California Cyber Liability Insurance

California does not require businesses to purchase cyber insurance. It does impose duties that cost money when an incident occurs, including breach notification obligations and, under the CCPA and CPRA, a private right of action for California residents following certain breaches of unencrypted personal information. Cyber insurance is how most small businesses fund those obligations, because a general liability policy will not respond to them.

The California Consumer Privacy Act, as expanded by the CPRA, gives California residents rights over the personal information businesses collect about them, including rights to know, delete, and opt out of sale. It generally applies to for-profit businesses handling California residents’ data that meet at least one threshold, such as annual revenue above $25 million, handling the personal information of 100,000 or more consumers or households, or deriving half or more of revenue from selling personal information. Even businesses below the thresholds face breach notification duties under California law.

No. General liability responds to bodily injury and physical property damage. Data breach, ransomware, and privacy claims are excluded from virtually every general liability policy sold today. That exclusion is the reason cyber liability exists as a separate line. If a contract or lender requires proof of cyber coverage, a general liability certificate will not satisfy it.

Most small California businesses pay between $500 and $2,000 per year for a $1 million cyber liability limit. Pricing depends on revenue, industry, the volume and sensitivity of the data you hold, and the security controls you have in place. Businesses with multifactor authentication, offline backups, and documented wire verification procedures generally receive better terms, because those controls directly reduce the two most common losses.

A typical policy funds the response: forensic investigators to determine what happened, legal counsel to determine notification duties under California law, notification letters to affected residents, credit monitoring, and defense against resulting claims. It can also cover ransom payments, lost income while systems are down, and funds lost to social engineering fraud where that coverage is included. Specific coverage depends on policy wording.