Professional Indemnity, D&O & Cyber Risk Insurance Advisory

Professional Indemnity (PI) insurance covers claims made against a professional or firm alleging negligence, an error, an omission, or a breach of professional duty in the course of rendering paid services. It is most relevant for CA firms, company secretaries, lawyers, architects, engineers, IT and management consultants, doctors, and any business whose core offering is advice or a professional service rather than a physical product. If a client can plausibly claim your advice or service caused them a financial loss, PI cover is worth assessing.

Primarily the individual director or officer, personally, against claims alleging a wrongful act in their management capacity. A standard D&O structure has three components: Side A covers the director personally when the company cannot or will not indemnify them; Side B reimburses the company when it does indemnify the director; and Side C (entity cover) protects the company itself, typically for securities claims. Most Indian D&O placements for private companies focus on Side A and B; Side C becomes more relevant as a company approaches a public listing or has a wider shareholder base.

Because directors of private companies can still face personal liability claims — from shareholders, creditors, employees, regulators (SEBI where applicable, RoC, or under the Insolvency and Bankruptcy Code 2016 in a distress scenario), or even the company itself in a dispute. Institutional investors and independent directors increasingly make adequate D&O cover a condition before they invest or agree to join the board — it is now a standard governance expectation, not a listed-company-only concern.

The DPDPA 2023 introduced statutory obligations for 'Data Fiduciaries' — entities that determine the purpose and means of processing personal data — including breach-notification duties to the Data Protection Board of India and to affected individuals, and financial penalties for non-compliance that can run into crores of rupees depending on the nature and scale of the breach. Cyber insurance increasingly needs to be assessed against this specific regulatory exposure — not just against the operational cost of a breach (forensic investigation, system restoration, customer notification) but against the DPDPA penalty and regulatory-defence dimension as well.

No. PNPC Global is a Chartered Accountancy firm and does not hold an IRDAI insurance intermediary (broker/agent) licence, and this advisory does not involve PNPC selling, underwriting, or placing policies. Our role is risk assessment, coverage-gap analysis, and wording review — independent of any commission on the policy sale. We coordinate with your chosen IRDAI-licensed broker, or directly with insurers, to ensure the policy actually placed matches what our risk assessment says you need.

A claims-made policy responds to claims first made against the insured during the policy period (or an agreed extended reporting period), regardless of when the underlying act occurred — provided the act occurred after the policy's retroactive date. This is different from an 'occurrence' policy, which responds based on when the incident happened, regardless of when the claim is later made. Because PI and D&O policies are almost always claims-made, a gap in renewal, a switch to a new insurer without preserving the retroactive date, or a late notification of a known circumstance can leave genuine exposure completely uninsured.

Most claims-made policies allow (and often require, to preserve rights) notification of a 'circumstance' — a set of facts that could reasonably give rise to a claim in future — even before any formal claim or demand has been made. Notifying a circumstance during the current policy period generally locks in coverage under that policy, even if the formal claim materialises after the policy has expired or been non-renewed. Failing to notify a known circumstance, and then having a formal claim arise later, is one of the most common grounds insurers use to deny cover.

There is no fixed statutory formula. Insurers and advisors typically consider the firm's annual professional fee income, the value of the largest client engagements undertaken, any specific contractual minimum limits demanded by key clients, and the sector's typical claim severity. A firm advising on high-value transactions (M&A, large audits, complex valuations) generally needs a materially higher limit than a firm doing routine compliance work, even at similar revenue levels.

No, ordinarily not. A standard CGL policy is designed to cover third-party bodily injury or property damage arising from the business's operations or premises — it typically carries an explicit exclusion for professional services liability and does not respond to a director's alleged wrongful management decision. PI and D&O are distinct, separately underwritten covers precisely because CGL is not designed to respond to these exposures.

Frequent exclusions include: war and cyber-war/state-sponsored-attack carve-outs (a live and evolving area of dispute globally), infrastructure or utility failure outside the insured's direct control, costs of 'betterment' (upgrading systems beyond their pre-incident state), and losses arising from a vulnerability the insured knew about and failed to patch before the incident. Sub-limits — often materially lower than the headline policy limit — commonly apply to specific heads such as cyber-extortion/ransom payments, regulatory fines (where legally insurable), and business-interruption waiting periods.

It depends on the actual risk profile, not the company's size. A small SaaS company processing customer payment data or health records can carry disproportionate cyber exposure relative to its headcount. Conversely, a small business with minimal digital footprint and no customer data processing may reasonably deprioritise cyber cover in favour of other insurance or working-capital needs. This is exactly the judgment call our risk-mapping stage is designed to make explicit rather than leaving it to a generic 'every business needs cyber insurance' sales pitch.

