Our Expert in India
Cyber insurance technology contracts india have moved from a procurement afterthought to a central commercial lever as the Digital Personal Data Protection (DPDP) regime and India’s evolving intermediary rules sharpen breach-notification duties, fiduciary obligations and intermediary accountability. For in-house counsel, general counsel (GCs), procurement leads and vendor legal teams, the question is no longer whether to require insurance but how to draft clauses that convert regulatory exposure into enforceable risk transfer. This guide provides a practical clause bank, recommended coverage levels, a comparison of indemnity versus insurance, and detailed drafting notes on subrogation and waivers. The aim is simple: give commercial teams the specific contract language and negotiation levers needed to manage India’s regulatory landscape with confidence.
The combined effect of the Digital Personal Data Protection Act, 2023, the intermediary rules made under the Information Technology Act, 2000, and CERT-In’s incident-reporting directions is to raise the cost of a data incident for vendors and platforms operating in India. Where a contract once relied on a generic indemnity, sophisticated buyers now expect layered protection: an enforceable indemnity, an independent and primary insurance obligation, and endorsements that respond to regulatory defence costs and mandatory reporting. Three contractual levers do most of the work.
The sections below map each regulatory obligation to a contractual response, provide modular sample clauses with red/amber/green negotiation notes, and set out a procurement checklist for evidencing cover. This is general guidance and not legal advice; apply it with counsel to your specific transaction.
Any discussion of cyber insurance technology contracts india must begin with the statutory and regulatory architecture that generates the exposure. Four bodies of rules matter most: the Digital Personal Data Protection Act, 2023 as the primary data-protection statute; the intermediary rules made under the Information Technology Act, 2000 governing intermediaries and platforms; the operational reporting regime administered by the Indian Computer Emergency Response Team (CERT-In); and the prudential and product oversight of the Insurance Regulatory and Development Authority of India (IRDAI). Each shapes the covers and endorsements a buyer should demand, and each should be cited to primary source material rather than secondary commentary when framing contractual obligations.
Readers should note that, at the time of writing, the Digital Personal Data Protection Act, 2023 is being brought into force in stages and the detailed Rules under it are being finalised and notified. Contracts should therefore reference the Act and its rules as in force from time to time, and be reviewed as the operational detail is confirmed.
The Digital Personal Data Protection Act, 2023, available through the India Code central legislation repository, establishes the roles of data fiduciary and data processor and imposes obligations around purpose limitation, security safeguards and notification of personal data breaches to the Data Protection Board and affected data principals. For technology contracts this is consequential. A vendor acting as a data processor assumes defined security and cooperation duties, and a breach can trigger notification obligations and potential administrative consequences. Because the statute allocates accountability to the data fiduciary while the operational failure may sit with a processor, the contract must allocate that liability and ensure insurance responds to regulatory defence, investigation and remediation costs.
Rather than quoting specific penalty figures, drafters should reference the operative provisions of the Act and align indemnity and insurance scope to the categories of exposure the Act creates, defence costs, remediation, notification expense and third-party claims.
The intermediary rules made under the Information Technology Act, 2000, currently the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as amended, extend diligence, grievance-redressal and accountability duties to intermediaries and platforms, and the Ministry of Electronics and Information Technology (MeitY) publishes notifications and press material on this framework. For procurement teams, the practical effect is that a platform vendor may carry obligations whose breach produces both regulatory and reputational exposure. Where your supplier is an intermediary within the meaning of the Rules, the contract should require insurance that extends to regulatory defence and media or reputational harm, and should oblige the vendor to cooperate with your own compliance obligations.
Heightened intermediary accountability is making regulatory-defence endorsements a common procurement ask rather than a negotiated extra.
CERT-In administers India’s operational cyber-incident reporting regime and publishes directions and circulars, notably its directions issued under section 70B(6) of the Information Technology Act, 2000, setting out the categories of incident that must be reported and the technical reporting expectations, including timelines for reporting specified incidents. For contracting parties, the key point is timing and cooperation: a vendor must be contractually bound to detect, report internally and support the customer’s statutory reporting within the windows CERT-In prescribes. Insurance should back the cost of this response. A breach-notification endorsement and incident-response cover ensure that forensic, legal and notification costs are funded at the moment an incident is confirmed, rather than becoming a budget dispute mid-crisis.
Contracts should reference CERT-In’s directions as the operational standard and require the vendor to maintain logs and evidence consistent with those directions.
