FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Mid-market insurance
A data protection super-cap is a separate, higher liability cap in an IT contract for data protection breaches, sitting outside the general cap. It often becomes the largest figure your tech PI and cyber must answer.
Part of: IT and technology business insurance
In short
Enterprise and public sector clients commonly take data protection liability out of the general cap and give it a higher super-cap, or leave it uncapped. UK GDPR already makes processors liable to individuals in some circumstances, but a contract can add much more: indemnities, recovery of the client's own costs and regulatory exposure. Tech PI and cyber may respond to some of this, subject to their contractual liability exclusions and fines wording. The practical aim is to keep any super-cap within your insurance limits and to avoid indemnities your policies will not follow.
A super-cap is not automatically insured. Tech PI and cyber policies usually cover liability you would have had in law anyway, and commonly exclude liability you take on only because the contract says so, unless the policy says otherwise. A broad data protection indemnity with a £10m super-cap can therefore leave part of the exposure uninsured, even if your limit is £10m. The task is to make the contract, the limit and the wording line up. For the wider data picture see GDPR, data protection and insurance for technology companies.
Super-caps usually appear in the limitation of liability clause of the master services agreement, with the data processing agreement setting out the obligations. Government buyers use them too: Mid-Tier Contract guidance sets the supplier's data protection liability in the award form and suggests a range of £10m to £20m, noting that unlimited liability is not permitted for it and that regulator fines against the supplier sit outside the cap.
| Source of liability | What it says | Insurance point |
|---|---|---|
| UK GDPR Article 82(2) | A processor is liable for damage only where it has not complied with processor obligations or has acted outside or contrary to the controller's lawful instructions | Liability in law, which tech PI and cyber commonly cover subject to terms |
| Article 82(4) and (5) | Where several parties are responsible, each can be held liable for the entire damage, with a right to claim back the other parties' share | You may pay the full claim first and recover later |
| UK GDPR Article 28(4) | A processor remains fully liable to the controller for a sub-processor's failure to meet its data protection obligations | Check your contracts with hosting and platform providers |
| Contract indemnity | Supplier indemnifies the client for all losses arising from data protection breaches, often including the client's own costs | May go beyond liability in law; check the contractual liability exclusion |
| Fines | The Information Commission (formerly the ICO) can fine controllers and processors | Fines are often uninsurable or excluded; contractual pass-through of a client's fine is a separate question |
Where tech PI and cyber are on separate policies, a data breach claim from a client can sit between them. A combined technology policy or clear other-insurance wording can reduce that risk.
These are illustrative only; whether cover applies depends on the policy terms and the facts.
The MSA has a general cap of 12 months' fees and a £15m data protection super-cap with a full indemnity. The supplier holds £10m tech PI and cyber combined. A breach exposes customer data. The bank claims its notification, remediation and customer compensation costs. Some of that would be recoverable in law; some arises only under the indemnity. Part of the claim may be uninsured, and £5m of the super-cap sits above the limit.
An MSP's backup provider is breached and client data leaks. Under Article 28(4) the MSP remains liable to its client for the sub-processor's failure. The MSP's recovery against the backup provider depends on that contract's cap, which is far lower. See MSP liability when a client is breached.
In WM Morrison Supermarkets plc v Various Claimants [2020] UKSC 12 the Supreme Court held that the employer was not vicariously liable for an employee's deliberate leak of payroll data. The principle is fact-specific and does not limit what a contract indemnity can make you pay.
For the wider programme see insurance for mid-sized IT companies. Apex arranges tech PI and cyber for IT companies and reads contract clauses against wordings; a broker reads every enquiry.
Partly, in many cases. Tech PI usually covers liability for negligent services, including data protection failures, but commonly excludes liability assumed only under contract. Losses within the super-cap that you would owe in law anyway may be covered; extra losses that exist only because of an indemnity may not be, subject to the policy terms.
Yes. Under UK GDPR Article 82, a processor is liable for damage caused by processing where it has not complied with obligations directed specifically to processors or has acted outside or contrary to the controller's lawful instructions. Where several parties are responsible, each can be held liable for the entire damage, with a right to recover the others' share.
Uncapped liability cannot be matched by any insurance limit, so it leaves the business exposed above whatever cover you buy. Many suppliers negotiate a super-cap instead. UK government Mid-Tier Contract guidance does not permit unlimited data protection liability and suggests a cap in the range of £10m to £20m.
Often not. Fines are commonly uninsurable or excluded, and policies that mention them usually cover them only where insurable by law. Regulatory defence costs are more commonly covered under cyber. A contract term making you repay a client's fine raises separate questions, so ask your broker to check the wording.
A super-cap sets the maximum you can be liable for under a head of loss. An indemnity creates or widens the liability itself, often covering losses you would not owe in law. Both matter for insurance: the cap should fit within your limit, and the indemnity should not go beyond what your policies cover.
Send us your current schedules or renewal pack and we will review the whole programme and tell you plainly what to keep and what to change. No fee and no obligation. Or call 0117 325 0027.
Book a programme review Get a quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
