FCA authorised · FRN 724952 0117 325 0027Quote & buy →
IT infrastructure
Yes: if you run a data centre, sell colocation or hosting, or process data for clients as a bureau, you need professional indemnity insurance. Clients build their own services on yours, so an outage, a failed restore or a processing error becomes their lost revenue and a claim against you. Public liability and property insurance deal with physical damage; PI usually deals with the financial loss that follows a service failure. Cyber insurance then covers your own costs if an attack takes you offline.
Part of: Professional indemnity for IT professionals
In short
Data centres were designated Critical National Infrastructure in September 2024, and the Cyber Security and Resilience Bill, still before Parliament, would bring larger data centres into the network and information systems regime. For insurance, the key question is what you control. Colocation supplies space, power, cooling and connectivity; managed hosting and processing bureaux also run systems or data for the client, so more of the client’s loss can be traced back to you. Read the SLA, the service credit regime and the liability cap together, and check how your PI and cyber policies treat outages caused by power or utility failures.
Last reviewed 5 October 2026 by the Apex professional indemnity team.
Your clients build their own services on top of yours. A retailer’s checkout, a payroll bureau’s monthly run and a software company’s platform may all depend on power, cooling, connectivity and operations you provide. When your service fails, the damage is mostly financial: lost sales, missed deadlines, penalties under the client’s own contracts and the cost of moving elsewhere.
Public liability and property insurance deal with physical events. If a leaking chiller damages a tenant’s servers, the damage to that equipment is a physical loss. The outage that follows, and the client’s claim that your maintenance, configuration or operational decisions caused it, is a different kind of claim. It alleges a failure of professional service, and that is what professional indemnity (PI) insurance, sometimes called technology errors and omissions cover, is written for.
Data processing bureaux face the same split. A bureau that runs payment files, mail merges or batch jobs causes loss through a wrong file or a wrong date, not through damage to anything. Only PI is designed to answer that allegation.
What your clients can claim against you depends on how much of their stack you run. The three common models carry very different exposures.
| Service model | What you control | Typical allegation | Where it usually lands |
|---|---|---|---|
| Colocation | Space, power, cooling, physical security and connectivity. The client owns and runs its own servers. | Power or cooling failed; a remote hands engineer pulled the wrong cable or rebooted the wrong server. | PI for the outage and operational errors; public liability or property cover for physical damage to client equipment. |
| Managed hosting or private cloud | The hardware, often the operating system, patching, monitoring and backups. | Backups were not taken or would not restore; a misconfiguration exposed data or caused downtime. | PI for the client’s losses; cyber for your own breach and recovery costs. |
| Processing bureau | Batch processing on the client’s behalf: payment files, payroll runs, print and post, data matching. | A file was sent twice, late or with the wrong data, and customers were affected. | PI, with data protection claims where the policy includes them. |
The model also decides your data protection role. The ICO’s guidance gives two useful markers. An IT services firm that stores archived data for a bank is a processor, even though it uses its own technical judgement about how to store it. A delivery service that carries sealed envelopes without being able to open them does not process the personal data inside. Pure colocation can sit between those examples, so set out your role in the contract rather than leaving it to be argued after an incident.
The scenarios below are illustrative only. They are not real claims, but they reflect the allegations data centre and bureau operators face.
Your liability is shaped mainly by contract, but the regulatory picture for data centres is changing and clients follow it closely.
| Rule, standard or scheme | What it says | Why it matters to your PI |
|---|---|---|
| Critical National Infrastructure designation | The government announced on 12 September 2024 that data centres would be designated Critical National Infrastructure, bringing greater government support in anticipating and recovering from critical incidents, including prioritised access to the NCSC. | Clients and their insurers treat your resilience as a national issue, and expect it to show in your contracts. |
| Cyber Security and Resilience (Network and Information Systems) Bill | The government’s factsheet says data centres with a rated IT load of 1MW or more, or 10MW for enterprise data centres, would come into scope, with Ofcom as regulator, a duty to manage risks and a duty to report significant incidents. The Bill is still before Parliament. | New duties are likely to change contract terms and insurer questions. Watch for the final text. |
| UK GDPR, Article 28 | Where you process personal data for a client, the contract must cover documented instructions, security, sub-processors, deletion or return at the end and audits. | Managed hosting and bureau contracts carry these terms; breaching them can be both a contract and a data protection claim. |
| BS EN 50600-1:2019 | General concepts for data centre facilities and infrastructures, with a classification system based on availability, security and energy efficiency. | If you sell a facility as built to a given class, that statement can be tested after an outage. |
| ISO/IEC 27001:2022 | Requirements for an information security management system, which organisations can certify against. | Commonly requested in tenders; a lapse in certification can be a breach of contract. |
| Bacs Approved Bureau Scheme | Approved bureaux submit Bacs and Faster Payments transactions for other organisations, and Pay.UK reviews them against its standards, including periodic inspections. | Bureau clients rely on your approval and controls when a payment run goes wrong. |
| Usually covered by PI | Often excluded or limited | Needs a different policy |
|---|---|---|
| Client losses from an outage caused by your negligent maintenance, configuration or operations | Outages caused by failure of external power, telecoms or other utility networks | Physical damage to client servers in your halls (public liability or customer equipment cover) |
| Remote hands and managed service errors | Service credits and other SLA rebates | Damage to your building, plant and generators (property and engineering insurance) |
| Backups and restores you were contracted to provide but did not deliver | Availability guarantees that go beyond reasonable skill and care | Your own lost income after a fire, flood or plant failure (business interruption) |
| Bureau processing errors: duplicated, late or incorrect files | Liability you accept above your standard cap | A cyber attack on your own network and systems (cyber insurance) |
| Defence costs, including expert reports on root cause | Many tenants affected by one event, which may be treated as a single claim | Injury to staff or visitors (employers’ and public liability) |
Wordings vary widely in how they treat infrastructure and utility failures, and everything is subject to the policy terms. The difference between a grid failure and your generator failing to start can decide whether a claim is covered, so ask how your policy draws that line.
