FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Insurance explained
Cyber insurance for schools is cover for the costs of a cyber attack or data breach, such as incident response, system recovery, extra working costs and data protection claims. Schools hold sensitive children's data and depend on IT to teach, so an attack can close classrooms.
Part of: Commercial insurance
In short
Schools face ransomware, phishing and data breaches like any organisation, but with children's data and safeguarding duties at stake. Academies and other public sector schools in the DfE's Risk Protection Arrangement get cyber cover up to £250,000 per member per year, but only if they meet four conditions: offline backups, annual NCSC training for staff and governors with IT access, Police CyberAlarm registration and a cyber response plan. Independent schools buy cyber insurance commercially. Under the UK GDPR, notifiable personal data breaches must be reported to the regulator within 72 hours where feasible, and insurers expect controls in line with DfE's cyber security standards.
A cyber policy is built around an incident. When a school discovers ransomware, a compromised email account or a data breach, it calls the insurer's response line. The insurer typically appoints specialists: IT forensics to contain the attack and find out what happened, lawyers to advise on data protection duties, and sometimes public relations support. The policy then pays for recovery and, depending on the wording, for losses and claims that follow.
Ransomware is the scenario many schools fear most: files and systems are encrypted, sometimes after data has been copied out, and a ransom is demanded. Recovery can take days or weeks, with the MIS, registers, email and payroll unavailable. Whether a policy would respond to a ransom demand depends on the wording and the law; the more reliable protection is tested offline backups, which is why both the RPA and commercial insurers focus on them.
Time matters. Under Article 33 of the UK GDPR, a controller must notify a personal data breach to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. The school or trust is the controller for pupil and staff data, so this duty sits with it, not with its IT provider. See cyber cover for pupil data and the ICO.
DfE's KCSIE 2026 consultation response says cyber security is now recognised as a safeguarding concern, not just an IT concern, and should be approached as a whole school issue rather than resting solely with individual roles or external providers.
| Commonly covered | Commonly excluded or limited |
|---|---|
| Incident response, IT forensics and legal advice | Improving systems beyond their pre-incident state |
| Restoring data and systems | Losses where required controls were not in place, if the policy makes them conditions |
| Extra costs of keeping the school running | Money lost to payment diversion, unless crime or social engineering cover is added |
| Notifying affected pupils, parents and staff | Regulatory fines, where uninsurable or excluded |
| Data protection claims and defence costs | Incidents known before the policy started |
Payment diversion is a frequent gap. A bursar who pays a fake supplier invoice has usually lost money through fraud, not through damage to systems, so crime cover or social engineering cover is often needed alongside cyber. See wire fraud and social engineering. On fines, see GDPR fines versus civil claims.
Under Section 14 of the RPA membership rules for academy trusts, members get compensation for increased cost of working after a cyber incident, plus incident response services. The limit is £250,000 each and every loss and in the aggregate per member per Membership Year, with a £750,000 aggregate for a group network. The member retention is £1,000 for a primary academy and £2,000 for other members.
Cover depends on four conditions, which a DfE Get help buying for schools blog lists as: offline backups; NCSC cyber security training completed annually by staff and governors with access to the IT system; registration with Police CyberAlarm; and a cyber response plan. The blog warns that a member that does not meet them and suffers an incident will not be covered. DfE's Cyber Security Hub also says cyber cover is for public sector schools.
Independent schools cannot join the RPA and buy cyber insurance commercially, usually as a standalone policy or a section of a school package. A large trust may also look at commercial cyber if it wants higher limits or wider cover than Section 14. Our page on the RPA versus commercial insurance covers the wider choice.
DfE's digital and technology standards say all schools and colleges should be working towards meeting six core standards by 2030. The cyber security core standard covers, among other things:
Commercial insurers ask similar questions on their proposal forms. The standard itself notes that failing to meet the user accounts standard could mean a school is not covered by its insurer for cyber attacks.
These examples are illustrative, not real cases.
A primary academy hit by ransomware. The trust is in the RPA and has met the four conditions. It uses the RPA's 24-hour incident support, restores from offline backups and claims its extra costs of working, less the £1,000 retention.
An independent senior school with a data breach. A phishing email leads to a compromised account holding pupil medical information. The school's commercial cyber policy funds forensics, legal advice on reporting and letters to families.
A trust bursar targeted by a fake supplier. The money lost is a crime issue. Without crime or social engineering cover, a cyber policy may pay only for investigating the compromised mailbox. See AI-powered attacks on schools.
For wider context, see our UK cyber breach statistics.
See also our commercial cyber guide and the education insurance guide.
Apex arranges commercial cyber insurance for independent schools and trusts that buy outside the RPA; a broker reads every enquiry.
It is not a legal requirement, but DfE's cyber security standard recommends schools get cyber insurance and says the RPA can be considered as an alternative to commercial insurance. Schools hold children's personal data and rely on IT for teaching, so an incident can be costly and disruptive.
Yes, for members who meet the conditions. Section 14 covers increased cost of working after a cyber incident and incident response, up to £250,000 per member per year. Members must have offline backups, annual NCSC training for staff and governors with IT access, Police CyberAlarm registration and a cyber response plan.
Often not. Many policies exclude fines and penalties, or cover them only where insurable by law, and the RPA's governors' liability section excludes regulatory penalties. Cyber policies more commonly pay for legal advice, notifying affected people and defending data protection claims, subject to the policy terms.
Under Article 33 of the UK GDPR, a notifiable personal data breach must be reported to the regulator without undue delay and, where feasible, within 72 hours of the school becoming aware of it. If it is reported later, the reasons for the delay must be given. The school, as controller, owns this duty.
Not always. Money paid to a fraudster after a fake change of bank details is usually treated as a crime or social engineering loss. Some cyber policies include limited cover for it; many do not. Schools often add crime cover, which commonly requires call-back checks before bank details are changed.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
