An employee of an accounting firm leaves their laptop on the train, with the payroll data of two hundred clients on it. A webshop sends out its newsletter with the wrong settings, with every recipient's e-mail address visible. A medical practice assistant hands test results to another patient with a similar name. These are not hacker attacks, yet they are all personal data breaches, and each sets off the same cost ladder: expert, lawyer, notification of the authority, informing the people affected, regulatory proceedings, the data subjects' claims – and possibly a fine at the end. As a broker, what I see is that SMEs equate cyber insurance with ransomware, and as for regulatory fines, they believe either that these are covered as a matter of course or that they are excluded from the outset. Neither is true. This article goes through the costs of a breach one by one and shows which cover applies to which step of the ladder – and where the question of the fine stands.
- The cost of a personal data breach does not start with the fine: notifying the authority and informing data subjects under Articles 33–34 of the GDPR, IT and legal experts, the regulatory proceedings and data subjects' compensation claims under Article 82 all cost money before any fine – this is what cyber or data protection liability insurance is for.
- Whether a regulatory fine can be insured is legally unclear: on the Hungarian market there are policy conditions that also cover fines, but typically only with a “where and to the extent permitted by law” proviso, with a sublimit and excluding intentional infringements – other conditions exclude fines; you have to read this line in your own policy.
- General and professional liability insurance often exclude data protection losses, and legal protection insurance covers the cost of regulatory proceedings only if its conditions extend to them – it is worth putting the three policies side by side before relying on any of them.
The cost ladder of a breach
Under Article 33 of the General Data Protection Regulation (GDPR), the controller notifies the breach to the supervisory authority – in Hungary, the National Authority for Data Protection and Freedom of Information (NAIH) – without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the data subjects. Under Article 34, if the breach is likely to result in a high risk, the data subjects must also be informed. Money comes into play already at this stage: who establishes what happened and whom it affects (IT forensic investigation), who drafts the notification and the communication to data subjects (lawyer), and how it reaches two hundred or twenty thousand people (letter, e-mail, customer service). Then regulatory proceedings may follow, in which the company has to make statements, provide documents and possibly pay for legal representation. Under Article 82, any person who has suffered material or non-material damage as a result of an infringement of the data protection rules is entitled to compensation from the controller or the processor – with a large customer base this means many small claims, with a medical practice a few serious ones. And only at the top of the ladder stands the fine: under Article 83, up to EUR 20 million or 4% of total worldwide annual turnover (whichever is higher) for the more serious infringements, and up to EUR 10 million or 2% for the less serious ones. In Hungarian practice, the amounts imposed on SMEs are much smaller than this, but in 2026, too, the news reported fines of several tens of millions of forints – and for an SME, the lower steps of the ladder together often cost more than the fine itself.
Can the fine be insured?
This is the most frequently asked and least clear-cut point. It is a general principle of insurance law that the consequences of an intentional infringement cannot be insured, and it is disputed whether a regulatory sanction – whose very purpose is to punish the infringer – can be shifted onto an insurer without losing its purpose. To my knowledge, there is no explicit Hungarian rule on this, either prohibiting or permitting it, so Hungarian policy conditions are cautiously worded. On the market there is data protection liability insurance that, according to its product description, also extends to regulatory fines; according to the policy conditions, such cover typically works only with a “where and to the extent permitted by law” proviso, with a separate sublimit, and with deliberate or repeated infringements, or infringements continued even after a warning from the authority, excluded. Other insurers' cyber insurance simply excludes fines, or covers only the legal costs of the regulatory proceedings, not the fine. The practical consequence: if fine cover matters to the company, it has to find it in the policy in so many words, together with the sublimit and the exclusions – a general “costs of regulatory proceedings” line is not the same thing. And even conditions that do cover fines do not give what most people hope for: none of them pays the penalty for deliberately improper data handling.
Which cover applies to which step?
Cyber insurance works in two directions: on the company's own loss (incident response, forensics, restoration, business interruption, extortion) and on damage caused to third parties. The data protection ladder is the second direction: the cost of notifying data subjects, the legal costs arising in the regulatory proceedings, data subjects' claims for compensation and for non-pecuniary damages (sérelemdíj), and, under some policy conditions, the fine. GDPR or data protection liability insurance also exists as a stand-alone product that covers only this second direction, not the restoration of your own systems – this may be enough where there is a lot of data but few systems. General liability insurance, by contrast, covers property damage and bodily injury, and Hungarian policy conditions typically exclude data protection losses; and professional liability insurance (accountant, lawyer, doctor, consultant) varies from insurer to insurer as to whether a leak of client data falls within professional error or is a separate exclusion. Legal protection insurance pays for the company's own legal defence – lawyer, expert, procedural fees – but whether regulatory data protection proceedings are included is a matter of the policy conditions; several Hungarian policy conditions cover administrative proceedings narrowly or not at all. So in a breach, it is worth putting the pages of three policies side by side and looking at where there are gaps and where there is overlap – not at which one is “better”.
Not just hackers: what the policy conditions require
The examples above are “analogue” breaches, and policy conditions pay attention to these as well. Hungarian cyber and data protection covers typically stipulate, or at least ask in a questionnaire, whether portable devices are encrypted, whether there is access management and logging, whether staff have received training and whether there is a written incident response procedure. Under some policy conditions, the loss of an unencrypted laptop is excluded from the outset; under others, the insurer may be released from paying if a measure undertaken when the policy was taken out was missing – the burden of proof is on the insurer, but the dispute can be avoided. Your answers to the questionnaire fall under the duty of disclosure: anything that is not true when the policy is taken out can come back to haunt you in a claim. The time structure of the cover also matters: liability-type covers are typically tied to the date the claim is made, so they apply to breaches that occurred before the policy was taken out only if the conditions provide retroactive cover – this is worth clarifying when you take out the policy. The equipment boundary described in the home office article is also a data boundary here: the company is responsible for the data on a company laptop used at home, wherever it was lost.
What should you do now?
List what personal data you process, where you store it and who has access to it – this data inventory is the basis of GDPR compliance, and it is also what the insurer's questionnaire asks about. Draw up a short incident response plan: who decides, whom to call, how the 72-hour notification works; the guidance for SMEs published by the NAIH and the European Data Protection Board is a good starting point for this. Encrypt portable devices – this is the simplest form of loss prevention. Take out your existing policies and check whether data protection losses, regulatory proceedings and fines are excluded, sub-limited or covered in them. If you request quotes, compare the fines line, the limit for notification costs, the handling of legal costs and the retroactive cover – not just the premium. If you contact me with this list, I prepare the comparison of the offers and the paperwork – the decision is yours.
A question tailored to your own data processing and policies? Book a free 20-minute consultation →
Sources
- Articles 33, 34, 82 and 83 of the General Data Protection Regulation (EU) 2016/679 (GDPR)
- European Data Protection Board – Data breaches (guidance for SMEs)
- Act CXII of 2011 on the right to informational self-determination and on freedom of information (Infotv.) – NAIH procedures
- Colonnade Biztosító – More and more regulatory fines show the need for GDPR insurance (insurer news item, May 2019; mentions cover that also extends to fines, but not the wording of the conditions or the provisos)
- hvg.hu – NAIH fines Mediaworks HUF 50 million (May 2026; an example of the order of magnitude of fines)
