FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Insurance explained
Insurance for businesses that handle customer data and payments is a combination of cyber, professional indemnity, liability and crime cover designed around data and card risks. It matters because one breach can trigger regulatory, contractual and customer losses that sit in different policies.
Part of: Commercial insurance
In short
A UK business that holds customer data and takes online payments usually needs more than one policy. Cyber insurance commonly covers breach response, system outages and data liability claims. PI or technology errors and omissions cover responds when a platform or service fails a customer. Product and public liability cover physical injury and damage, while crime cover deals with payment fraud against the business. PCI DSS is a contractual standard, not law, and card scheme costs are often sub-limited. Chargebacks are usually not insured. The UK GDPR requires appropriate security, and notifiable breaches must be reported to the Information Commission (formerly the ICO) without undue delay and, where feasible, within 72 hours.
There is no single policy called "data and payments insurance". Instead, a business that collects personal data and takes card payments online usually needs several covers that fit together: cyber insurance for breaches and system outages, professional indemnity or technology errors and omissions cover if it provides a service or platform to others, public and product liability for physical injury and damage, and sometimes crime cover for fraud against the business itself.
The reason is that a single incident can create several kinds of loss at once. A compromised checkout page might expose card details, trigger a personal data breach under the UK GDPR, take the website offline, prompt claims from customers and lead to costs under the merchant's card acquiring agreement. Each of those losses tends to sit in a different part of an insurance programme, and the gaps between policies are where uninsured losses usually arise.
Two sets of rules shape the risk. The first is data protection law. Under the UK GDPR, a controller must keep personal data secure, and the ICO's guide to data security explains that Article 32 requires "appropriate technical and organisational measures" proportionate to the risk. A notifiable personal data breach must be reported to the Information Commission, which took over from the ICO on 30 September 2026, without undue delay and not later than 72 hours after becoming aware of it, according to the ICO's guide to personal data breaches. The second is the card industry's own standard, PCI DSS, which is contractual rather than statutory and is explained further below.
The table below is a general guide. Every policy is different, and cover is always subject to the policy terms, limits, excesses and exclusions.
| Risk | Policy that commonly responds | Common limits or gaps |
|---|---|---|
| Breach response: forensics, legal advice, notifying customers | Cyber (first party) | Usually requires use of the insurer's panel or prior consent |
| Website or booking system down after an attack | Cyber business interruption | Waiting periods apply; outages at a third-party provider may need a specific extension |
| Customer claims after a data breach | Cyber (third party liability) | Subject to the policy terms and the insured's legal liability |
| Card scheme assessments and PCI costs | Some cyber policies, often under a sub-limit | Frequently sub-limited or excluded; check the wording |
| Your platform fails and a business customer loses money | PI or technology errors and omissions | Contractual liabilities beyond the law are often excluded |
| A product sold injures someone | Product and public liability | Cyber and PI policies usually exclude bodily injury |
| Staff tricked into paying a fake supplier invoice | Crime or social engineering cover | Often a separate sub-limit; verification conditions apply |
| Chargebacks and customer payment disputes | Usually not insured | Treated as an ordinary trading risk |
| Information Commission (formerly ICO) fines | Rarely, and only where lawfully insurable | Insurability of regulatory fines in the UK is uncertain |
The question of fines is covered in more depth in GDPR fines vs civil claims: what is insurable, and the split between your own losses and claims by others is explained in first party versus third party cyber cover. Where payment fraud is the main worry, wire fraud, social engineering and crime cover sets out how cyber and commercial crime insurance divide the risk.
PCI DSS is the Payment Card Industry Data Security Standard. The PCI Security Standards Council describes it as a baseline of technical and operational requirements designed to protect payment account data, and says it applies to entities that store, process or transmit cardholder data, including merchants and service providers. The Council does not itself decide who must comply; that sits with payment brands and acquirers, which is why the obligation reaches a merchant through its acquiring or payment services agreement.
Outsourcing card payments to a hosted payment page reduces the scope but does not remove the duty. The Council's FAQ on outsourced payments says merchants still need to confirm their provider is compliant, keep written agreements setting out each party's responsibilities and validate their own compliance, often through a self-assessment questionnaire.
PCI DSS also matters to data protection. The ICO's security guidance notes that if you process card data you must comply with PCI DSS, and that after a breach involving card data the ICO will consider how far you had put in place the measures PCI DSS requires. If a card data breach leads to contractual assessments or costs under a merchant agreement, whether any of that is insured depends heavily on the cyber wording, and cover is commonly sub-limited. Our guide to cyber for retailers, PCI DSS and e-commerce looks at this in more detail.
The examples below are illustrative only and are not real claims.
Under Article 82 of the UK GDPR, any person who has suffered material or non-material damage as a result of an infringement has a right to compensation from the controller or processor. A processor is liable only where it has not complied with processor obligations or has acted outside the controller's lawful instructions. That distinction matters when a platform provider and its merchant customers argue about who caused a breach.
Many businesses assume one policy covers everything digital. In practice, cyber insurance is built around security incidents and their consequences, PI and tech E&O are built around failures in the service you provide, and crime cover is built around theft of your own money. A payment platform outage caused by a coding error is usually a PI matter; the same outage caused by ransomware is usually a cyber matter; a fraudster persuading your accounts team to change bank details is usually a crime or social engineering matter.
The overlaps can help as well as hurt. Some insurers offer combined technology policies that write PI and cyber together, which can reduce arguments about which policy should pay. Others keep them separate with different limits and insurers. Either approach can work, but the boundaries should be checked so that an incident does not fall between two wordings. Our commercial cyber insurance broker guide sets out the main sections of a cyber policy, and what to do after a cyber breach explains the first steps after an incident.
Apex arranges cyber, PI, liability and crime cover for UK businesses that handle customer data and payments; a broker reads every enquiry.
Usually yes, for the breach response and many liability claims, subject to the policy terms. Costs that arise under a merchant or acquiring agreement, such as card scheme assessments or PCI forensic investigations, are often covered only under a sub-limit, and some policies exclude them. The wording needs checking against your payment set-up.
No. PCI DSS is an industry standard managed by the PCI Security Standards Council, and the duty to comply usually comes through your contract with your acquirer or payment provider. The ICO has said it will consider how far PCI DSS measures were in place when it looks at a breach involving card data.
Usually not. Chargebacks and payment disputes are normally treated as an ordinary trading risk rather than an insured loss. Some crime or cyber policies may respond where a chargeback follows a covered fraud or security incident, but that depends entirely on the wording and should not be assumed.
Often yes. A hosted payment page reduces the card data that touches your systems, but you still hold customer names, addresses, emails and account logins, and your website can still be attacked or taken offline. Cyber cover commonly responds to those wider data and outage risks.
Rarely. Many cyber policies offer cover for regulatory fines only where they are insurable by law, and the position in the UK is uncertain. Defence costs for an Information Commission investigation are more commonly covered than the fine itself, subject to the policy terms.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
