Cyber insurance in Australia: cover, exclusions and cost
· Updated
Joaquín Trapero in AI and privacy expert, and founder of Nonimo.
Cyber insurance in Australia is sold as one product, but it’s several covers bolted together, and each insurer bolts them differently. Search results are mostly insurers and brokers. I’ve left them out and kept to the law, the regulator, the government and the industry body.
You get the menu of covers, the clauses to hunt for in your wording, and the clocks that start after an incident. If a renewal form asked about AI use, the AI questions on a cyber insurance questionnaire have their own guide.
A cyber policy can pay for your response after an attack (forensics, data recovery, notifying customers, ransomware, lost trading time) and for claims made against you, and some cover regulator penalties. What yours won't pay is set by its wording, not by any market standard, so read the full policy before you accept the quote.
What cyber insurance covers in Australia
The government’s business.gov.au lists four areas a cyber policy can cover: cyber extortion and ransomware, interruptions from a cyber event, network security and data breaches including recovery costs, and the inadvertent loss or release of customers’ personal information.
The Insurance Council of Australia adds forensics, customer notification, advice on whether a ransom payment is legal or reportable, the ransom itself, and regulator penalties. Both lists say “can” and “may”. Fair enough: I’d treat any line missing from my own schedule as not bought.
What happened, and which line of cover it touches
Pick the event. Then find that line in your schedule.
Extortion and ransomware, plus legal advice on whether paying is lawful or reportable. If your turnover was above $3 million last financial year and a payment is made, a report to ASD is due within 72 hours of paying.
Business interruption from a cyber event. Your schedule sets the waiting period before it starts counting and the longest stretch it pays. A short outage can fall entirely inside the waiting period.
Data breach, recovery and customer notification costs on your side. Claims brought by those customers sit under liability cover, if your policy includes it.
Penalties imposed by government regulators appear on the Insurance Council's list of what cover can include. Whether your policy pays a particular Privacy Act penalty is a separate question, covered below.
No public source I found answers this either way. The nearest listed line is the inadvertent release of customers' personal information. Whether a paste counts is the insurer's reading of its wording, and how client data leaks through AI tools shows how many routes there are.
business.gov.au, Types of business insurance; Insurance Council of Australia, Cyber risk; Home Affairs ransomware reporting factsheet. Matching events to lines of cover is my own reading.
What cyber insurance doesn’t cover: the clauses in your wording
There’s no standard exclusion list to quote, because there’s no standard Australian policy. The Insurance Council calls cyber insurance a relatively novel product, and each insurer drafts its own wording. So the useful question is what yours excludes.
That makes the full policy wording the document to ask for before you accept a quote. A product summary is a sales document. If you’re a broker fielding these requests, Nonimo for insurance brokers covers the client files that pass through your office.
Find each of these in your wording before you sign
Tick it once you've read the clause itself, not the summary.
0 of 8
Every unticked line is an email to the broker. Ask for the answer in writing.
You've read the clauses that settle most arguments. File the wording with the schedule and your proposal answers.
My list of clauses to look for, not a summary of any insurer's policy. The only wording that counts is the one on your schedule.
A wording that says nothing about AI bothers me more than one that excludes it. An exclusion you can plan around. Silence gets settled after the loss, by whoever is arguing about it, and a written AI policy for staff is what you’d want on the table then.
Will a cyber policy pay a Privacy Act penalty?
On paper, sometimes. The Insurance Council lists regulator penalties among what cover can include, but whether an insurer may lawfully pay a given penalty is a legal question. A wording can hand that question straight back to you with a phrase like “insurable by law”.
The amounts explain why owners ask. Since the 2024 amendments the Privacy Act has three civil penalty provisions, and only the top one is written in dollars.
The Privacy Act's three civil penalty tiers
The top row is the one a cyber policy's penalty cover gets tested against.
| Section | What it catches | Maximum |
|---|---|---|
| 13G | A serious interference with privacy | Body corporate: the greatest of $50,000,000, three times the benefit obtained, or 30% of adjusted turnover in the breach turnover period. Anyone else: $2,500,000 |
| 13H | An interference with privacy that isn't serious | 2,000 penalty units, with a higher ceiling for a body corporate |
| 13K | Listed APP breaches, such as privacy policy content, and a data breach statement that doesn't comply with s 26WK(3) | 200 penalty units, with infringement and compliance notices available |
Privacy Act 1988, Compilation No. 104, 4 June 2026, ss 13G, 13H, 13K and 80U. Penalty units are shown as the Act states them, not converted to dollars. Section 80U applies the Regulatory Powers Act, which generally allows up to five times the stated penalty for a body corporate; s 13G(4) switches that off for the top tier only.
The first penalties under the Act came on 8 October 2025: $5.8 million against Australian Clinical Labs over the Medlab Pathology breach. I wouldn’t settle the “insurable by law” point myself, or let a broker settle it on the phone.
Staying out of the table is cheaper than insuring against it, and that starts with which AI tools you can use under the Privacy Act.