IRDAI regulates insurance product design, endorsement practice and insurer solvency in India. This matters for two reasons. First, the endorsements a buyer requires, waiver of subrogation, primary and non-contributory, cross-liability, must be capable of being issued under the Indian regulatory framework, and a prudent contract asks for the endorsement in writing from the insurer rather than a bare representation from the vendor. Second, where cover is placed with a foreign insurer, admissibility and local regulatory treatment become live issues. Referencing IRDAI guidance when specifying endorsement and evidence requirements keeps the insurance obligation grounded in what the Indian market can actually deliver, and reduces the risk of a clause that no compliant insurer will honour.
Together, these regimes explain why cyber insurance technology contracts india now require a deliberate mapping exercise: each regulatory duty should be traced to a contractual obligation and then to an insurance cover or endorsement that funds the exposure. The sections that follow carry out that mapping in practical, clause-level terms.
Buyers should not request “cyber insurance” as an undifferentiated line item. Modern technology exposures span data breaches, professional service failures, algorithmic harms and reputational damage, and these are addressed by distinct policies and extensions. Mapping the right policy to the right risk is the foundation of effective cyber insurance clauses India.
There is no universal figure for minimum coverage limits that DPDP exposure demands; limits must be calibrated to the sensitivity and volume of data, the criticality of the service and the realistic cost of regulatory defence, remediation and third-party liability. The table below offers indicative baselines for negotiation, not legal prescription. Buyers should test each limit against a worst-case scenario combining defence costs, notification expense, remediation and third-party claims, and should confirm current market pricing and capacity with a broker.
| Contract type | Indicative minimum limit (INR) | Priority endorsements |
|---|---|---|
| Enterprise SaaS (standard data) | Scaled to data volume and criticality | Breach notification; regulatory defence; waiver of subrogation |
| Cloud / infrastructure provider | Higher, reflecting shared-service impact | Contingent business interruption; primary & non-contributory; cross-liability |
| Platform handling sensitive personal data | Higher, scaled to data volume | Regulatory defence; media liability; breach notification |
| AI vendor (high-risk deployment) | Scaled to decision impact | AI/model risk extension; E&O; erosion-aware limits |
Whatever the limit, the endorsement set is what makes the cover fit the Indian regulatory context: a breach-notification endorsement (funding the CERT-In and DPDP response), a regulatory-defence extension, and a waiver of subrogation endorsement evidenced in writing. The next section translates these requirements into drafting language.
The clauses below are modular first-draft wordings intended for insertion into a schedule, statement of work (SOW) or insurance annex. Each carries an author note and a red/amber/green negotiation signal: green is customer-favourable and usually achievable; amber is a reasonable compromise; red is a position buyers should resist. These are templates to be validated against your transaction and primary regulatory sources, not off-the-shelf drafting.
(i) Insurance obligations, scope and minimum limits. “The Supplier shall, at its own cost, effect and maintain throughout the Term and for a period of [24] months thereafter: (a) cyber liability insurance (first- and third-party) with a limit of not less than INR [•]; (b) technology errors and omissions insurance with a limit of not less than INR [•]; and (c) where the Services include AI functionality, AI/model risk cover appropriate to the deployment.” Author note: define each cover by function, not just label, insurers interpret policy titles inconsistently. Green: supplier accepts named covers and stated limits. Amber: aggregate rather than per-claim limits. Red: “commercially available insurance” with no defined covers or limits.
(ii) Evidence and renewal. “The Supplier shall provide, prior to the commencement of Services and on each renewal, a certificate of insurance, copies of the relevant endorsements, and on reasonable request a letter from its insurer or broker confirming the scope and currency of cover.” Author note: a certificate alone proves little; require the endorsements. Green: certificate plus endorsements plus insurer letter on request. Amber: certificate plus endorsement summary. Red: self-certification only.
(iii) Endorsements, regulatory defence, breach notification, cross-jurisdictional cover. “The policies shall include, and the Supplier shall evidence by endorsement: (a) cover for regulatory investigation and defence costs arising under applicable data-protection law; (b) breach-notification and incident-response cost cover; and (c) where Services are delivered across borders, confirmation that cover responds to claims and regulatory action in India.” Author note: confirm with the insurer that each endorsement is issuable under IRDAI practice. Green: all three endorsed. Amber: regulatory defence and breach notification endorsed, cross-border confirmed by letter. Red: endorsements promised but not evidenced.
(iv) Insurance-backed liability cap. “Notwithstanding any limitation of liability in this Agreement, the Supplier’s liability for [data breach / regulatory] claims shall not be limited below the amount actually recoverable under the insurance required by Clause [•].” Author note: this ties the cap to real recoverability, giving the customer residual protection above a nominal cap. Green: cap uplifted to policy limit for specified claims. Amber: uplift for data-breach claims only. Red: single low cap covering all heads of loss including regulatory exposure.
