Cyber insurance explained
Data breaches and the PDPA: what cyber insurance pays for
The PDPA can make a data breach expensive even before anyone claims. Here is what the law asks of a business, as our cyber page explains it, and which costs each policy we price pays.
What the law asks
Since 2021 a data breach that is likely to cause significant harm, or that affects 500 or more people, must be reported to the Personal Data Protection Commission within three calendar days of your assessing it as notifiable, and the people affected told. The Commission can fine a business up to 10% of its annual Singapore turnover if that is above S$10 million, and up to S$1 million otherwise.
What each policy pays, at a S$500,000 limit
| Allied World | Sompo | Great American | |
|---|---|---|---|
| Forensics, legal advice and notifying the people affected | Full limit (forensics); Full limit (notification, monitoring, PR) | Full limit (forensics); Full limit (notification, monitoring, PR) | Full policy limit |
| Regulator investigations and claims from others | Full limit | Full limit | Full policy limit (privacy liability) |
| Fines, where insurable | No separate line in our record of its form | No separate line in our record of its form | 50% of the policy limit, within it |
| Excess on every claim | S$1,000.00 | S$1,000.00 | S$5,000.00, costs included, before GST |
| A year, revenue up to S$1,000,000 | S$1,308.00 | S$1,348.88 | S$1,308.00 |
None of Allied World, Sompo and Great American is one of our featured insurers for cyber insurance, so we rank none of them: every insurer’s plans are shown, cheapest first. Every revenue and limit · Price your own business.
How these prices are worked out
The prices are the Standard Plan tables printed on each insurer’s own proposal form (Allied World SG-CYBER1023-PF (0625), Sompo Oct 24, Great American F.40323B (12/24)), premiums including GST, read on 2 Nov 2026. A Premier Plan is the Standard figure plus the 50% loading Allied World’s and Sompo’s forms state. The insurers price on the past twelve months' revenue, in five bands up to S$20,000,000, and the limit. An unlimited retroactive date (20% more at Allied World and Sompo) is not priced here. Nothing here is a live quote. Shenton Brokers is an insurance broker in Singapore. Every example is in a CSV file, updated daily.
Questions people ask
What does the PDPA require after a data breach?
Since 2021 a data breach that is likely to cause significant harm, or that affects 500 or more people, must be reported to the Personal Data Protection Commission within three calendar days of your assessing it as notifiable, and the people affected told. The Commission can fine a business up to 10% of its annual Singapore turnover if that is above S$10 million, and up to S$1 million otherwise.
What does cyber insurance pay for after a breach?
Incident response cover pays for the assessment, the notifications and the lawyers. Each policy we price pays these to its full limit; the table below gives each insurer’s terms.
Does it pay PDPC fines?
Great American pays civil fines and penalties, where insurable, 50% of the policy limit, within it. Allied World and Sompo pay third-party, regulator and investigation liability to the full limit; our record of their forms has no separate line for fines.
How do I buy it?
Each insurer sells through intermediaries, so a broker places it: Apply Now opens the insurer’s own proposal form on our site, filled in from your answers. The form asks about your business, the data you hold, your security controls and your loss history, and the insurer confirms the premium. Ask Shenton to arrange sends us the plan you picked and we arrange it for you.