Party loss insuring agreements:

  1. seizure, nationalization, confiscation, or destruction of property or data by order of any governmental or public authority;
  2. costs or expenses incurred by the insured to identify or remediate software program errors or vulnerabilities or update, replace, restore, assemble, reproduce, recollect or enhance data or computer systems to a level beyond that which existed prior to a security breach, system failure, dependent security breach, dependent system failure or extortion threat;
  3. failure or malfunction of satellites or of power, utility, mechanical or telecommunications (including internet) infrastructure or services that are not under the insured organization’s direct operational control; or
  4. fire, flood, earthquake, volcanic eruption, explosion, lightning, wind, hail, tidal wave, landslide, act of God or other physical event.

Limit of Liability and Coverage back to top

The Policy Aggregate Limit of Liability listed in the Declarations (the "policy aggregate limit of liability") is the Underwriters’ combined total limit of liability for all loss, other than breach response services, payable under this Policy.

The limit of liability payable under each insuring agreement will be an amount equal to the policy aggregate limit of liability unless another amount is listed in the Declarations. Such amount is the aggregate amount payable under this Policy pursuant to such insuring agreement and is part of, and not in addition to, the policy aggregate limit of liability.

All dependent business loss payable under this Policy is part of and not in addition to the business interruption loss limit listed in the Declarations.

The Underwriters will not be obligated to pay any damages, penalties, PCI fines and expenses and costs or claims expenses, or to defend any claim, after the policy aggregate limit of liability has been exhausted, or after deposit of the policy aggregate limit of liability in a court of competent jurisdiction.

Coverage for breach response services under this Policy is in addition to the policy aggregate limit of liability.

The Notified Individuals limit listed in the Declarations is the maximum total number of individuals to whom notification, call center and credit or identity monitoring services will be provided (or attempted) for all incidents or series of related incidents giving rise to an obligation to provide breach response services.

The Legal, Forensic & Public Relations/Crisis Management limit listed in the Declarations is the aggregate limit of coverage for all services and costs covered under parts 1., 2., 3. and 7. of the definition of breach response services.

Except as provided in the Additional Breach Response Limits clause below, the Underwriters will not be obligated to provide any breach response services after the number of individuals to whom services are provided under part 4. of the definition of breach response services reaches the Notified Individuals limit listed in the Declarations. If the total number of individuals to be notified under the Policy exceeds the Notified Individuals limit listed in the Declarations, the insured will be responsible for notifying and providing call center services and credit or identity monitoring services to such additional individuals in accordance with the processes described in the Information Packet.

Notwithstanding the foregoing, if:

  1. the total number of individuals to whom services described in parts 4., 5. and 6. of the definition of breach response services are provided exceeds the amount listed in Notified Individuals limit listed in the Declarations; or
  2. the dollar amount of the services described in parts 1., 2., 3. and 7. of the definition of breach response services provided to the insured organization exceeds the Legal, Forensic & Public Relations/Crisis Management limit listed in the Declarations;

this Policy will cover the costs, fees and expenses incurred to provide such breach response services up to an amount equal to the policy aggregate limit of liability (the "additional breach response limit").

The Additional Breach Response Limit is part of, and not in addition to, the policy aggregate limit of liability and will be reduced and may be exhausted by payments under either limit. Upon exhaustion of the additional breach response limit, there will be no further coverage under this Policy for any costs, fees or expenses covered thereunder.

The Retention listed in the Declarations applies separately to each incident, event or related incidents or events giving rise to a claim or loss. The Retention will be satisfied by monetary payments by the named insured of covered loss under each insuring agreement. If any loss arising out of an incident or claim is subject to more than one Retention, the Retention for each applicable insuring agreement will apply to such loss, provided that the sum of such Retention amounts will not exceed the largest applicable Retention amount.

The Retention for breach response services listed in the Declarations applies separately to each incident, event or related incidents or events, giving rise to legal, forensic and public relations/crisis management services and costs covered under parts 1., 2., 3. and 7. of the definition of breach response services. The Retention will be satisfied by monetary payments by the named insured for such services and costs.

Coverage for business interruption loss and dependent business loss will apply after the waiting period has elapsed and the Underwriters will then indemnify the named insured for all business interruption loss and dependent business loss sustained during the period of restoration in excess of the Retention.

Satisfaction of the applicable Retention is a condition precedent to the payment of any loss under this Policy, and the Underwriters will be liable only for the amounts in excess of such Retention.

Upon non-renewal or cancellation of this Policy for any reason except the non-payment of premium, the named insured will have the right to purchase, for additional premium in the amount of the Optional Extension Premium percentage listed in the Declarations of the full Policy Premium listed in the Declarations, an Optional Extension Period for the period of time listed in the Declarations. Coverage provided by such Optional Extension Period will only apply to claims first made against any insured during the Optional Extension Period and reported to the Underwriters during the Optional Extension Period, and arising out of any act, error or omission committed before the end of the policy period. In order for the named insured to invoke the Optional Extension Period option, the payment of the additional premium for the Optional Extension Period must be paid to the Underwriters within 60 days of the termination of this Policy.

