Many small business owners assume their general liability (GL) policy will protect them if they get hacked. After all, it’s your main business insurance, and it covers “liability.” Unfortunately, that assumption is one of the most common and costly mistakes in small business insurance.
In most cases, a standard general liability policy does not cover cyber attacks, data breaches or ransomware. Some policies provide a small amount of limited protection, but it’s rarely enough to handle a real incident.
This guide explains why GL falls short, which parts of your insurance might respond to a cyber event, and how to close the gap. If you’re new to the topic, start with what cyber insurance is and what it covers.
The Short Answer
General liability insurance was designed for physical-world risks: a customer slips in your store, your contractor damages a client’s property, or an advertisement leads to a claim. It wasn’t built for digital incidents.
Most modern GL policies include exclusions for data breaches and electronic data. That means the costs that matter most after a cyber attack, such as forensics, data recovery, notification and lost income, usually fall outside the policy.
What General Liability Insurance Covers
A standard commercial general liability (CGL) policy typically covers claims from third parties in three areas:
- Bodily injury: someone is physically hurt because of your business operations.
- Property damage: you or your employees damage someone else’s physical property.
- Personal and advertising injury: claims such as libel, slander, copyright infringement in your advertising or invasion of privacy.
Notice what’s missing: your own losses, digital assets and the response costs of a security incident.
Why GL Usually Doesn’t Cover Cyber Attacks
1. Data Isn’t “Tangible Property”
Property damage coverage generally applies to physical, tangible property. Many policies define electronic data as not being tangible property, so corrupted files, encrypted systems or stolen databases don’t qualify.
2. Data Breach Exclusions
Many insurers add specific exclusions for liability arising from access to or disclosure of confidential or personal information and data-related liability. These are common in standard policies, and they target the very claims that follow a breach.
3. It Doesn’t Cover Your Own Losses
GL is third-party liability insurance. It responds when someone else makes a claim against you. Cyber attacks create large first-party costs, such as investigation, restoration and downtime, that GL doesn’t address at all. For an explanation of the difference, read First-Party vs. Third-Party Cyber Coverage: What’s the Difference?
4. No Incident Response Support
Cyber policies usually give you access to forensic experts, breach lawyers and a 24/7 hotline. GL doesn’t include that help, and in a crisis, knowing whom to call can save days.
Could Any Part of GL Respond?
In limited situations, parts of a general liability policy might come into play:
- Personal and advertising injury. A claim that your website or social media content invaded someone’s privacy or infringed their copyright might fall under this coverage. However, data breach exclusions can still apply.
- Physical damage caused by a cyber event. If a cyberattack leads to bodily injury or damage to physical property, a GL policy may respond, depending on the wording and any exclusions.
- Business owner’s policy (BOP) add-ons. Some BOPs include a small extension for electronic data or limited data breach expenses. The limits are often low and the coverage narrow, so confirm the details.
Don’t rely on any of these without reading the actual wording. Ask your broker to confirm in writing what your current policies do and don’t cover.
What About Other Business Insurance?
Commercial Property Insurance
Property policies cover physical loss to buildings and equipment. They generally don’t cover digital losses, although a cyber attack that physically damages hardware can raise questions. Business interruption coverage in a property policy usually requires physical damage as the trigger, which a ransomware attack typically isn’t.
Professional Liability (E&O)
Professional liability covers claims that your advice or services caused a client financial loss. It may respond if a client says your error led to a breach, but it generally doesn’t pay for your own incident response. If you sell technology services, see Cyber Liability Insurance vs. Tech E&O: Which One Do You Need?
Crime Insurance
Commercial crime policies can cover employee theft and some forms of fraud, but they often exclude or limit losses from tricking employees into sending money electronically. Social engineering coverage is more commonly found in cyber policies. Learn more in Business Email Compromise Coverage: What to Look for in a Policy.
General Liability vs. Cyber Insurance
| General Liability | Cyber Insurance | |
|---|---|---|
| Designed for | Physical injuries, property damage, advertising claims | Data breaches, ransomware, online fraud |
| Pays for your own losses? | No | Yes, through first-party coverage |
| Covers data recovery and forensics? | Generally no | Yes |
| Covers business interruption from a cyber event? | Generally no | Yes, often with a waiting period |
| Covers customer notification and credit monitoring? | Generally no | Yes |
| Includes breach response team? | No | Often yes |
| Covers privacy lawsuits after a breach? | Often excluded | Yes |
A Realistic Example
Imagine a dental practice with a standard GL policy and a BOP. An employee opens a phishing email, and attackers steal patient records. The practice must hire forensic specialists, notify patients, offer credit monitoring, handle a regulatory inquiry and close for several days.
- The GL policy: denies coverage because of the data breach exclusion and the fact that no bodily injury or property damage occurred.
- The BOP: may offer a small data breach sublimit, which doesn’t come close to the total cost.
- A cyber policy: would cover forensics, notification, legal costs, lost income and potential claims, subject to limits and conditions.
For the industry details, see Cyber Insurance for Dental Practices: What You Need to Know.
How to Close the Gap
- Review your current policies. Ask your broker to point out every cyber-related exclusion or endorsement in your GL, BOP, property and E&O policies.
- Get a standalone cyber quote. A dedicated policy is the most reliable way to cover digital risks. Start with How to Get Cyber Insurance Quotes Online in 15 Minutes.
- Choose limits that fit your exposure. Use How Much Cyber Insurance Coverage Do You Need? as a guide.
- Check the exclusions. Even cyber policies have gaps, as explained in What Does Cyber Insurance Not Cover? 12 Common Exclusions.
- Put basic security controls in place. MFA, tested backups and employee training help you qualify and can lower your premium.
What Does Cyber Insurance Cost?
Many small businesses pay somewhere between a few hundred and a few thousand dollars a year for a standalone policy, depending on industry, revenue and security. For ranges and the factors that move them, see How Much Does Cyber Insurance Cost for Small Businesses in 2026?
Frequently Asked Questions
Does general liability cover a data breach?
Usually not. Many standard GL policies exclude data breaches and electronic data liability, and they don’t cover your own response costs. Some policies provide narrow protection, so check your wording.
Does general liability cover ransomware?
Typically no. Ransomware causes digital losses such as locked data and downtime, which GL isn’t designed to cover. Ransomware coverage is usually found in cyber policies, often with sublimits.
Does a business owner’s policy (BOP) cover cyber attacks?
Sometimes, in a very limited way. Some BOPs include a small extension for electronic data or breach expenses, but the limits are usually too low for a significant incident.
Is cyber insurance an add-on to general liability?
It can be offered as an endorsement, but standalone cyber policies generally provide much broader coverage and higher limits. Ask your broker to compare both.
Can I rely on my GL policy if my website is accused of copyright infringement?
Possibly. Personal and advertising injury coverage in a GL policy can respond to certain content-related claims. Cyber policies with media liability coverage may also help. Review the wording of each.
The Bottom Line
General liability insurance is essential, but it isn’t designed for cyber attacks. If your business stores customer data, takes payments online or depends on its systems, a standalone cyber policy is the dependable way to cover those risks.
Check your existing policies, close the gaps and compare options. When you’re ready to look at providers, see Best Cyber Insurance for Small Business: 10 Providers Compared.
Disclaimer: This article is for general information only and is not insurance, legal or financial advice. Policy terms vary by insurer and state. Review the actual policy wording and consult a licensed insurance professional before making a decision.