Availability commitments are where data centre contracts and PI policies meet. Three clauses deserve attention before you sign.
Remember the chain behind you. Your tenant may have promised its own customers more than you promised it, and it will try to pass those losses up to you. Consistent caps and exclusions through the chain protect both your balance sheet and your PI record.
For a data centre, PI and cyber insurance answer different questions about the same incident. PI asks what you owe your clients. Cyber asks what the incident cost you.
If ransomware or a denial-of-service attack takes your network down, cyber insurance usually pays for incident response, forensic investigation, restoring your systems, extortion demands where lawful and insurable, and your own loss of income. The tenants’ claims that you failed to protect the service are a liability question: they may fall under PI or under the liability section of a cyber policy, depending on the wordings. Make sure they cannot fall between the two.
Watch for non-malicious outages. Some cyber policies offer system failure cover for your own losses when systems go down without an attack; many PI and cyber wordings exclude failures of external utility infrastructure. Our guide to cyber insurance explained sets out the sections, and if you also sell cloud services, see insurance for cloud service providers.
Limits are driven by your largest tenants and your contract structure. Enterprise and public sector clients usually specify a minimum PI figure, but in a multi-tenant facility the real test is what one event could cost across everyone it affects.
A complete proposal gets better terms than a bare one, and a broker can only present what you tell us. Have these ready:
Speak to a broker
PI for data centre and data processing providers, placed by a named broker
Start the online proposal and save it as you go, or leave your number and a named broker will call you back, usually the same working day.
Apex Insurance Brokers is an independent insurance broker based in Bristol, established in 2009 and authorised and regulated by the Financial Conduct Authority. We are not tied to one insurer: we work with over 30 markets, including Lloyd’s syndicates through wholesale brokers, and every client has a named broker who handles the placement, mid-term changes, certificates for clients and the renewal.
Yes. Clients rely on your power, cooling, connectivity or processing to run their own businesses, and an outage or processing error causes them financial loss. Public liability and property insurance deal with physical damage. PI responds when a client alleges your service, advice or operations were negligent, subject to the policy terms.
No law requires data centre operators to hold PI. Critical National Infrastructure status brings government support rather than an insurance duty, and the Cyber Security and Resilience Bill’s duties, as the government describes them, concern security and incident reporting. In practice enterprise and public sector clients set PI requirements in their contracts.
It depends on the cause and the wording. Many policies exclude failures of external power or other utility networks. If the outage happened because your UPS, generator or switchgear was not properly maintained or operated, the client’s claim may fall within PI, subject to the policy terms. Ask your broker how your wording draws that line.
Usually not. Physical damage to a client’s equipment, from a leak, fire or overheating, is generally a matter for public liability or specific customer equipment cover. PI usually deals with the financial loss caused by negligent services, such as the outage that follows. Check how both policies treat property in your care.
Not necessarily. The ICO treats an IT firm storing archived data for a bank as a processor, but says a delivery service carrying sealed envelopes it cannot open does not process the personal data inside. Where colocation sits depends on your access to client data, so define your role in the contract.
Often it does. Many PI policies group claims arising from the same originating cause and apply a single limit to them, and an aggregate limit is shared across the policy year. Model what a site-wide failure would cost across your largest tenants and set your limit and aggregation terms with that in mind.
Apex arranges professional indemnity insurance for data centre and data processing providers across the UK. Tell us about your work and we’ll find cover that fits. Or call 0117 325 0027.
Start your PI proposal Call 0117 325 0027Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances. Cover is always subject to the insurer’s acceptance and the policy terms, and this page does not guarantee that cover will be available or on what terms.
