What is cyber insurance? An Australian small business guide

What is cyber insurance? Cyber insurance is designed to cover costs after a data breach or cyber attack. First-party costs may include incident response, forensics, notifying affected people and data recovery.

Third party cover may respond to claims from customers or regulators. Cyber cover is subject to the policy terms, conditions and exclusions.

Cover depends on the policy and insurer you choose. Check the policy wording and its terms and conditions for what is and isn't included.

Cyber insurance for small business owners sits alongside cyber security controls rather than replacing them.

Key takeaways

• Cyber insurance may include incident response, data recovery and business interruption costs, and may respond to claims from customers, subject to the policy terms.
• Cyber policies commonly exclude some losses, as set out in the policy wording.
• As at the time of writing (October 2026), the Notifiable Data Breaches scheme and ransomware payment reporting under the Cyber Security Act 2024 may apply to some businesses.
• upcover has separate guides on cyber insurance cost, limits, insurer checks and claims.

What is cyber insurance and how does it work in Australia?

A cyber policy may include first-party cover for your own costs after an incident and third party cover for claims against you.

First-party cover may relate to costs such as investigating an incident, restoring systems and notifying affected customers. Third party cover may be relevant where customers whose data was exposed allege that your business caused them loss.

A customer claim that an error in your software or services caused it financial loss may raise other cover questions, which upcover's comparison guide explains.

What does cyber insurance cover?

A cyber policy may include cover options for data breaches, cyber extortion, business interruption, funds transfer fraud and claims from others, subject to its terms.

upcover's cyber insurance page describes cover options including:

• Customer data breach: forensic, legal and notification costs when customer data is exposed, which may include credit monitoring and identity restoration
• Cyber extortion and ransomware: expert response, negotiation support and ransom payments where legally permitted
• Business interruption: lost income or extra costs if systems are forced offline
• Phishing and funds transfer fraud: loss of money when scammers trick you into transferring funds
• Malicious insider incidents: losses and response costs where an employee or contractor intentionally causes a data breach

What do cyber insurance claims look like?

Claims examples on the same page include a ransomware attack and a website taken offline by a denial of service attack.

Important: These claims examples are examples only. Cover is subject to policy terms, conditions and exclusions. Policy wordings vary between insurers. Always refer to the policy wording and its terms and conditions for details. If you have questions about a particular possible claim or would like assistance about whether a certain claim might be covered it is always best to speak to an upcover team member or your insurance broker.

If you're concerned about a particular customer service or experience, you can always consider telling your insurer as soon as you become aware of an incident, complaint or circumstance that could lead to a claim. Importantly, this doesn't impact your premiums or cost of insurance until a claim arises, and it means that any future claim is triggered from the original date you notified the insurer, so it helps spread the risk of claims across policy periods too.

You don't need to wait for a formal demand. Also keep in mind that notifying of a claim late may affect your claim.

You can start a claim through the make a claim page. Admitting liability, incurring costs or agreeing to a settlement before you notify your insurer may affect your claim. Starting a claim does not confirm that your claim is covered; your insurer assesses it under the policy terms, conditions, exclusions and limits.

upcover's cyber claims guide explains the steps after an incident, from containing a breach to the insurer's assessment.

What does cyber insurance not cover?

Cyber policies commonly exclude some losses, and a policy may also set sub-limits and conditions that affect a claim.

Exclusions commonly include, but are not limited to:

• Intellectual property claims, such as patent or trade secret disputes, although an exception may apply to some software copyright claims
• Incidents a senior executive knew about, or could reasonably foresee, before cover started
• Outages at third party utilities or telecoms providers, unless the provider's own security failure directly caused them

Important: This list is not exhaustive. Exclusions vary between insurers. Always refer to the policy wording and its terms and conditions for the exclusions that apply to you, and if you have questions you should speak to your insurance broker or the upcover team.

A sub-limit is "a maximum amount the insurance company will pay for a specific type of loss, which is within the overall policy limit".

upcover's guide to why cyber claims get denied lists reasons such as inaccurate application answers, lapsed security controls and late notification.

Which upcover cyber guide answers your next question?

Each upcover cyber guide takes one question in more depth, from whether to arrange cover to what happens after a claim.

Cyber insurance is not a general legal requirement in Australia (why cyber cover matters). Our guides cover whether a business may need cyber insurance and what insurers may check.

What cyber security controls do insurers check?

Insurers may ask about your security controls before offering or renewing cyber cover.

upcover's cyber insurance requirements guide says underwriters commonly ask about controls such as multi-factor authentication, tested backups, patching, endpoint protection and security awareness training.

A customer may also ask for a System and Organization Controls 2 (SOC 2) report, which upcover's SOC 2 guide compares with cyber insurance.