Most D&O policies continue to cover a former director for wrongful acts committed while they served, for claims made during the policy period (subject to the retroactive date), even after resignation — this is sometimes explicitly extended through a 'run-off' or 'extended reporting period' provision, particularly important when the company itself is being sold, merged, or wound up. A director resigning from a company should specifically ask whether run-off cover exists and for how long.

No. PNPC charges a fixed, agreed professional fee for the risk assessment, policy audit, specification, and ongoing advisory work — discussed and confirmed in writing before the engagement begins. We do not receive commission on the premium of any policy ultimately placed, because we are not the licensed intermediary placing it. This keeps our recommendation focused on what actually covers your risk, not on which product pays the highest commission.

PI insurance is not universally mandated by statute for all professionals, but specific regulators and professional bodies impose it in defined circumstances — for instance, certain categories of statutory audit engagements, valuation assignments under the Companies Act 2013 and IBC 2016 framework (Registered Valuers), and specific SEBI-regulated intermediary roles carry PI requirements or strong professional-body recommendations. Even where not mandatory, many corporate and institutional clients now contractually require their professional advisors to carry a minimum PI limit as a condition of engagement.

Side A covers individual directors and officers personally when the company is unable or legally unwilling to indemnify them (for instance, in an insolvency scenario, or where indemnification is legally restricted). Side B reimburses the company for amounts it has indemnified its directors and officers for. Side C, where included, extends cover to the entity itself — most commonly for securities-related claims, and more relevant as a company's shareholder base widens or it approaches a public listing.

A corporate insurance broker's role is typically to place cover efficiently across the market and manage the relationship with insurers on your behalf — a valuable and distinct function. PNPC's advisory sits one step earlier: independently assessing what your actual risk profile requires, auditing whether the policy your broker placed actually matches that risk (reading the wording, not just the premium quote), and providing a second, non-commission-linked opinion before you bind or renew cover. The two roles work well together rather than in competition — we have supported clients whose existing broker relationship continued, with PNPC providing the independent coverage-adequacy check.

Business interruption cover within a cyber policy responds to lost income and continuing operating expenses incurred while systems are down or degraded following a covered cyber event — typically subject to a waiting period (a number of hours the systems must be down before the cover triggers) and a defined indemnity period (the maximum duration for which lost income is payable). The payout is usually calculated against a pre-agreed methodology in the policy — often based on prior-period revenue trends adjusted for the interruption — and insurers frequently appoint a forensic accountant to quantify the actual loss.

A cyber policy itself does not create DPDPA compliance — that requires the underlying operational measures (consent management, data minimisation, breach-notification protocols, appointing a Data Protection Officer/nodal contact where the DPDPA and its rules require one, and reasonable security safeguards under the Act). What a well-structured cyber policy does is provide financial protection — breach-response costs, potential regulatory-defence costs, and business-interruption losses — for the event that compliance measures did not prevent. The two are complementary, not substitutes for each other.

Notify the insurer (or the policy's specified incident-response hotline) as early as possible — many cyber policies require prior insurer consent before engaging forensic IT firms or legal counsel if those costs are to be covered under the policy. Preserve evidence rather than immediately wiping and rebuilding affected systems. Avoid making public statements about the scope or cause of the incident before initial forensic findings are available. Engage the insurer-approved panel of forensic IT and legal advisors where the policy specifies one, since using non-panel vendors without consent can affect cost reimbursement.

At minimum, annually, at renewal. But a proper review should also be triggered by specific events — a funding round, a new independent director joining the board, a significant new client contract with unusual indemnity terms, a material change in the company's data-processing footprint, or any near-miss incident, complaint, or regulatory query, even one that did not become a formal claim.

Generally, fines and penalties that are 'uninsurable as a matter of law' are excluded from D&O cover — Indian law, like most jurisdictions, does not permit insuring against certain punitive fines as a matter of public policy. However, defence costs incurred in responding to a regulatory investigation or proceeding — legal fees, expert costs — are typically covered even where the eventual fine itself would not be, and this defence-cost coverage is often the more financially significant benefit in practice, since regulatory proceedings can run for years before any fine is even determined.

Where defence costs are 'within limits', every rupee spent defending a claim erodes the same limit that would otherwise be available to pay a settlement or judgment — a long, expensive defence can leave little or nothing left to pay the underlying claim. Where defence costs are 'in addition to limits', the insurer pays defence costs separately, over and above the stated limit of indemnity, preserving the full limit for settlement or judgment. This structural difference can matter more than the headline limit amount itself.