(v) Subrogation and waiver. “The Supplier shall procure that its insurers waive all rights of subrogation against the Customer and its affiliates, save in respect of loss caused by the Customer’s fraud or wilful misconduct, and shall evidence such waiver by endorsement.” Author note: the carve-out protects the insurer’s legitimate recovery rights while shielding the customer from recovery actions after a vendor-side loss. Green: endorsed waiver with narrow carve-out. Amber: waiver subject to insurer consent. Red: no waiver offered.
(vi) AI model failure with erosion language. “Where the Services include AI functionality, the Supplier shall maintain cover responding to loss arising from erroneous, biased or non-conforming model outputs, and shall notify the Customer where the available limit is materially eroded by unrelated claims.” Author note: AI claims can be frequent and small, eroding aggregate limits before a major event; erosion notice gives the customer early warning. Green: dedicated AI extension plus erosion notice. Amber: E&O confirmed to respond to algorithmic harm. Red: silence on AI harm.
When negotiating AI insurance clauses, anchor the discussion in the risk profile of the deployment rather than the vendor’s standard policy. For low-risk automation, confirming that existing E&O responds to algorithmic error may suffice. For decision-making systems that affect individuals, credit, hiring, eligibility, press for a dedicated model-risk extension and erosion-awareness. International AI governance instruments, including the OECD AI Principles and the UNESCO Recommendation on the Ethics of Artificial Intelligence, provide a principled basis for requiring risk allocation around model harms, and referencing these frameworks in negotiation lends weight to a request that might otherwise be dismissed as unusual.
Each sample clause above should be inserted into the insurance annex or SOW and cross-referenced from the liability and indemnity provisions so the programme reads coherently.
Indemnities and insurance are complementary, not interchangeable. An indemnity is a contractual promise to make good a defined loss; insurance is a funded mechanism that pays claims subject to policy terms. A robust approach to indemnity vs insurance SaaS India treats them as parallel protections: the indemnity establishes the vendor’s contractual responsibility, while the insurance obligation ensures there is money behind that promise. The table below sets out the distinction.
| Indemnity | Insurance | Liability cap | |
|---|---|---|---|
| Purpose | Allocate defined losses to the responsible party | Fund claims through a third-party insurer | Limit aggregate exposure between the parties |
| Trigger | Breach or specified event under the contract | Covered loss under policy terms and conditions | Claim exceeding the agreed ceiling |
| Typical covers | Third-party IP and data claims, regulatory loss | Breach response, E&O, regulatory defence, AI harm | Not a cover, a contractual limit |
| Enforceability in India | Recognised under the Indian Contract Act, 1872, subject to scrutiny of unconscionable terms | Depends on policy validity and endorsement | Enforceable if reasonable and clearly drafted |
| Pros / cons | Direct but only as good as the vendor’s solvency | Funded but subject to exclusions and limits | Provides certainty but can strand regulatory risk |
| Drafting tip | Keep distinct from the cap | Require primary and non-contributory wording | Carve out data/regulatory heads from the cap |
Indian contract law recognises indemnities, including under sections 124 and 125 of the Indian Contract Act, 1872, and Indian courts have also enforced indemnities that respond to loss beyond the strict statutory definition. Courts nonetheless scrutinise broadly drafted or unconscionable terms. A well-drafted indemnity is specific about the triggering events, the heads of loss covered and any procedural conditions. An over-broad indemnity risks challenge; a precise one survives. The practical lesson is to draft indemnities that are proportionate and tied to identifiable exposures, third-party IP infringement, data-breach liability and regulatory loss, rather than sweeping catch-all language.
A low liability cap can quietly neutralise an otherwise strong indemnity. The solution in cyber insurance technology contracts india is the insurance-backed cap: the parties agree a general cap but uplift it, for defined high-severity claims, to the amount recoverable under the required insurance. This preserves commercial certainty for routine disputes while ensuring that a major data or regulatory event is backed by real funds rather than a nominal ceiling.
The clause should (a) identify the specific claim categories that benefit from the uplift, (b) express the uplift as the amount actually recoverable under the policy, and (c) make clear that the insurance obligation is independent, so that a lapse in cover does not reduce the vendor’s underlying liability. Sequencing matters: the indemnity bites first, the insurance funds the recovery, and the cap operates only where the drafting permits. Keeping these three mechanisms logically separate prevents the common error of allowing a single low cap to swallow regulatory and data exposures.
Subrogation is the right of an insurer, having paid a claim, to step into the insured’s shoes and pursue the party responsible for the loss. In vendor relationships this creates a hidden risk: after an incident, the customer’s own insurer could pursue the vendor, or the vendor’s insurer could pursue the customer, undermining the commercial allocation the parties negotiated. Managing subrogation waiver vendor agreements is therefore a core drafting task, not a boilerplate afterthought.