Does cyber insurance pay out? It starts with the proposal form
Most payout fights start with what you told the insurer, or did after. For a business policy, section 21 of the Insurance Contracts Act makes you disclose what you know, or a reasonable person would know, is relevant to the insurer’s decision.
Two provisions soften that. Under section 21(3), a question left blank, or answered obviously incompletely, counts as the insurer waiving disclosure on that point. Under section 54, a later act alone can’t justify refusing, unless it could reasonably have caused or contributed to the loss.
The insurer is questioning the claim. Over what?
What is the insurer pointing at?
Would the insurer have written the same policy, for the same premium and terms, with the right answer?
Was the wrong answer fraudulent?
Could that act reasonably be seen as capable of causing or contributing to the loss?
Insurance Contracts Act 1984, Compilation No. 33, 8 October 2026, ss 21, 28 and 54. My reading of public documents, not advice about your policy or your claim.
A lapsed MFA setting is the section 54 fight I’d expect most. Fill in the form as if the claims assessor will one day read it beside your incident report. If you’re the IT provider answering it with a client, our partner programme is written for that seat.
Answer any AI question tool by tool and plan by plan. “We use Claude” says little, because Claude’s training setting depends on the plan.
Microsoft is the same story, since the Copilot name covers several products. Keep a dated copy of every answer, filed with the wording’s version number.
Client data pasted into a chatbot: is that a cyber claim?
The OAIC’s own example is set inside an insurance company. Staff paste a customer’s claim details into a public chatbot and ask for a report on whether to accept the claim. The OAIC treats that as disclosure to the chatbot’s owners, engaging APP 6.
Its best-practice line is plain: don’t enter personal information, especially sensitive information, into publicly available generative AI tools. What the tool does with the text next varies by product, and what ChatGPT keeps and shares shows how much.
Whether a cyber policy responds to that is a reading of its wording. For a law firm, confidentiality bites first, as the Law Society of NSW’s guidance for firms explains. A paste that never happens needs no claim, which is why the box below exists.
What's in the text before it goes into a chatbot?
Paste what a staff member was about to send.
Runs in your browser and sends nothing. It finds TFNs, Medicare numbers, ABNs and ACNs by check digit, and NDIS numbers, BSBs, passports, phone numbers and emails by format. It can't spot names or addresses.
The NDB clock and your insurer’s notification clock
Several clocks can start at once. The Privacy Act wants a reasonable and expeditious assessment of a suspected eligible data breach, with all reasonable steps to finish within 30 days. Once you believe one happened, the OAIC gets a statement as soon as practicable.
Those clocks now have a price. Against Australian Clinical Labs, the Federal Court ordered $800,000 for a slow assessment and $800,000 for a late statement, plus $4.2 million over security. Whether a chatbot paste is a notifiable breach is the first thing to settle.
Four clocks after a cyber incident
The last row is the one no law sets, and the one your claim depends on.
| Clock | Starts when | Deadline | Who it binds |
|---|---|---|---|
| NDB assessment (s 26WH) | You have reasonable grounds to suspect an eligible data breach | All reasonable steps to finish within 30 days | APP entities. Most businesses that have never turned over more than $3 million a year are outside, unless an exception applies, such as providing a health service |
| Statement to the OAIC (s 26WK) | You have reasonable grounds to believe there was one | As soon as practicable, then individuals are told | The same entities |
| Ransomware payment report | A payment is made, or you learn one was made for you | 72 hours | Businesses above $3 million turnover in the previous financial year, and critical infrastructure entities |
| Your insurer | Whatever your policy says | Check your policy's notification condition | You, as a condition of the claim |
Privacy Act 1988, ss 26WH and 26WK; OAIC data breach guide, Part 4; Home Affairs ransomware reporting factsheet; OAIC on the Australian Clinical Labs orders, 9 October 2025.
The insurer’s clock is the one that slips in the first hour. Print the claims number and the notification clause, and put the Australian Cyber Security Hotline, 1300 CYBER1, beside them. A PDF of your policy on the server that’s just been encrypted is no help.
How much cyber insurance costs, and is it worth it for a small business?
I couldn’t find a premium figure from any regulator or government body. The prices in search results come from insurers and brokers selling the cover, so they’re not here. Your quote comes from turnover, industry, claims history and your answers on the form.
What is published is the cost of the problem. The Insurance Council, citing the 2024-25 Annual Cyber Threat Report from ASD’s Australian Cyber Security Centre, puts the average self-reported cost per cybercrime report at $56,600 for a small business and $97,200 for a medium one.
Those are averages across victims who reported, not what a business should expect to lose in a year. Set your quote against them and your cash reserves. For organisations holding client records, I’d weigh the liability side above the downtime.
Does your business need cyber insurance?
Is your business covered by the Privacy Act?
Could you pay forensics, lawyers and customer notification from cash next month?
Would a week offline stop you trading?
OAIC data breach guide, Part 4, on small business operators; business.gov.au on the Small Business Cyber Resilience Service, delivered by IDCARE. The branching is my own.