The purchase of the Optional Extension Period will in no way increase the Policy Aggregate Limit of Liability or any sublimit of liability. At the commencement of the Optional Extension Period the entire premium will be deemed earned, and in the event the named insured terminates the Optional Extension Period for any reason prior to its natural expiration, the Underwriters will not be liable to return any premium paid for the Optional Extension Period.

All notices and premium payments with respect to the Optional Extension Period option will be directed to the Underwriters through entity listed for Administrative Notice in the Declarations.

General Conditions back to top

The insured must notify the Underwriters of any claim as soon as practicable, but in no event later than: (i) 60 days after the end of the policy period; or (ii) the end of the Optional Extension Period (if applicable). Notice must be provided through the contacts listed for notice of claim loss or circumstance in the Declarations.

With respect to breach response services, the insured must notify the Underwriters of any actual or reasonably suspected data breach or security breach as soon as practicable after discovery by the insured, but in no event later than 60 days after the end of the policy period. Notice must be provided to the breach response services Team listed in the Declarations. Notice of an actual or reasonably suspected data breach or security breach in conformance with this paragraph will also constitute notice of a circumstance that could reasonably be the basis for a claim.

With respect to cyber extortion loss, the named insured must notify the Underwriters via the email address listed in the Notice of claim, loss or Circumstance in the Declarations as soon as practicable after discovery of an extortion threat but no later than 60 days after the end of the policy period. The named insured must obtain the Underwriters’ consent prior to incurring cyber extortion loss.

With respect to data recovery costs, business interruption loss and dependent business loss the named insured must notify the Underwriters through the contacts for Notice of claim, loss or Circumstance in the Declarations as soon as practicable after discovery of the circumstance, incident or event giving rise to such loss. The named insured will provide the Underwriters a proof of data recovery costs, business interruption loss and dependent business loss, and this Policy will cover the reasonable and necessary costs, not to exceed USD 50,000, that the named insured incurs to contract with a third party to prepare such proof. All loss described in this paragraph must be reported, and all proofs of loss must be provided, to the Underwriters no later than 6 months after the end of the policy period.

The named insured must notify the Underwriters of any loss covered under the eCrime insuring agreement as soon as practicable, but in no event later than 60 days after the end of the policy period. Notice must be provided through the contacts listed for notice of claim loss or circumstance in the Declarations.

Any claim arising out of a loss that is covered under the Breach Response, First Party loss or eCrime insuring agreements and that is reported to the Underwriters in conformance with the foregoing will be considered to have been made during the policy period.

With respect to any circumstance that could reasonably be the basis for a claim (other than a data breach or security breach noticed under the Breach Response insuring agreement) the insured may give written notice of such circumstance to the Underwriters through the contacts listed for Notice of claim, loss or Circumstance in the Declarations as soon as practicable during the policy period. Such notice must include:

  1. the specific details of the act, error, omission or event that could reasonably be the basis for a claim;
  2. the injury or damage which may result or has resulted from the circumstance; and
  3. the facts by which the insured first became aware of the act, error, omission or event.

Any subsequent claim made against the insured arising out of any circumstance reported to Underwriters in conformance with the foregoing will be considered to have been made at the time written notice complying with the above requirements was first given to the Underwriters during the policy period.

Except with respect to coverage under the Payment Card Liabilities & Costs insuring agreement, the Underwriters have the right and duty to defend any covered claim or regulatory proceeding. Defense counsel will be mutually agreed by the named insured and the Underwriters but, in the absence of such agreement, the Underwriters’ decision will be final.

With respect to the Payment Card Liabilities & Costs insuring agreement, coverage will be provided on an indemnity basis and legal counsel will be mutually agreed by the named insured and the Underwriters and will be selected from one of the firms listed in the Information Packet.

The Underwriters will pay actual loss of salary and reasonable expenses resulting from the attendance by a corporate officer of the insured organization at any mediation meetings, arbitration proceedings, hearings, depositions, or trials relating to the defense of any claim, subject to a maximum of $2,000 per day and $100,000 in the aggregate, which amounts will be part of and not in addition to the policy aggregate limit of liability.

If the insured refuses to consent to any settlement recommended by the Underwriters and acceptable to the claimant, the Underwriters’ liability for such claim will not exceed:

  1. the amount for which the claim could have been settled, less the remaining Retention, plus the claims expenses incurred up to the time of such refusal; plus
  2. sixty percent (60%) of any claims expenses incurred after the date such settlement or compromise was recommended to the insured plus sixty percent (60%) of any damages, penalties, PCI fines and expenses and costs above the amount for which the claim could have been settled;

    and the Underwriters will have the right to withdraw from the further defense of such claim.

The insured may settle any claim where the damages, penalties, PCI fines and expenses and costs and claims expenses do not exceed the Retention, provided that the entire claim is resolved and the insured obtains a full release on behalf of all insureds from all claimants.

The Underwriters will have the right to make any investigation they deem necessary, and the insured will cooperate with the Underwriters in all investigations, including investigations regarding coverage under this Policy and the information and materials provided to the underwriters in connection with the underwriting and issuance of this Policy. The insured will execute or cause to be executed all papers and render all assistance as is requested by the Underwriters. The insured agrees not to take any action which in any way increases the Underwriters’ exposure under this Policy. Expenses incurred by the insured in assisting and cooperating with the Underwriters do not constitute claims expenses under the Policy.

