Cyber insurance for small businesses: is it worth the cost in the UK?

What to take away

Verdictyes for most UK small firms holding customer data; no for sole traders with minimal data.
UK premiumsbasic £250k cover often £120 to £400 a year; £1m cover often £500 to £2,000 a year.
Named insurersHiscox, Aviva, AXA, Zurich and CFC Underwriting. Beazley also writes cyber. Brokers: Superscript and Simply Business.
ICO fines often excluded; check sub-limits.
Use NCSC Cyber Essentials and MFA to cut premium.

The verdict on whether cyber insurance is worth the cost

For a UK small business with customer or staff data, cyber insurance is usually worth the cost if you can buy £1m cover for under £1,500 a year. That is the clear answer for most. It is not worth it for a sole trader with no client data and tested backups. The break-even is simple.

Is cyber insurance worth it?

Do you hold customer or staff data?

Yes

worth it if £1m cover under £1,500

not worth it for sole trader, tested backups

One breach response bill can exceed several years of premium. Hiscox, Aviva, AXA and Zurich all sell cyber cover to UK small firms. CFC Underwriting and Beazley are specialist cyber insurers. Superscript and Simply Business offer online quote journeys for smaller risks.

What UK cyber insurance actually costs

Public UK quote engines often show basic cover for a low-risk micro business at £10 to £30 a month. That buys limits around £250,000. For a firm with £500,000 turnover and 20,000 records, £1m cover often quotes £500 to £2,000 a year. A £2,500 excess is common.

UK cyber insurance premium ranges

Low-risk micro£10-£30 a month
£500k turnover, 20k records£500-£2,000 a year
Common excess£2,500

Hiscox advertises cyber and data insurance for small businesses. Aviva's cyber liability policy includes breach response and legal defence. AXA and Zurich sell cyber policies through brokers. CFC Underwriting is known for incident response led cyber cover. Beazley writes cyber for larger SMEs. These are market ranges, not quotes. Your sector, records and controls change the price.

How insurers price the risk

Insurers price exposure and evidence. A firm with multi-factor authentication and offline backups looks better than one without. The limit, excess and sub-limits do most of the work. Raising the limit raises premium. Raising the excess lowers premium but leaves more risk with you.

Data volume matters. Special category data raises price. Weak controls raise price or cut cover. NCSC Cyber Essentials is a government-backed scheme. Certification costs from around £300 plus VAT through licensed bodies. It can help your quote. The business insurance market guide explains buying routes.

A worked example with UK figures

Assume a marketing agency with £500,000 turnover holds 20,000 consumer records. It buys a cyber policy with a £1m limit and a £2,500 excess. Public market ranges suggest a premium of £700 to £1,800 a year.

Worked breach example

£115,000total insured loss
£2,500excess
£112,500insurer pays
£700-£1,800annual premium

A breach response bill reaches £40,000 for forensics and notification. Legal defence costs £60,000. Business interruption adds £15,000. The insured loss is £115,000 before the excess. After the £2,500 excess, the insurer pays £112,500. The annual premium is a small share of that loss. That example is not a quote.

What a policy pays for and what it excludes

The Wikipedia cyber insurance page outlines first-party breach costs and third-party liability claims. First-party cover can pay forensics, notification, credit monitoring and public relations. Third-party cover can pay legal defence and compensation claims. Most policies include business interruption for lost profit during an outage. Read the waiting period and sub-limit.

Common gaps include ICO fines, prior acts, unencrypted devices, failed backups and contractual liabilities above the limit. Most cyber policies exclude fines and penalties. Cover may pay defence costs, but the ICO penalty often stays with the business.

When the cost is not worth it

Do not buy cyber insurance if you are a sole trader with no customer data, strong backups and no contractual requirement. Put the premium into controls instead. A GOV.UK's finance and support page lists grant and loan routes that may fund improvements.

If you use AI tools to process customer data, the controls in AI in business insurance intake matter. A vendor breach can become your notification duty. The ICO's guide for organisations explains when a personal data breach must be reported and what the notification should contain. Report within 72 hours if risk is high.

A short checklist before you buy

Map the personal data you hold and where it sits.
Test your backup restore and incident contacts.
Decide the most you can retain after a breach.
Ask for the schedule, sub-limits and exclusions.
Compare quotes on the same limit and excess.
Set a review date when your data or tools change.

Common questions

Is cyber insurance legally required for UK small businesses?

No UK law requires cyber insurance for every small business. Some contracts or regulators may require cover. The ICO's data protection duties apply whether or not you insure.

How much does cyber liability insurance cost UK?

Public UK ranges run from about £120 to £400 a year for £250,000 cover. £1m cover often quotes £500 to £2,000 a year. Ask Hiscox, Aviva, AXA, Zurich or Superscript for a quote based on your data map.

Does data breach insurance for a small business cover ICO fines?

Usually not. Policies tend to exclude fines and penalties. They may pay defence costs and breach response costs under the liability or first-party sections.

What limit should a small business choose?

Start with the cost of a worst-case breach. Then check what sub-limits apply. A £1m limit can shrink once notification, legal and interruption sub-limits are counted. Many UK small firms buy £1m.