Usually yes, at least in part — Indian PI, D&O, and cyber policies are typically underwritten with an Indian jurisdiction and legal-system assumption, and may not adequately respond to a claim brought in a foreign court or under a foreign regulator's jurisdiction. Companies with UAE operations, in particular, should assess whether UAE-domiciled entities need separate local cover (UAE has its own insurance market and, since the UAE Federal Data Protection Law, its own data-protection exposure) rather than assuming the Indian parent's policy extends worldwide.

The Insurance Ombudsman is a statutory grievance-redressal mechanism under the Insurance Ombudsman Rules for policyholder complaints against insurers, generally available for claims up to a specified monetary threshold and typically used after the insurer's own internal grievance process has been exhausted without resolution. For larger commercial PI, D&O, and cyber claims that often exceed the Ombudsman's pecuniary threshold, disputes more commonly proceed through arbitration (if the policy has an arbitration clause) or civil litigation instead.

Listed companies face materially higher D&O exposure — SEBI's Listing Obligations and Disclosure Requirements (LODR), securities-class-action-style claims (even though the Indian class-action framework differs from the US model), and heightened public shareholder scrutiny — and typically require a higher limit, explicit Side C entity/securities cover, and broader regulatory-defence extensions. Private companies generally prioritise Side A/B adequacy relative to their specific investor base and board composition. Our risk-mapping approach adjusts the specification accordingly rather than applying a one-size template.

Social engineering fraud cover responds to losses from fraudulent instructions — a fake CEO email, a spoofed vendor payment-details change, business email compromise — that trick an employee into transferring funds to a fraudster, even though no technical system was actually 'hacked' in the traditional sense. It is frequently sold as a separate endorsement or sub-limited add-on to a cyber or crime policy rather than being automatically included, and companies sometimes discover this gap only after such a fraud has already occurred.

Yes. Investment term sheets and shareholders' agreements frequently include specific insurance covenants — minimum D&O limits, indemnification obligations the company must undertake for its directors, and sometimes specific cyber-cover requirements as a condition of investment. We review these clauses alongside our broader risk assessment to confirm the company can practically source the required cover in the market, and at what approximate cost, before those terms are finalised.

Yes — insurance premiums for general insurance products, including PI, D&O, and cyber covers, attract GST under the CGST Act 2017, and the applicable rate should be confirmed against the current GST rate structure at the time of purchase, since GST rates on specific categories are periodically revised by the GST Council. This GST is an additional cost layer on top of the base premium quoted by the insurer or broker and should be factored into any premium comparison across quotes.

A complete copy of the policy wording (not just the schedule), all endorsements and correspondence with the insurer/broker at every renewal, a log of any circumstance notifications made, the internal claim-notification protocol document, and — specifically for cyber exposure — records of security measures in place at the time of placement (since insurers may ask for evidence of the security posture disclosed at underwriting if a claim is later contested on non-disclosure grounds).

This advisory is delivered by PNPC's insurance and risk advisory practice, which works alongside — not in place of — your existing statutory audit, tax, and finance function, whether that is PNPC's own team or another firm's. We draw on the company's financial statements, board minutes, and existing contracts as inputs to the risk assessment, and we coordinate directly with the CFO or finance controller rather than requiring the founder or board to be the sole point of contact.

The fee depends on the scope — a first-time risk assessment and specification for a company procuring PI, D&O, and cyber cover for the first time is a more substantial engagement than an annual renewal review of existing, well-structured cover. PNPC agrees a fixed fee in writing for the specific scope before work begins, scaled to the company's size, number of covers under review, and complexity of the risk profile (multiple jurisdictions, complex data footprint, prior claims history, etc.).

Yes to PI — sole proprietors and freelance professionals (consultants, freelance designers, independent IT contractors) can and often should carry Professional Indemnity cover in their own name or business name, particularly where client contracts require it. D&O cover, by contrast, is specific to the directors and officers of an incorporated entity (company or, in some structures, an LLP's designated partners under an equivalent liability cover) — it is not a relevant product category for a sole proprietorship, which has no separate legal personality or board structure to protect.

Across engagements, the most recurring gap is a mismatch between what the policy's definitions and exclusions actually say and what the client believed the policy covered based on the broker's renewal summary or the policy's marketing brochure — most commonly: a cyber exclusion buried in a PI policy that excludes exactly the data-related professional failures modern service delivery creates, a D&O policy with defence-costs-within-limits structure the board was unaware of, or a materially reduced sub-limit for the specific risk (cyber-extortion, regulatory defence, social engineering fraud) that turns out to matter most for that particular business.