A balanced waiver protects the counterparty from recovery actions while preserving the insurer’s right to pursue genuinely culpable conduct. The standard structure waives subrogation generally but carves out fraud, intentional breach and, where negotiated, gross negligence. The carve-out keeps the waiver acceptable to insurers and aligns the risk allocation with public policy. The waiver should be mutual where both parties carry relevant cover, and it should be evidenced by insurer endorsement rather than relying on a contractual promise alone.
Because IRDAI oversees endorsement practice, buyers should confirm each endorsement is issuable under the Indian framework and require written evidence from the insurer. A sample waiver endorsement reference in the annex, “Insurer confirms waiver of subrogation in favour of [Customer] and affiliates, carve-out for fraud and wilful misconduct”, gives procurement a concrete acceptance standard.
If a vendor becomes insolvent, the insurance obligation may be the customer’s only effective protection, which is why the insurance covenant should be drafted to survive termination and insolvency and why run-off or tail cover matters. Where third-party recoveries are possible, the waiver and primary-and-non-contributory wording should be read together to ensure recoveries flow in the intended direction and do not leave the customer exposed to a contribution claim.
Clauses are only as good as the evidence that supports them. Procurement teams should treat vendor insurance requirements as a gated condition of go-live, with a clear proof matrix and ongoing monitoring.
| Document | Why it matters | Acceptance standard |
|---|---|---|
| Certificate of insurance | Confirms policies are in force | Current, naming covers and limits |
| Relevant endorsements | Proves waiver, primary/non-contributory, regulatory defence | Written, issued by insurer |
| Insurer / broker contact | Enables direct verification | Named contact provided |
| Claims history (prior 3 years) | Indicates risk profile and limit erosion | Disclosed with context |
| Retroactive & expiry dates | Confirms continuity of cover | No gaps affecting the Term |
| Insolvency / run-off cover | Protects against vendor failure | Confirmed where risk warrants |
Insurance is not static. The contract should require the vendor to notify material changes, cancellations or non-renewals, and to re-evidence cover at each renewal. Automated calendar triggers tied to expiry dates prevent the common failure of cover quietly lapsing mid-term. Where limits are materially eroded by unrelated claims, particularly relevant for AI covers, the vendor should notify the customer promptly.
“The Supplier shall not commence Services until it has provided evidence satisfactory to the Customer of the insurance required by this Agreement, and shall re-evidence such cover on each renewal and within [5] business days of any material change.” This makes evidence a condition precedent to go-live, giving procurement a hard stop rather than a remedy after the fact.
Many technology suppliers to the Indian market are headquartered abroad and insure through foreign programmes, raising questions of admissibility, jurisdiction and currency of cover. Where a foreign insurer provides the programme, confirm whether the policy responds to claims and regulatory action arising in India, and whether a local admitted policy or endorsement is needed to satisfy Indian regulatory expectations. Conflicts can arise between Indian DPDP obligations and foreign governing law, and sublimits expressed in foreign currency may not match the rupee exposure.
The cleanest fix is a local endorsement or admitted local policy confirming Indian response, paired with contractual wording requiring the vendor to maintain cover that responds to Indian claims and regulatory defence. Currency should be addressed by stating minimum limits in INR or requiring equivalent cover at a defined exchange basis.
Foreign governing law and arbitration may be acceptable where the vendor’s bargaining position is strong, provided the insurance obligation and data-protection compliance covenants are expressly governed by, or at minimum fully responsive to, Indian law. The practical compromise is to accept foreign law for general commercial terms while ring-fencing data-protection and insurance obligations so they remain enforceable and meaningful in India.
Well-drafted cyber insurance technology contracts india turn the heightened obligations of the DPDP framework and India’s intermediary rules into managed, funded risk rather than open-ended exposure. The practical path is to map each regulatory duty to a contractual obligation, require named policies with calibrated limits and the right endorsements, keep indemnities distinct from liability caps, and control subrogation through evidenced waivers. Begin by risk-mapping your vendor estate, adapt the sample clauses to each contract type, ask insurers to confirm the required endorsements in writing, and build the procurement evidence checklist into your RFP process. For contract-specific drafting and review, consult qualified counsel; this article is general guidance and not a substitute for legal advice tailored to your transaction.
This article was produced by Global Law Experts. For specialist advice on this topic, contact Mitakshara Goyal at Svarniti Law Offices, a member of the Global Law Experts network.
posted 13 minutes ago
posted 31 minutes ago
posted 42 minutes ago
posted 1 hour ago
posted 1 hour ago
posted 2 hours ago
posted 3 hours ago
posted 3 hours ago
posted 3 hours ago
posted 3 hours ago
posted 4 hours ago
posted 4 hours ago
Find the right Legal Expert for your business
Send welcome message