Do I need cyber liability insurance for my Ontario business if I store customer data online?

Cyber liability insurance is worth serious consideration for any Ontario business that stores customer data online, since it is designed to cover the costs that follow a data breach or cyberattack that general liability and property insurance typically do not address. These commonly include the cost of investigating a breach, legally required notification to affected individuals, legal costs and potential liability if customers or regulators pursue a claim, and sometimes business interruption or ransom costs tied to a ransomware incident.

Under PIPEDA, businesses that experience a breach involving personal information posing a real risk of significant harm have an obligation to notify affected individuals and, in some cases, report to the federal privacy commissioner — obligations that exist regardless of insurance, but that cyber coverage can help fund and manage. Whether you specifically need this coverage depends on the volume and sensitivity of the customer data you hold and how it is secured, and on what your existing policies already cover, since some CGL or professional liability policies include limited cyber extensions that are rarely sufficient on their own for a business handling meaningful customer data.