Mind the Gap: When the Cap and the Insurance Cover Don’t Match: Cyber Risk in Technology Contracts
Zinta Strydom and Jasmine Sikhosana
A technology contract states that the supplier’s liability is limited to R10 million. The supplier’s insurance policy provides R10 million of cover. The figures match, the agreement is signed, and everyone feels protected. But when the hackers come, the data goes missing, the systems go dark and the Information Regulator wants answers, those two R10 million figures may turn out to mean very different things.
Two R10 million figures sit side by side in many technology deals: the supplier’s contractual liability cap and the supplier’s insurance cover. They look like a perfect match. After a cyber incident, they often aren’t.
How is this so, you may ask?
Well, a cyber incident can generate a collection of costs that look very different from the traditional professional negligence claim, as these cyber incidents often require forensic investigation, incident response, notification, legal advice, business interruption, restoration costs, third-party claims and potentially significant
reputational damage.
To make matters worse (depending on whether you are the aggrieved customer on the receiving end of a cyber incident, or the supplier under whose watch the cyber incident occurred), South Africa’s data protection regime provides that a security compromise can also trigger statutory notification obligations to the Information Regulator, which adds another layer of cost and urgency. This burden rests on the customer as the responsible party, even where the compromise occurred within the supplier’s systems, as the supplier (acting as an operator) need only notify the customer immediately (section 21(2) of POPIA). The Information Regulator may also impose an administrative fine of up to R10 million (section 109 of POPIA), an amount which, on its own, could exhaust a R10 million cap, and which a policy may cover only “where insurable by law”.
As such, a prevalent practice emerging from negotiations in technology contracts is that of linking the contractual liability cap to its own insurance or the supplier’s insurance limit.
On the face of it, this may be perfectly reasonable in the commercial sense. If the contractual liability cap says R10 million and the supplier has R10 million of insurance cover, surely the customer is protected up to R10 million? Well… not necessarily. For example, two policies might each have R10 million of cover, yet provide vastly different levels of protection:
Policy A may provide R10 million for any one claim, which operates very differently from Policy B that provides R10 million in the aggregate for the entire policy period. If the supplier suffers several cyber incidents during the year, each claim could reduce the amount of insurance that remains available. By the time your incident occurs, there may be considerably less than R10 million left. The devil is always in the detail.
Then there are legal and investigation costs. Responding to a cyber incident can be expensive and may require a host of lawyers, forensic investigators and other specialists to be brought in before anyone even knows the full extent of the damage. If these costs are taken from the same R10 million insurance limit, the amount available to pay the actual claim can quickly shrink.
Exclusions. There is also the matter of exclusions. A policy may contain exclusions for particular types of cyber incident, infrastructure failures, indemnities provided in contracts, war or state-sponsored activity, sanctions and other circumstances. The contract may impose liability for the event, while the insurance policy excludes it. In this case, provided that the cap is drafted as a fixed amount, the contractual cap has not disappeared. Rather, it is the insurance protection that was supposed to stand behind that liability that has disappeared. More importantly, your contract wording needs to align to your insurance wording and caveats.
That is why we review your contract terms against your insurance terms. An insurance-linked liability cap should never be drafted by looking at the headline insurance amount alone. Before signing an agreement with an insurance-linked liability cap, you should establish:
1. Is it R10 million per claim or R10 million for all claims combined?
2. Do legal, forensic and investigation costs reduce that limit?
3. Are there sub-limits for cyber or privacy claims?
4. What happens if the relevant loss is excluded from the policy?
5. What happens if the insurance is cancelled, not renewed or otherwise unavailable? 6. Does the policy exclude liability assumed under contract?
7. What are the exclusions?
What to do about it
Where an insurance-linked liability cap is proposed, careful drafting can go a long way towards closing the gap. The aim is a cap that stands on its own, so the customer’s protection doesn’t rise or fall with an insurer’s decision, together with ongoing visibility of the supplier’s cover and clear treatment of the liabilities that should never be limited by the level of insurance. Getting this right depends on reading the contract and the policy together.
Contractual liability and insurance should therefore be considered together with the policy limits, exclusions and claims process, and carefully aligned with the risks being allocated. Because when the dog bites, the bee stings and the hackers strike, it is too late to discover that the protection you thought you had was never quite what it seemed.
At ZS Attorneys, we review insurance policies alongside the contracts they are meant to support, so that the cover matches the risk.
For more information, please contact Zinta Strydom, Managing Director.
To download:
Comments