Cyber Insurance for Small Business: Do You Really Need It?

Posted by Insurance City on June 13, 2026

Short answer: if your business stores customer names with Social Security, driver’s license, card, or health information, you likely need cyber insurance. California Civil Code §1798.82 requires you to notify affected residents within 30 calendar days of discovering a breach, and your general liability policy usually excludes those costs. A cyber policy may pay for the notification, forensics, and legal response.

Plenty of California owners assume cyberattacks only hit big companies. The opposite is true — small businesses are targeted precisely because their defenses are thinner.

Why GL won’t help

Your general liability policy excludes data breaches and cyber events. The cost of a breach — notification, recovery, lost income, liability to customers — falls on you unless you carry cyber liability.

What cyber liability covers

• Breach response — notifying customers, credit monitoring, forensics
• Ransomware and cyber extortion
• Business interruption from a cyber event
• Liability to customers whose data was exposed, plus regulatory costs

Who especially needs it

If you store customer data, take card payments, or rely on software to run — retailers, medical and professional offices, tech businesses — cyber is no longer optional.

What does California Civil Code §1798.82 require after a data breach?

If your business owns or licenses computerized personal information about California residents, you must notify each affected resident of a breach within 30 calendar days of discovering it. SB 446 set that deadline, effective January 1, 2026. When more than 500 Californians are notified, you must also send a sample copy of the notice to the Attorney General within 15 calendar days of notifying them (§1798.82(f)). Delays are allowed only for law-enforcement needs or to determine the scope of the breach and restore the system.

• Who must notify: any business that "conducts business in California" and owns or licenses the data. If you only maintain data for someone else, as a bookkeeper, IT vendor, or payroll service does, you must notify the data owner immediately after discovery (§1798.82(b)).
• What counts as personal information (§1798.82(h)): a name combined with a Social Security number, a driver's license or state ID number, a financial account or card number with its access code, medical or health-insurance information, or biometric data. A username or email address with its password also counts. Properly encrypted data is excluded unless the key was also taken.
• What the notice must look like (§1798.82(d)): plain language, at least 10-point type, titled "Notice of Data Breach," with the headings "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information."
• Identity-theft services: if Social Security, driver's license, or state ID numbers were exposed and your business was the source, the notice must offer identity-theft prevention and mitigation services at no cost to the resident for at least 12 months.

There is a separate lawsuit risk as well. Under the CCPA (Civil Code §1798.150), consumers can sue for statutory damages, set per consumer and per incident, when a breach results from a failure to keep reasonable security. That means exposure grows with every record you hold.

What should a small business do in the first 30 days after a breach?

1. Day 0: contain and call. Disconnect affected systems, but don't wipe them. Call your cyber carrier's claim or breach hotline before hiring anyone. Many policies require using the carrier's approved breach counsel and forensic firms.
2. Days 1–10: forensics. Find out what was accessed and whose data it was. The answer determines who must be notified under §1798.82 and in which other states.
3. Days 10–25: draft and set up. Breach counsel drafts the "Notice of Data Breach" with the required headings. Arrange the mailing, a call center, and, if SSNs or driver's license numbers were involved, 12 months of identity-theft services.
4. By day 30: notify residents. Unless a documented law-enforcement or scope delay applies.
5. Within 15 days after that: notify the Attorney General if more than 500 California residents received notice.

General liability vs. cyber liability: which one responds to a breach?

General liability is built for bodily injury and physical property damage, and most GL forms exclude data-breach and electronic-data losses. Cyber liability is written for exactly those losses. Coverage always depends on the policy wording.

Event	General liability (typical)	Cyber liability (may cover, per policy)
Notification letters, call center, credit monitoring (§1798.82)	Usually excluded	Breach-response costs
Forensic investigation and breach counsel	Usually excluded	First-party response costs
Ransomware or cyber extortion	Excluded	Extortion response, subject to policy terms
Income lost while systems are down	Not covered	Business interruption and data restoration
Customer lawsuit over exposed data (e.g., CCPA §1798.150)	Usually excluded	Network security and privacy liability
Customer slips and falls in your store	Covered	Not covered

How common are cyber incidents for small businesses?

The FBI's Internet Crime Complaint Center logged 859,532 complaints in 2024 (IC3 2024 Internet Crime Report). Verizon's 2025 Data Breach Investigations Report found ransomware in 44% of the breaches it reviewed, and it found third-party involvement in about 30%. That second number is a reminder that your bookkeeper's or software vendor's breach can become your notification problem.

What affects the price of cyber insurance?

We don't publish price ranges, because cyber pricing is individual. Underwriters typically look at your annual revenue, your industry, the number and type of records you hold (SSNs, card data, health data), your security controls (multi-factor authentication, offline backups, endpoint detection, patching), prior incidents, and the limits and retention you choose. Strong MFA and tested backups often affect eligibility as much as price.

Frequently asked questions

How long does a California business have to report a data breach?

Under Civil Code §1798.82, as amended by SB 446 (effective January 1, 2026), affected California residents must be notified within 30 calendar days of discovering the breach. A delay is allowed only for law-enforcement needs or to determine scope and restore the system. If more than 500 residents are notified, a sample notice goes to the Attorney General within 15 calendar days after that.

Does cyber insurance pay for breach notification costs?

Many cyber policies include breach-response coverage that may pay for notification letters, call centers, credit or identity monitoring, forensics, and breach counsel. Limits, retentions, and approved-vendor requirements vary by policy, and a licensed agent can review yours.

Does §1798.82 apply to small businesses?

Yes. It applies to any individual or business that conducts business in California and owns or licenses computerized personal information of California residents. There is no size or revenue exemption in §1798.82.

Get a cyber quote

Insurance City is a local independent brokerage in Stockton. Call (209) 670-1556 or see our cyber liability page (en español).

Insurance City Agency, LLC dba Via Rapida Insurance Services · CA Lic #6003045 · 956 W Robinhood Dr, Stockton · 25 N 14th St Ste 125, San Jose · (209) 670-1556. Reviewed by Santo Militello, CA License #1737723. Updated September 30, 2026. This is general information, not legal advice. Coverage depends on the policy wording, and a licensed agent can review a specific policy with you.