You have a client's customer list in a spreadsheet, their login in your password manager and three months of project files on your laptop. Then the laptop is stolen, or a phishing email gets you to hand over a password, and their data is out. Most freelancers assume their contract or their professional indemnity policy will handle it. Neither is built for that, and cyber insurance for freelancers holding client data is the product that is.
This post explains what a cyber policy usually pays for, how it differs from professional indemnity cover, what the common exclusions are and how India's new data protection rules fit in. It does not tell you to buy one. It gives you the questions to ask so you can decide for yourself.
What cyber insurance covers for a freelancer
A cyber policy typically pays for two kinds of loss. The first is your own cost after an incident: restoring systems after malware, handling a breach, and sometimes losses from identity theft or phishing and spoofing. The second is a claim from someone else, such as a client whose data leaked through you. Wording and sub-limits vary by insurer, so what one policy covers another may not.
Breach-related costs commonly include notifying the people affected, legal help and public relations support. Read the policy schedule, not the brochure, because the headline sum insured is often split into smaller limits for each type of loss.
How it differs from professional indemnity cover
Professional indemnity (PI) cover responds when your work or advice causes a client a financial loss. Cyber cover responds when data is stolen, leaked or locked. The two overlap at the edges, and some PI policies exclude data incidents entirely, so one does not stand in for the other. Search each policy for the words "data", "breach" and "cyber" in the exclusions. If a PI policy lists them as excluded, you have no data cover under it. Developers and IT consultants can read how tech PI policies treat data breach.
Our guide to professional indemnity insurance for freelancers covers the mistake side. A contract clause that caps your liability does not pay a claim either. It only limits how large a claim can get, which the guide on limitation of liability and indemnity clauses explains.
Ransomware and breach notification costs
Ransomware cover is the part that varies most. Some policies pay for restoration and expert response, while others offer only expert support and nothing towards the ransom itself. Breach notification, legal and PR costs are the usual inclusions. Ask the insurer exactly what happens in a ransomware case before you rely on the policy for it.
Do not treat any premium or sum insured you see quoted online as typical. Pricing differs by insurer, cover limit and your profile, so no single premium is typical. Ask for a written quote for your own situation.
Common exclusions to look for in the wording
The exclusions that appear most often are attacks that happened before you bought the policy, losses linked to negligence or a lack of basic precautions, breaches of unencrypted data, war and terrorism, and intentional acts. The negligence and encryption wording matters most to a freelancer, because a claim can be refused if the insurer decides you skipped reasonable safeguards.
That turns routine habits into a coverage question. A laptop with no disk encryption, a shared password for client accounts or no two-step verification gives an insurer a reason to push back. Read the exclusions page first and the benefits page second.
The DPDP Act and Rules 2025: timeline and what it means for you
India's Digital Personal Data Protection Rules were notified on 13 November 2025, with a phased start. The Data Protection Board provisions took effect immediately. Consent manager provisions are scheduled for about 13 November 2026, and most other duties, covering notice and consent, security safeguards, breach intimation and the rights of individuals, are scheduled for about 13 May 2027. A proposal to cut the 18-month period was floated in January 2026, and as of October 2026 no amendment has been notified. Check the MeitY site for the current dates.
If you process personal data for a client, the client usually decides why and how it is used and you work under their instructions. Ask a lawyer how the Act treats your role before you sign data terms. What you can do now is read your contracts. Expect clients to ask for data-handling and breach-reporting terms. The freelance NDA guide covers the confidentiality side.
Do you need cyber insurance?
No rule makes a freelancer buy cyber cover, and a policy is not a substitute for good security. Whether it is worth it depends on what you hold, what your contracts say and what your clients ask for. A copywriter who only touches published web pages has little to lose. A bookkeeper or developer with access to customer records has a lot more.
Ask yourself what client data sits on your devices, whether any of it is personal data about customers, whether a contract makes you responsible for a breach, and whether a client has asked for proof of cover. If the answers are mostly no, spend the effort on security habits first.
What to do before buying
Start with the contract. Check who owns the data, what security you promise, how fast you must report a breach and whether your liability is capped, and use the freelance contract guide as a checklist. Then fix the basics: encrypt your laptop, use a password manager, switch on two-step verification and keep client files out of personal chat apps.
Only then ask insurers or a licensed adviser for quotes, and send each the same facts so the answers compare. Ask what is covered, the sub-limits, the exclusions, any waiting period and how a claim is made. Check whether the policy covers only incidents that happen after it starts, since buying one after a breach will not help.
Keep the paperwork that proves your side
Keep the signed contract and any written instruction from the client. After an incident you must show what data you held, on whose instruction and under which contract. Rinto lets you send a contract for e-signature (a Pro feature), and once the client signs, the project is created automatically with the details pre-filled, so the signed terms sit next to the work. Rinto does not sell or advise on insurance and does not track which data you hold. This post is general information, not insurance or legal advice. Dates are as of October 2026.
Frequently Asked Questions
Do freelancers in India need cyber insurance?
No rule makes cyber insurance compulsory for a freelancer. Whether to buy it is a business decision based on the data you hold and what your contracts require. If you only work with public or low-risk material, careful habits and a clear contract may be enough for now. If you handle customer records, logins or financial files for clients, a breach could cost more than you can absorb, and some clients may ask for proof of cover. Read your client agreements first, then ask an insurer or a licensed adviser what suits your situation, because cover and wording differ between policies.
What does cyber insurance cover for a freelancer?
Policies typically cover breach response costs such as notifying affected people, legal help and public relations support, restoration after malware, and sometimes identity theft or phishing and spoofing losses. Many also cover claims from third parties whose data was exposed through you. Not every policy includes every item, and each type of loss usually has its own sub-limit under the headline sum insured. For example, a stolen laptop may be covered for restoration but only up to a lower sub-limit for legal costs.
Is ransomware covered by cyber insurance in India?
It depends on the policy. Some cover restoration and expert response, while others offer only expert support and nothing towards a ransom demand. Cover can also be limited by a sub-limit or refused if basic precautions were missing. Because this is the area where policies differ most, do not assume it is included. Ask the insurer to explain in writing what happens if your files are locked, what is paid, what is not and which security measures the policy expects you to have in place before it will pay out a claim.
Does the DPDP Act apply to freelancers who handle client data?
Yes, if you process digital personal data for a client, such as customer lists and contact details you hold for them. The Rules were notified on 13 November 2025, and most duties are scheduled for about 13 May 2027. The client usually decides how the data is used and you work under their instructions, so expect data terms in your contracts. Ask a lawyer how the Act treats your role. No amendment to the timeline had been notified as of October 2026.
What is the difference between cyber insurance and professional indemnity insurance?
Professional indemnity responds when your work or advice causes a client a financial loss. Cyber insurance responds when data is stolen, leaked or locked, including your own recovery costs and claims from people affected. They are different products, and a liability cap in your contract does not pay a claim under either. Some PI policies exclude data incidents altogether, so check the wording of each policy rather than assuming one covers both. If you handle sensitive client data and also give advice, ask an insurer or licensed adviser whether you need both.