The insured will not admit liability, make any payment, assume any obligations, incur any expense, enter into any settlement, stipulate to any judgment or award or dispose of any claim without the written consent of the Underwriters, except as specifically provided in the Settlement of claims clause above. Compliance with a breach notice law will not be considered an admission of liability.

If any payment is made under this Policy and there is available to the Underwriters any of the insured’s rights of recovery against any other party, then the Underwriters will maintain all such rights of recovery. The insured will do whatever is reasonably necessary to secure such rights and will not do anything after an incident or event giving rise to a claim or loss to prejudice such rights. If the insured has waived its right to subrogate against a third party through written agreement made before an incident or event giving rise to a claim or loss has occurred, then the Underwriters waive their rights to subrogation against such third party. Any recoveries will be applied first to subrogation expenses, second to loss paid by the Underwriters, and lastly to the Retention. Any additional amounts recovered will be paid to the named insured.

The insurance under this Policy will apply in excess of any other valid and collectible insurance available to any insured unless such other insurance is written only as specific excess insurance over this Policy.

No action will lie against the Underwriters or the Underwriters’ representatives unless and until, as a condition precedent thereto, the insured has fully complied with all provisions, terms and conditions of this Policy and the amount of the insured’s obligation to pay has been finally determined either by judgment or award against the insured after trial, regulatory proceeding, arbitration or by written agreement of the insured, the claimant, and the Underwriters.

No person or organization will have the right under this Policy to join the Underwriters as a party to an action or other proceeding against the insured to determine the insured’s liability, nor will the Underwriters be impleaded by the insured or the insured’s legal representative.

The insured’s bankruptcy or insolvency of the insured’s estate will not relieve the Underwriters of their obligations hereunder.

If there is a change of law, regulation or enforcement that prevents the Underwriters or its providers from providing all or part of the breach response services, or if a provider is unable to or does not provide breach response services, the Underwriters will make reasonable efforts to procure similar services from other sources. In such event, the maximum the Underwriters will pay for the costs of procuring and providing all breach response services, including substitute products and services, will be no more than USD 10,000,000 in the aggregate for the policy period, which amount will be in addition to the policy aggregate limit of liability. If it is not reasonably possible for the Underwriters to procure substitute products or services, the Underwriters will not be obligated to provide such services.

By acceptance of the Policy, all insureds agree that this Policy embodies all agreements between the Underwriters and the insured relating to this Policy. Notice to any agent, or knowledge possessed by any agent or by any other person, will not effect a waiver or a change in any part of this Policy or stop the Underwriters from asserting any right under the terms of this Policy; nor will the terms of this Policy be waived or changed, except by endorsement issued to form a part of this Policy signed by the Underwriters.

If during the policy period the named insured consolidates or merges with or is acquired by another entity, or sells more than 50% of its assets to another entity, then this Policy will continue to remain in effect through the end of the policy period, but only with respect to events, acts or incidents that occur prior to such consolidation, merger or acquisition. There will be no coverage provided by this Policy for any other claim or loss unless the named insured provides written notice to the Underwriters prior to such consolidation, merger or acquisition, the named insured has agreed to any additional premium and terms of coverage required by the Underwriters and the Underwriters have issued an endorsement extending coverage under this Policy.

The interest hereunder of any insured is not assignable. If the insured dies or is adjudged incompetent, such insurance will cover the insured’s legal representative as if such representative were the insured, in accordance with the terms and conditions of this Policy.

This Policy may be canceled by the named insured by giving written notice to the Underwriters through the entity listed for Administrative Notice in the Declarations stating when the cancellation will be effective.

This Policy may be canceled by the Underwriters by mailing to the named insured at the address listed in the Declarations written notice stating when such cancellation will be effective. Such date of cancellation will not be less than 60 days (or 10 days for cancellation due to non-payment of premium) after the date of notice.

If this Policy is canceled in accordance with the paragraphs above, the earned premium will be computed pro rata; but the premium will be deemed fully earned if any claim, or any circumstance that could reasonably be the basis for a claim or loss, is reported to the Underwriters on or before the date of cancellation. Payment or tender of unearned premium is not a condition of cancellation.

Whenever the singular form of a word is used herein, the same will include the plural when required by context.

The titles of paragraphs, clauses, provisions or endorsements of or to this Policy are intended solely for convenience and reference, and are not deemed in any way to limit or expand the provisions to which they relate and are not part of the Policy.

All insureds agree that the statements contained the information and materials provided to the Underwriters in connection with the underwriting and issuance of this Policy are true, accurate and are not misleading, and that the Underwriters issued this Policy, and assume the risks hereunder, in reliance upon the truth thereof.

The named insured will be considered the agent of all insureds, and will act on behalf of all insureds with respect to the giving of or receipt of all notices pertaining to this Policy, and the acceptance of any endorsements to this Policy. The named insured is responsible for the payment of all premiums and Retentions and for receiving any return premiums.