Coverage for the data breach a standard policy won’t touch
Cyber liability insurance may pay for the costs a data breach creates, including the notices California Civil Code §1798.82 requires within 30 calendar days of discovery, plus forensics, legal response, ransomware, and lost income. General liability usually excludes those costs.
A breach, ransomware attack, or a stolen laptop can cost a small business more than a fire — and general liability excludes it. Cyber liability covers the response and the fallout when customer or business data is compromised. Insurance City helps Central Valley businesses get covered before it happens.
What cyber liability covers
- Breach response — customer notification, credit monitoring, and forensics.
- Ransomware & cyber extortion.
- Business interruption from a cyber event.
- Liability to customers whose data was exposed.
- Regulatory and legal costs tied to a covered breach.
Why businesses work with us
We’re independent, so we shop cyber markets across major carriers instead of one company’s box — and there are no broker fees on standard policies at our Stockton and San Jose offices. We right-size limits to the data you actually hold and explain what the policy expects of you (the security basics that keep coverage valid). Bilingual (English / Español) and local to Stockton.
Get a cyber liability quote
Tell us your business and the kind of customer data you handle, and we’ll put together comparative quotes across carriers. Call (209) 670-1556 or request a quote below.
What does California Civil Code §1798.82 require after a data breach?
If your business owns or licenses computerized personal information about California residents, you must notify each affected resident of a breach within 30 calendar days of discovering it. SB 446 set that deadline, effective January 1, 2026. When more than 500 Californians are notified, you must also send a sample copy of the notice to the Attorney General within 15 calendar days of notifying them (§1798.82(f)). Delays are allowed only for law-enforcement needs or to determine the scope of the breach and restore the system.
- Who must notify: any business that "conducts business in California" and owns or licenses the data. If you only maintain data for someone else, as a bookkeeper, IT vendor, or payroll service does, you must notify the data owner immediately after discovery (§1798.82(b)).
- What counts as personal information (§1798.82(h)): a name combined with a Social Security number, a driver's license or state ID number, a financial account or card number with its access code, medical or health-insurance information, or biometric data. A username or email address with its password also counts. Properly encrypted data is excluded unless the key was also taken.
- What the notice must look like (§1798.82(d)): plain language, at least 10-point type, titled "Notice of Data Breach," with the headings "What Happened," "What Information Was Involved," "What We Are Doing," "What You Can Do," and "For More Information."
- Identity-theft services: if Social Security, driver's license, or state ID numbers were exposed and your business was the source, the notice must offer identity-theft prevention and mitigation services at no cost to the resident for at least 12 months.
General liability vs. cyber liability: which one responds to a breach?
General liability is built for bodily injury and physical property damage, and most GL forms exclude data-breach and electronic-data losses. Cyber liability is written for exactly those losses. Coverage always depends on the policy wording.
| Event | General liability (typical) | Cyber liability (may cover, per policy) |
|---|---|---|
| Notification letters, call center, credit monitoring (§1798.82) | Usually excluded | Breach-response costs |
| Forensic investigation and breach counsel | Usually excluded | First-party response costs |
| Ransomware or cyber extortion | Excluded | Extortion response, subject to policy terms |
| Income lost while systems are down | Not covered | Business interruption and data restoration |
| Customer lawsuit over exposed data (e.g., CCPA §1798.150) | Usually excluded | Network security and privacy liability |
| Customer slips and falls in your store | Covered | Not covered |
Step-by-step 30-day breach checklist, attack statistics, and pricing factors: Cyber Insurance for Small Business: Do You Really Need It?
Insurance City Agency, LLC dba Via Rapida Insurance Services · CA Lic #6003045 · 956 W Robinhood Dr, Stockton · 25 N 14th St Ste 125, San Jose · (209) 670-1556. Reviewed by Santo Militello, CA License #1737723. Updated September 30, 2026. This is general information, not legal advice. Coverage depends on the policy wording, and a licensed agent can review a specific policy with you.
Frequently Asked Questions
How long does a California business have to report a data breach?
Under Civil Code §1798.82, as amended by SB 446 (effective January 1, 2026), affected California residents must be notified within 30 calendar days of discovering the breach. A delay is allowed only for law-enforcement needs or to determine scope and restore the system. If more than 500 residents are notified, a sample notice goes to the Attorney General within 15 calendar days after that.
Does cyber insurance pay for breach notification costs?
Many cyber policies include breach-response coverage that may pay for notification letters, call centers, credit or identity monitoring, forensics, and breach counsel. Limits, retentions, and approved-vendor requirements vary by policy, and a licensed agent can review yours.
Does §1798.82 apply to small businesses?
Yes. It applies to any individual or business that conducts business in California and owns or licenses computerized personal information of California residents. There is no size or revenue exemption in §1798.82.
Does my small business really need cyber insurance?
If you store customer data, take card payments, or rely on software, yes — small businesses are targeted because defenses are thinner, and general liability excludes cyber events.
What does cyber liability cover?
Breach response such as notification and forensics, ransomware and cyber extortion, business interruption from a cyber event, and liability to customers whose data was exposed.
Why will my general liability not cover a data breach?
General liability is built for physical injury and property damage and specifically excludes cyber and data exposure — cyber liability fills that gap.
Insurance City offers comparative quotes on Cyber Liability Insurance from multiple insurance carriers so you can compare options and pick the right fit.
Request a quote to compare your options.
Ready for a quote? Call, walk in, or send the form
Call (209) 670-1556 Request a Quote
956 W Robinhood Dr, Stockton · Mon–Fri 10am–6pm · Walk-ins welcome · Se habla español · ITIN accepted. Insurance City Agency, LLC · CA License #6003045. Reviewed by Santo Militello, California-licensed agent and owner (CA Lic. #1737723). Our licensed team brings more than 70 years of combined insurance experience.
