Costly Mistakes and Official Sources
Does CGL cover a data breach? The cyber and privacy gap for Canadian businesses
Why a standard Canadian CGL policy rarely covers a privacy breach, what PIPEDA and Quebec's Law 25 require after an incident, what cyber insurance covers, and a worked breach cost example.
Usually not. Commercial general liability (CGL) policies in Canada typically exclude electronic data and, in many current wordings, the access or disclosure of confidential or personal information, and they never cover your own breach response costs. After a breach, a business may have to investigate, notify individuals and the privacy regulator under PIPEDA or, in Quebec, Law 25, restore systems and defend claims. Those costs belong to a cyber or privacy liability policy, and transfers tricked out of your bank account usually need crime or social engineering cover. Check your CGL wording for data exclusions, then decide whether the risk justifies a cyber policy.
This guide is part of the costly business insurance mistakes section. Figures are illustrative.
What the CGL does and does not do
| Event | CGL? | Where cover usually sits |
|---|---|---|
| A hacker steals customer records | Usually no | Cyber: breach response and privacy liability |
| Ransomware locks your systems | No | Cyber: extortion, data restoration, business interruption |
| An employee emails a client list to the wrong person | Usually no, under data disclosure exclusions | Cyber: privacy liability |
| A fake supplier email diverts a payment | No | Crime or social engineering cover |
| Your software error corrupts a client's data | No; it is a professional error | Technology E&O, often combined with cyber |
| Your advertising uses someone's photo without consent | Possibly, under personal and advertising injury | CGL coverage B, subject to exclusions |
| A laptop with unencrypted data is stolen from a car | Laptop itself under property; data breach costs not under CGL | Property plus cyber |
The personal and advertising injury part of a CGL may refer to the publication of material that violates a person's right of privacy. Many insurers have added exclusions so that this does not extend to data breaches. Read your policy's exclusions list rather than assuming either way.
What the law requires after a breach
| Rule | Who it applies to | Key obligation |
|---|---|---|
| PIPEDA (federal) | Private-sector organizations handling personal information in commercial activity, except where a substantially similar provincial law applies | Report breaches creating a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notify affected individuals, keep records of all breaches for 24 months |
| Quebec's Law 25 | Businesses collecting personal information in Quebec | Report confidentiality incidents presenting a risk of serious injury to the Commission d'accès à l'information and to affected persons; keep an incident register |
| Alberta PIPA | Private-sector organizations in Alberta | Notify the Alberta privacy commissioner of breaches with a real risk of significant harm |
| British Columbia PIPA | Private-sector organizations in BC | Privacy obligations; check the BC commissioner for current breach requirements |
| Health privacy laws | Health custodians in several provinces | Separate breach rules, for example under Ontario's health information law |
Quebec's Law 25 also introduced administrative monetary penalties and penal fines that can be substantial. Whether fines and penalties can be insured depends on the law and the wording; many policies cover them only "where insurable by law".
What a cyber policy usually covers
First-party costs (your own losses):
- breach response: forensic investigation, legal advice, notification, call centre, credit monitoring
- data restoration and system repair
- business interruption from a network outage
- cyber extortion, including negotiation, subject to legal limits
- crisis communications
Third-party liability:
- privacy and security liability claims by affected individuals or clients
- regulatory investigations and defence, and penalties where insurable
- payment card industry assessments, sometimes as a sub-limit
- media liability for online content
Policies differ widely in sub-limits for ransomware, social engineering and business interruption, in waiting periods before business interruption is paid, and in security requirements such as multi-factor authentication and backups. Insurers commonly ask about these controls on the application, and misstating them can affect a claim; see disclosure and misrepresentation.
Worked example: a small breach
An illustrative Toronto physiotherapy clinic discovers that an attacker accessed its booking system, exposing records of about 4,000 patients.
| Cost | Illustrative amount |
|---|---|
| Forensic investigation | $28,000 |
| Breach lawyer and regulatory reporting | $18,000 |
| Notification letters and call centre | $9,000 |
| Credit monitoring for those who accept it | $14,000 |
| Lost revenue while the system was offline | $11,000 |
| Defence of a claim by affected patients | $40,000 |
| Total | $120,000 |
Under the clinic's CGL: probably nothing, given its data exclusion. Under an illustrative cyber policy with a $500,000 aggregate limit, a $5,000 retention and a 12-hour waiting period for business interruption: the clinic pays the $5,000 retention plus any revenue loss within the waiting period, and the policy pays most of the rest. Health information may also trigger obligations under the provincial health privacy law and the regulatory college's rules.
Deciding whether you need cyber insurance
Consider it seriously if you:
- hold personal information about customers, patients, students or employees
- take card payments or online orders
- depend on systems you cannot run without for more than a day
- pay suppliers by electronic transfer on email instructions
- have contracts that require cyber cover
Before buying, ask the broker to explain each sub-limit, the retention, the waiting period and the security conditions, and compare at least two quotes. The quote preparation checklist covers the general process. Cyber policies are claims-made, so the retroactive date matters when you switch insurers; see claims-made gaps. For the wider set of privacy and other rules to re-check this year, see business insurance rules to check in 2026.
Frequently asked questions
My IT provider handles security. Am I still responsible for a breach?
Under privacy law, the organization that controls the personal information generally remains accountable, even if a service provider was involved. You may have a claim against the provider, but that does not remove your obligations.
Does cyber insurance pay ransoms?
Some policies cover extortion payments subject to legal restrictions, including sanctions laws, and insurer consent. Many insurers now expect strong backups and controls instead.
Is a small business really a target?
Automated attacks do not choose by size. The question is whether you could absorb the costs listed above without insurance.
Can I add cyber cover to my package policy?
Some insurers offer a cyber endorsement with modest limits. Compare its sub-limits with a standalone policy before deciding.
Sources
- Office of the Privacy Commissioner of Canada — PIPEDA breach reporting
- Commission d'accès à l'information du Québec — Law 25 confidentiality incident reporting
- Office of the Information and Privacy Commissioner of Alberta — breach notification under Alberta PIPA
- Canadian Centre for Cyber Security — guidance on security controls for small organizations
- Insurance Bureau of Canada — cyber insurance information
