Data Protection & GDPR Consultants Insurance
Data protection consultants are usually engaged to reduce a client's regulatory risk, which means a claim against them tends to follow the event the client was paying to avoid. A breach happens six months after a clean audit, a complaint reaches the Information Commissioner's Office, or a subject access request is mishandled on the consultant's template, and the client looks at the advice it was given.
The legal framework is UK GDPR alongside the Data Protection Act 2018. Both give the ICO powers to investigate and fine, and both give individuals a right to claim compensation for damage, including distress, caused by an infringement. A client facing either will want to know whether its consultant contributed.
Acting as an outsourced data protection officer changes the position. UK GDPR allows the DPO role to be filled under a service contract, and many consultancies hold it for several organisations at once. The DPO is expected to monitor compliance and advise, so where a client's processing goes wrong the question becomes what its DPO knew, reported and did about it.
We can advise data protection consultancies on professional indemnity for audit, advisory and DPO work, and on cyber cover for the client data that passes through the practice during engagements.
Common claims and risk exposures
The exposures that produce claims in this trade, rather than a generic list.
A breach after your audit
A client is audited, given a remediation plan or a clean report, and then suffers a breach in an area that was reviewed. The client's costs, compensation claims from data subjects and any regulatory outcome may be pursued against the consultancy, particularly if the report gave assurance rather than findings.
Outsourced DPO appointments
Holding the DPO role for a client means advising and monitoring on an ongoing basis. If a high risk processing activity went ahead without a data protection impact assessment, or a reportable breach was not notified in time, the DPO's records will be examined closely.
Breach response advice
UK GDPR generally requires reportable breaches to be notified to the ICO within 72 hours of the controller becoming aware. Advice that a breach did not need reporting, or that individuals did not need telling, can be second guessed later and aggravate the client's position.
Templates, policies and DPIAs
Privacy notices, retention schedules, data sharing agreements and DPIA templates are reused by clients for years. A defect in a template can repeat across many clients at once, raising questions about how claims aggregate under the policy.
Handling client personal data
Audits and DSAR support mean the consultancy holds copies of client data, sometimes special category data. A breach by the consultant is the scenario the client hired them to prevent, and it attracts both a claim and reputational damage.
The cover we arrange
We arrange professional indemnity and related insurance around the services you provide, the clients you work with and the contractual requirements you face. The appropriate cover and limits will depend on your individual activities and the terms available from insurers.
Professional indemnity
Claims arising from negligent data protection advice, audits, DPIAs, policies and training. The wording should describe privacy and information governance consultancy specifically, including any DPO appointments.
- Audit and gap analysis work
- Policies, notices and DPIAs
- Breach and DSAR advice
- Defence costs, depending on the policy
Outsourced DPO role
Some policies treat holding a statutory role differently from giving advice. Where the practice acts as DPO, the number of appointments, client sectors and the services included should be declared and the wording checked.
- Named appointments declared
- Monitoring and advisory duties
- Large scale special category clients
- Records of advice given
Cyber and data liability
The consultancy's own breach response costs and liability where client data it holds is compromised. Increasingly asked for by clients as a condition of engagement.
- Breach notification and forensics
- Claims from clients and individuals
- Ransomware and system restoration
- Social engineering where available
Regulatory investigation costs
Some policies can include legal costs where the consultancy is drawn into an ICO investigation of a client, or of itself. Cover varies widely, so the limit and the trigger need checking.
- Responding to regulator enquiries
- Legal representation costs
- Sub limits are common
- Fines themselves treated separately
Run off
Continuing cover after the consultancy closes or a DPO appointment ends. Breaches and complaints can surface years after the audit or the policy work that is later criticised.
- Continues after the practice ceases
- Appointments that have ended
- Commonly six years
- Arranged before closure
What an underwriter will ask
Having these to hand shortens the process considerably, and usually improves the terms.
- Fee income split between audits, outsourced DPO services, DPIAs, policy drafting, training and DSAR support
- Number of DPO appointments held and the sectors of those clients
- Whether clients process special category data at scale, for example health, biometrics or children's data
- Whether technical security testing is carried out, or only governance and legal compliance advice
- Qualifications and professional memberships of the consultants
- How client personal data is received, stored and deleted during engagements
- Standard terms, liability caps and whether reports are shared with third parties
- Claims, complaints and notified circumstances over the last six years
What affects the cost of your insurance?
The main factors insurers consider when assessing the premium.
DPO appointments
The number of organisations relying on the practice as their DPO, and the sensitivity of their data, typically has more influence on terms than general advisory income.
Client data profile
Clients processing health, financial, children's or biometric data at scale present larger potential losses after a breach, and so does advice to organisations with very large customer databases.
Own data security
How the consultancy protects the client data it handles affects both the cyber premium and the professional indemnity view, since a breach by the adviser is hard to defend.
Contract terms
Liability caps, clear scope and limits on third party reliance reduce the exposure on each engagement, particularly for audit reports that clients show to customers or acquirers.
Conditions and exclusions to consider
Terms vary between insurers, so treat these as the questions to ask rather than a description of any one policy.
Fines imposed by the regulator
ICO fines are generally regarded as uninsurable in the UK as a matter of public policy, whether imposed on the client or on the consultancy. Policies may refer to fines only where insurable by law, which in practice often means they are not paid.
Guaranteeing compliance
Certifying that a client is fully compliant, or warranting that no breach will occur, goes beyond reasonable skill and care. Reports framed as findings and recommendations are easier to defend and to insure.
Security testing and technology services
Penetration testing, system configuration and software supply are technology services that a governance advisory policy may not cover. They need declaring and possibly a technology professional indemnity wording.
Legal advice reserved to solicitors
Data protection consultants advise on the law legitimately, but conducting litigation or holding out as solicitors is a different matter. Where a client needs representation in proceedings, referring it on keeps the consultancy inside its declared activity.
Common questions
Can insurance pay an ICO fine?
Generally not. Regulatory fines are widely regarded as uninsurable in the UK as a matter of public policy, so you should assume neither your fine nor your client's will be paid. Insurance can respond to defence and legal costs and to civil compensation claims, depending on the policy.
We act as outsourced DPO for several clients. Is that covered as consultancy?
It needs to be declared as its own activity. The DPO role carries continuing monitoring and advisory duties, and insurers will want to know how many appointments you hold, the sectors involved and how you document advice. Undeclared, it could leave a gap in the very work most likely to be scrutinised.
A client we audited has had a breach. What should we do?
Notify your insurer of the circumstances as soon as you are aware, even if the client has not made a claim. Keep your audit scope, findings, recommendations and the client's responses together, because whether the breach area was in scope and whether recommendations were followed will decide the position.
Do we need cyber insurance if we only give advice?
Most data protection consultancies hold client data during audits and DSAR work, and some clients now require cyber cover as a contract condition. A breach of data you hold for a client is both a claim and a serious reputational problem in this profession.
Does our policy cover the training we deliver to client staff?
Often it can, provided training is declared as part of the business. The claim scenario is a client whose staff followed what they were taught and caused a breach, which is a professional indemnity question about the content of the course.
How do I get a quote from True Risk Solutions?
Call 01304 262880 and speak to a broker, or email info@truerisksolutions.co.uk with what you do, what you need cover for and a phone number with the best time to call, and a broker will call you back. We need a phone number to quote, because the cover and the price depend on questions that are quicker to answer on a call than by email.
Speak to a specialist who understands your industry
Tell us about your business and the work you undertake, and we will come back to you with cover options built around it. Call 01304 262880, or email us with a phone number and the best time to call and a broker will ring you back.