Your General Liability Policy Will Not Pay for a Breach

The most expensive assumption a California business can make is that its existing policies handle cyber incidents. They don't. General liability covers bodily injury and property damage — and modern GL policies explicitly treat data as intangible property and exclude breach costs, ransomware, and privacy liability. Business owners' policies do the same.

Cyber liability insurance is the policy built for that exposure. And California businesses have more of that exposure than businesses almost anywhere else in the country. Here's why, and what to know before buying.

Why California Businesses Are Exposed Twice

First, the attack surface. Automated attacks don't check company size or industry. Phishing, credential stuffing, and ransomware hit small businesses constantly — precisely because attackers assume weaker defenses. A five-person online store with a compromised password faces the same response costs as a large company.

Second, the law. California stacks two legal obligations on any business that suffers a breach:

  • The data breach notification law (Cal. Civ. Code 1798.82) requires you to notify every affected California resident promptly after a breach of personal information. At scale, notification alone — letters, call centers, credit monitoring — runs to six figures.
  • CCPA/CPRA gives consumers a private right of action with statutory damages when their unencrypted personal information is breached due to unreasonable security. A single incident affecting thousands of records can multiply into serious class-action exposure, plus regulatory penalties from the California Privacy Protection Agency.

So a California breach isn't just an IT problem. It's a legal event with statutory deadlines — and uninsured costs land directly on the balance sheet.

What Cyber Liability Actually Covers

A well-built cyber policy has two sides:

First-party coverage — paying for your own losses:

  • Forensic investigation to determine what happened and what data was affected
  • Customer notification, credit monitoring, and call-center support required by law
  • Business interruption — lost income while your systems are down, including contingent interruption when a critical vendor or cloud provider goes down
  • Ransomware response — negotiation specialists, and where appropriate, extortion payment, plus system restoration
  • Data restoration — rebuilding corrupted or destroyed data

Third-party coverage — paying for claims others bring against you:

  • Privacy liability — customers and clients suing over exposed personal information
  • Network security liability — claims that your compromised systems spread malware or enabled fraud against others
  • Regulatory defense and penalties — including defense of CCPA/CPRA enforcement actions
  • Media liability — defamation and copyright claims in your online content

Many carriers also include a breach-response retainer: a pre-vetted forensics firm, notification vendor, and counsel you can activate the day an incident happens. For a small business, that bench alone is worth a large share of the premium — assembling those vendors in a crisis, uninsured, is the part nobody plans for.

What Cyber Insurance Does Not Cover

Read these exclusions before you buy — they're where claims go wrong:

  • Problems you knew about. Unpatched systems, disabled MFA, or known vulnerabilities that were never fixed can void coverage. Carriers increasingly require baseline controls.
  • Fraudulent funds transfers, sometimes. Social-engineering fraud — an employee tricked into wiring money — is covered under some cyber policies and excluded under others, or needs a separate crime-policy endorsement. This is one of the most commonly misread areas.
  • Your own sloppy contracts. If you contractually promise security outcomes you can't deliver, the warranty exclusion may apply.
  • Future lost profits beyond the policy period. Business-interruption coverage has a defined window; check it.

What It Costs — and What Makes the Price Move

For small California businesses, cyber premiums typically run roughly $500 to $5,000 per year depending on revenue, the type and volume of data handled, industry, and chosen limits — commonly $250,000 to $1 million or more for small and mid-size firms.

The price is unusually sensitive to your security posture. Controls that reliably reduce quotes:

  • Multi-factor authentication on email and remote access
  • Offline or immutable backups tested on a schedule
  • Employee phishing training with records
  • An incident-response plan on paper
  • Endpoint detection software on all devices

Two businesses of the same size in the same industry can see meaningfully different quotes based on those controls. Carriers aren't just pricing the risk — they're pricing whether you'd survive an attack long enough for the response to matter.

The Checklist for California Businesses

1. Don't rely on GL or BOP for cyber. Check the exclusions yourself.

2. Get MFA and tested backups in place — both for the risk and the premium.

3. Match limits to your data. Customer PII, payment data, and health information all raise the right limit.

4. Read the social-engineering/funds-transfer line before you assume you're covered.

5. Know your vendor exposure. Contingent business interruption matters if your revenue depends on a cloud platform.

6. Compare real quotes. Cyber underwriting varies more between carriers than almost any other line.

Cyber Liability Guides for California Cities

Looking for a city-specific take? We publish short cyber liability guides for businesses in the largest California cities:

Each guide covers the same California breach-notification and CCPA exposure, what cyber policies pay for, what they exclude, and hedged pricing — with local FAQs and a path to a free quote.

How PRIA Fits In

PRIA Brokers is an independent California broker (CA License #0G81238, 25+ years) that compares cyber liability quotes across multiple A-rated carriers. We walk through first- and third-party coverage, social-engineering treatment, business-interruption windows, and breach-response services line by line — so you know what the policy actually pays before you need it.

Start with our online quote form or call (888) 998-7742.

Important

Cost figures in this article are illustrative and vary widely by business size, industry, security posture, and underwriting factors. They are not quotes or guarantees. This article is general information, not insurance or legal advice. Coverage is subject to policy terms, conditions, and exclusions. Policy language controls.