What Australian data breach rules apply in 2026?

As at the time of writing (October 2026), the Notifiable Data Breaches (NDB) scheme and ransomware payment reporting may apply after a cyber incident.

The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in 2025, an 8% increase over 2024.

Holding cyber cover does not replace these obligations. A cyber insurance policy may help with some forensic, notification and legal response costs after a breach, subject to the policy terms.

Which businesses must notify a data breach?

Organisations the Privacy Act covers must notify affected individuals and the OAIC when a data breach is likely to result in serious harm.

The OAIC says "A small business is one with an annual turnover of $3 million or less". Most small businesses fall outside the Privacy Act, but health service providers and businesses trading in personal information are among the exceptions.

The OAIC's quick reference guide says notice of an eligible data breach is due "as soon as practicable". The Privacy Act 1988 also sets civil penalties for a serious interference with privacy and for other interferences with privacy (sections 13G and 13H).

Do ransomware payments have to be reported?

Some businesses must report ransomware or cyber extortion payments within 72 hours, under rules that started on 30 May 2025.

The obligation applies to entities carrying on a business in Australia with a previous financial year turnover above $3 million, and some critical infrastructure entities.

Section 27 of the Cyber Security Act 2024 runs the 72 hours from making the payment or becoming aware it was made. Reports go to the Australian Signals Directorate through its online reporting form.

How upcover can help

upcover arranges cyber insurance for small business owners. upcover works with 80+ insurance partners and can arrange quotes from a range of insurers.

• 70,000+ businesses covered across Australia
• 4.9/5 customer rating
• 80+ insurance partners

Get a cyber insurance quote.

Frequently asked questions

What affects the cost of cyber insurance?

The cost may depend on factors including your turnover, data exposure, security controls and the cover you select (cost guide).

What do businesses weigh when choosing a cyber insurance limit?

How much cover to consider may depend on your contracts, data, revenue, downtime exposure and the cost of recovering from a serious event (limits guide). An upcover team member or an insurance broker can talk through what different limits may mean for your business.

What does cyber insurance cover for scam payments and invoice fraud?

How a cyber policy treats business email compromise (BEC) depends on its wording. upcover's BEC guide says "Some policies cover BEC under a cybercrime section; others require a separate social engineering endorsement, and some apply lower sublimits or payment verification conditions that must be met before a claim is accepted".

What is cyber insurance excess?

upcover's glossary defines the excess as "The first amount an insured must pay towards a claim before the insurer pays". How the excess applies varies between policy wordings, so always check with your insurance broker or the team at upcover.

How can a small business compare cyber insurance policies?

Comparing cyber policies on their cover sections, sub-limits, excess and security conditions, as well as price, shows where the wordings differ.

‍

_{Written by upcover's editorial team.}

_{This article provides general information only and does not take into account your objectives, financial situation or needs. It is not legal advice: get legal advice about how the Notifiable Data Breaches scheme and ransomware payment reporting apply to your business. Laws and guidance described are as at the time of writing (October 2026) and may change. Insurance availability and cover are subject to underwriting and the terms, conditions, limits and exclusions of the relevant policy. Read the policy wording and its terms and conditions before deciding. upcover arranges insurance products with selected insurers and underwriters and does not compare all general insurers or insurance products available in the market.}

_{Official guidance referred to in this article:}

1. _{OAIC: Notifiable Data Breaches scheme - https://www.oaic.gov.au/privacy/notifiable-data-breaches/about-the-notifiable-data-breaches-scheme}
2. _{Federal Register of Legislation: Cyber Security Act 2024 - https://www.legislation.gov.au/C2024A00098/latest/text}
3. _{OAIC: Data breach notifications in 2025 - https://www.oaic.gov.au/news/media-centre/data-breach-notifications-increase-to-all-time-high-in-2025,-new-ndb-stats-show}
4. _{OAIC: Small business privacy guidance - https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business}
5. _{OAIC: Quick reference guide for responding to data breaches - https://www.oaic.gov.au/privacy/notifiable-data-breaches/quick-reference-guide-for-responding-to-data-breaches}
6. _{Federal Register of Legislation: Privacy Act 1988 - https://www.legislation.gov.au/C2004A03712/latest/text}
7. _{Department of Home Affairs: Ransomware payment reporting factsheet - https://www.homeaffairs.gov.au/cyber-security-subsite/files/factsheet-ransomware-payment-reporting.pdf}
8. _{Australian Signals Directorate: Ransomware and cyber extortion payment reporting - https://www.cyber.gov.au/report-and-recover/report/ransomware-payment-and-cyber-extortion-payment-reporting}