Regulatory-Fines Insurability Map
“Does cyber insurance pay regulatory fines?” has no single answer — it depends on the regime and, above all, on whether the law of the relevant place even permits insuring a penalty. Many jurisdictions treat insuring punitive penalties as against public policy. Here is the general lay of the land, with the recurring rule that defense costs are far more reliably covered than the fine itself. Directional and educational — not legal or insurance advice.
What this map shows
- "Does cyber insurance pay regulatory fines?" has no single answer — it depends on the regime and whether the law even permits insuring a penalty.
- A directional map across GDPR, UK ICO, US state AG/CCPA, HIPAA, BIPA and PCI, each marked often insurable / varies / rarely, with the reason.
- Two rules travel across regimes: defense costs are far more insurable than the penalty, and most policies only pay fines "where insurable by law".
- Directional and educational — jurisdiction- and wording-dependent; not legal or insurance advice.
Why this matters
A regulatory fine is often the scariest line in a breach’s aftermath, and buyers assume the cover they bought for "regulatory defense and penalties" simply pays it. It frequently does not — because whether a penalty can be insured at all is a question of public policy decided by the jurisdiction, not the insurer, and most policies quietly condition the promise on being "insurable by law".
Knowing which regimes are reliable, which are contested, and that the defense is more coverable than the penalty lets you set realistic expectations and press for the right extensions (like PCI). Directional and educational, not legal or insurance advice.
Frequently asked questions
Are regulatory fines covered by cyber insurance?
Sometimes, partially, and it depends heavily on where the fine is imposed. Many jurisdictions treat insuring a punitive or penal fine as contrary to public policy, so even a policy that offers "regulatory defense and penalties" cover usually promises to pay the penalty only "where insurable by law" — which hands the hard question back to the local law. What is far more reliably covered is the cost of defending the regulatory action (lawyers, responding to the investigation), as distinct from the penalty itself. So the realistic expectation is: defense generally yes, penalty maybe, depending on the regime and wording.
Are GDPR fines insurable?
It is genuinely unsettled and varies across EU member states. Some regulators and commentators consider insuring administrative GDPR fines to be against public policy (the deterrent effect is undermined if an insurer pays), while the position differs by country and has not been uniformly tested. The safer assumption is that the fine itself may not be insurable even where a policy appears to offer it, while the defense and response costs are more defensible. The same uncertainty applies to UK GDPR / ICO fines. Treat any "we cover GDPR fines" statement as conditional on local law.
Why are PCI fines treated differently?
Because PCI DSS "fines" are not government penalties — they are contractual assessments levied by the card brands and your acquiring bank under your merchant agreement when card data is compromised. Contractual amounts do not raise the same public-policy objection as statutory penalties, so cyber policies commonly cover them under a specific "PCI fines and assessments" extension, usually with its own sub-limit. If card payments are core to your business, confirm that extension exists and that its sub-limit is adequate, because PCI assessments after a card breach can be substantial.
Is this legal or insurance advice?
No. It is a directional, educational map of how regulatory fines tend to be treated for insurability, to help you ask the right questions. Insurability of penalties is highly jurisdiction-specific, fast-moving and wording-dependent, and nothing here states the law of any particular place. Confirm the position for your regimes with coverage counsel and your broker, and read the "where insurable by law" language in your own policy.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.