Cyber insurance is easy to buy badly. The cover responds to a narrow set of events, the exclusions have moved sharply in the last three years, and underwriters now decline risks outright over missing controls rather than simply charging more. Here is what a Mauritian SME should understand before signing anything.
Your legal exposure starts with the Data Protection Act 2017
If you hold personal data — customer records, staff files, a mailing list — you are a controller under the Data Protection Act 2017, and a breach starts a clock. Section 25 requires you to notify the Data Protection Commissioner without undue delay and, where feasible, within seventy-two hours of becoming aware of the breach. Miss that window and you must explain the delay. Section 26 then requires you to tell the affected individuals themselves, without undue delay, wherever the breach is likely to result in a high risk to their rights and freedoms.
There is a meaningful exemption in section 26: if the data was protected by appropriate technical measures such as encryption, so that it is unintelligible to whoever took it, you may not need to notify individuals at all. Encryption is not only a security control. It is a notification defence.
Penalties under the Act are criminal, not administrative. The general provision, section 43, carries a fine of up to Rs 200,000 and imprisonment of up to five years.
Because Mauritian data protection penalties are criminal fines imposed by a court, they are very unlikely to be insurable — cyber policies cover regulatory fines only where the law permits. What a policy realistically funds is the investigation, the legal defence, the notification exercise and the business interruption. Confirm the position on fines with your insurer in writing before you rely on it.
What the threat actually looks like at this size
CERT-MU recorded more than 5,000 incidents through the MAUCORS reporting platform in 2024, twenty-seven per cent up on the previous year. Read the breakdown carefully, though. The reported categories are dominated by consumer harm — online harassment, identity theft, scams — and only eleven ransomware incidents were formally reported in the entire year. That is not a measure of the corporate threat. It is a measure of how rarely Mauritian businesses report to a public channel.
The insurer data tells a different story. Munich Re, reviewing its global book, reports that the majority of cyber incidents and claims it records affect micro-companies and SMEs, and that 2025 claims split roughly sixty-two per cent first-party to thirty-eight per cent third-party. Regionally, INTERPOL puts cybercrime losses across Africa at US$484 million in 2025, more than double the US$192 million recorded in 2024.
For a business of twenty or fifty people, the realistic scenarios are narrow and repetitive: ransomware that encrypts the file server, and payment diversion fraud where an attacker inside a mailbox alters bank details on a genuine invoice.
What a cyber policy covers
Cover divides in two. First-party insures your own losses: the incident response fund that pays for forensics, legal advice, notification and public relations; data restoration; business interruption while systems are down, sometimes extended to an outsourced provider’s outage; and cyber extortion, including the negotiation and, where lawful, the payment.
The third-party side insures what you owe others: privacy and network security liability, the cost of defending a regulatory proceeding, payment card liabilities if you take card payments, and media liability for what you publish.
Note where the money actually goes. The response costs — the forensic firm, the lawyers, the notification exercise — are what most SME claims consist of, and they arrive within days of the incident.
Where the cover stops
- State-backed attacks. Since Lloyd’s Market Bulletin Y5381 took effect on 31 March 2023, every standalone cyber policy written at Lloyd’s must exclude state-backed cyber-attacks that significantly impair a state’s functioning or security. The clauses differ in how attribution is decided, and some earlier versions have since been prohibited outright. Ask which clause is on your policy and what it takes to trigger it.
- Social engineering and funds transfer fraud. Usually an endorsement with its own sub-limit, not part of core cover — which matters, because payment diversion is one of the two most likely losses an SME will suffer.
- Security warranties. Multi-factor authentication and working backups are frequently written in as conditions. If you warrant a control and it is not actually in place at the time of loss, the claim is exposed.
- War. A separate exclusion from the state-backed clause, and both may appear on the same wording.
The questions underwriters will ask
Expect to evidence, not merely assert: multi-factor authentication enforced on email, remote access and administrator accounts; endpoint detection and response rather than legacy antivirus, with a coverage report; backups following the 3-2-1 rule with at least one copy offline or immutable and documented test restores; email filtering plus recurring staff training and phishing simulations; a patching standard with defined timescales; no RDP exposed to the internet; separate administrator accounts; a written incident response plan tested in the last twelve months; and a list of critical vendors with their notification obligations.
Gaps in that list do not simply cost you premium. They produce sub-limits, coverage exclusions or a declinature.
Buying the policy is the last step. The controls the policy assumes are the first.
How we help
We work through the proposal with you before it reaches an underwriter, so that answers are accurate and defensible, and so gaps are fixed rather than discovered at claim stage. We compare wordings on the points that decide claims — the state-backed exclusion, the social engineering sub-limit, the waiting period on business interruption, and whether regulatory defence costs sit inside or outside the limit. Call us on 5256 5688 or email info@globalequity.mu.