If the insurer declines your cyber claim
The General Insurance Code of Practice holds a surprise. Its claims timeframes, including four months to decide, sit in Part 8, which doesn’t apply to wholesale insurance. Retail insurance means seven named product types, motor to travel, and cyber isn’t one.
On my reading, a small business cyber policy is wholesale under the Code, so its claims and complaints parts don’t bind the insurer. Ask whether yours follows them anyway. A strengthened Code went to ASIC on 22 October 2026, so this may change.
Which parts of the Code reach a cyber policy
| Part of the Code | Retail (motor, home, contents, travel and others) | Wholesale, where cyber falls |
|---|---|---|
| 5. Standards for service suppliers | Applies | Doesn't apply |
| 6. Buying insurance | Applies | Doesn't apply |
| 7. Cancelling a policy | Applies | Doesn't apply |
| 8. Making a claim, with the four-month default | Applies | Doesn't apply |
| 9. Customers experiencing vulnerability | Applies | Doesn't apply |
| 11. Complaints, with a 30-day decision | Applies | Only where you're entitled to financial hardship support |
General Insurance Code of Practice, October 2023 update, paragraph 12, Part 11 and Part 16 definitions. Placing cyber under wholesale is my reading of those definitions.
The Code’s promise of the Australian Financial Complaints Authority sits in Part 11 too. Check AFCA’s own rules on small business complaints, claim limits and time limits before you count on it. The rest of our guides cover the AI side of a claim file.
![A cyber insurance policy number shown as [POLICY_NUMBER_1]; keep it printed, since a PDF on an encrypted server is no help](/guias/en-au/cyber-insurance-policy-number-label.webp "A cyber policy number as a label")
Keeping client data out of your next cyber insurance claim
Cyber insurance pays once something has already left. Shrinking how much client information sits in emails, chats and AI prompts is cheaper, and it’s the problem we work on: a breach exposes less and a notification goes to fewer people.
For Australian teams, Nonimo covers client details before a prompt or file reaches an AI tool, and it’s something concrete to describe when the proposal form asks about controls.
If your own software calls an AI model, masking personal information inside your own apps is the equivalent control.
Two ways to handle the same risk
Insure it and stop there
- Pays after the incident, inside the wording
- Every client detail in the leak still triggers the clocks
- The AI question on the form stays hard to answer
Insure it and send less out
- The policy still backs you
- Fewer people to notify if something leaks
- A control you can name on the proposal form, with the logs an AI gateway keeps if you run one
My preference. Neither column replaces reading your wording.
Sources
- Insurance Council of Australia, Cyber risk: what cover can include, including regulator penalties and ransom, and the 2024-25 cost per cybercrime report it cites from ASD’s Australian Cyber Security Centre.
- Insurance Council of Australia, General Insurance Code of Practice, October 2023 update: parts that don’t apply to wholesale insurance and the definition of retail insurance.
- business.gov.au, Types of business insurance: the four areas cyber insurance can cover.
- business.gov.au, Small Business Cyber Resilience Service: free, delivered by IDCARE, for 19 or fewer employees.
- Insurance Contracts Act 1984, Compilation No. 33: ss 21, 21(3), 28 and 54.
- Privacy Act 1988, Compilation No. 104: ss 13G, 13H, 13K, 26WH and 26WK.
- OAIC, Guidance on privacy and the use of commercially available AI products: the insurance company chatbot example and the best-practice recommendation.
- OAIC, Australian Clinical Labs ordered to pay penalties: $5.8 million, including $800,000 each for the assessment and the statement.
- Department of Home Affairs, Ransomware payment reporting factsheet: 72 hours, the $3 million threshold and the phased approach.
Accessed 7 November 2026.
Common questions
What is covered in a cyber insurance policy?
Usually your response costs and, if included, claims from others. Government and industry lists name ransomware, business interruption, data recovery, customer notification, forensics and sometimes regulator penalties. Your schedule decides which of those you bought.
What does cyber insurance not cover?
Whatever your own wording excludes, since there's no standard Australian policy. Look for war and state-backed attacks, known prior incidents, contract liability, uninsurable fines, unsupported software and any mention of AI.
Is it worth getting cyber insurance?
It depends on what one incident would cost you against the premium. ASD figures quoted by the Insurance Council average $56,600 per report for small businesses. Compare that with your quote and cash reserves.
Does cyber insurance pay out?
Yes, when the loss fits the wording and your disclosure holds up. Section 54 of the Insurance Contracts Act limits refusals over later acts, unless the act could have caused or contributed to the loss.
How much does cyber insurance typically cost in Australia?
No regulator or government body publishes a premium figure. Prices in search results come from insurers and brokers. Yours depends on turnover, industry, claims history and your answers on the proposal form.
What are the new cybersecurity laws in Australia for 2026?
Ransomware payment reporting is the one most businesses meet. Since 30 May 2025, businesses above $3 million turnover must report a payment within 72 hours, and Home Affairs moved to compliance from 1 January 2026.