A client’s tender may ask for PI. Yet a hacked mailbox or ransomware-hit website can leave your agency paying its own recovery costs.
For UK digital agencies, PI and cyber insurance solve different problems. Always check the policy wording.
PI and cyber cover protect different losses
PI protects against allegations of client loss. Cyber insurance protects the incident itself. PI may respond when a client says your advice, code, campaign, or delivery caused financial loss.
Cyber cover is designed for costs that arise when systems, data, or accounts are compromised. Think of PI as cover for a disputed job. Think of cyber as help after a break-in.
For example, PI can respond when a client alleges that your work caused loss. This could include development, campaign management, advice, or creative work.
Examples include a failed launch, a coding defect, a missed deadline, or an incorrect paid-media setting. The client must usually allege a financial loss.
Cyber cover often includes first-party cover. This can pay for forensic work, legal advice, data recovery, crisis communications, and business interruption.
It can also include third-party cover, which can address privacy or network-security claims from other people.
Errors and omissions cover is usually sold in the UK as professional indemnity insurance. It is not normally a separate E&O product.
The purpose is much the same. It addresses claims that professional services, advice, or deliverables caused a client financial loss.
This matters in tenders and contracts. A US client may ask for “E&O”, while a UK insurer may list “professional indemnity insurance”.
Check that the defined professional services match your actual work. This may include development, SEO, paid media, design, consulting, and systems integration.
PI is usually written on a claims-made basis. That means continuous cover and the retroactive date matter.
A claims-made policy works like a membership that must stay active. A gap can leave earlier work outside cover.
Quick comparison for England agencies
A small England agency with client data or code will often need both covers. The limit and wording should match its real contract risk.
Lower-risk micro-agencies may pay £200 to £800 each year for PI. Cyber cover may cost £250 to £1,500 each year.
| Decision point | Professional indemnity | Cyber liability |
|---|
| Main loss paid | Client financial loss alleged from faulty professional work | Forensics, recovery, and liability after a cyber incident |
| Typical UK annual range | £200 to £800 for lower-risk small agencies | £250 to £1,500 for lower-risk small agencies |
| Common excess | £250 to £1,000 per claim | £500 to £2,500 per incident |
| Ransomware and data recovery | Often excluded or tightly limited | Often included, subject to conditions and sub-limits |
| Best fit | Advice, code, or delivery that can harm client finances | Client credentials, personal data, websites, or cloud access |
The UK GDPR does not require every breach to be reported. The ICO may need notice within 72 hours where risk exists.
Prompt forensic work can show what happened. It can also show whether reporting is required.
A digital-agency claim can involve both policies. The outcome depends on the type of loss.
A deployment error may cause a website outage. Incorrect campaign settings or faulty code may also cost a client revenue.
These are usually PI-style allegations of client financial loss. By contrast, ransomware in the agency’s own network points first to first-party cyber cover.
Cyber cover can include ransomware recovery, forensic work, and data recovery costs. A leaked CRM export may create privacy liability and breach-response costs.
It may also cause third-party cyber claims from affected people or clients. One event can trigger both policies.
Lost creative assets may be an own-cost restoration issue. A delivery warranty claim may need PI.
Neither policy should be assumed to cover every contract promise. The wording decides the result.
PI: choose this if clients rely on your work
Choose PI where your professional output can cause client financial loss. This applies even if you hold little personal data.
PI is usually the first priority for web builds, software development, strategic advice, SEO, paid media, design, and systems integration.
Pros
PI can pay legal defence costs and settlements. It responds to alleged breaches of professional duty.
Cons
PI is often a poor incident-response fund. Cyber exclusions may remove ransomware, restoration, and notification costs.
For whom it fits
It fits agencies whose deliverables affect client sales, operations, or compliance. It also fits agencies facing PI requirements in tenders.
For whom it does not fit alone
PI alone is weak where the agency manages WordPress, cloud platforms, email data, or client credentials. Those activities create cyber incident costs.
✅
Our recommendation
A USB security key can reduce the risk from a stolen password. It can protect agency email, ad accounts, and client dashboards.
It supports controls that cyber insurers often ask agencies to evidence.
- Provides stronger sign-in protection for Google Workspace and Microsoft accounts
- Helps protect shared administrator access to client CMS and advertising platforms
- Creates a practical control for cyber-insurance renewal questions
Check availability →
Choose this if: your agency may be blamed for failed advice, code, campaigns, or delivery. Keep claims-made PI active and preserve its retroactive date.
Cyber: choose this if you hold access or data
Choose cyber cover where you store data or manage client systems. Choose it if an attack could stop your agency trading.
This includes agencies that host sites, manage CRM exports, retain campaign audiences, or hold privileged client access. It also includes agencies with shared admin accounts.
Pros
Cyber insurance may give access to a 24-hour incident-response team. It may cover the costs of forensics, legal advice, PR support, recovery, extortion, and lost income.
Cons
Policies often require multi-factor authentication, supported software, secure backups, and prompt notification. Regulatory fines may be uninsurable, even when defence costs are covered.
For whom it fits
Cyber insurance suits agencies with personal data, hosting duties, administrator rights, or major SaaS dependencies. These risks can create costs before any client claim.
For whom it does not fit alone
Cyber alone may not answer a poor website performance claim. It may not cover an advertising strategy that wasted a client’s budget.
Those are normally PI-style professional-work allegations. The two covers have different jobs.
Choose this if: a breach, account takeover, or ransomware event could force the agency to spend money first.
Which cover should your agency buy?
Buy both if you build or manage digital services and handle client data, credentials, or systems. PI deals with the financial allegation about your work.
Cyber deals with the operational emergency. Compare schedules, exclusions, excesses, and sub-limits, not just a bundle’s headline limit.
For most England digital agencies, both covers are the sounder choice. PI without cyber can leave incident costs unpaid.
Cyber without PI can leave client performance claims unpaid. The final answer still depends on the actual policy wording.
- Ask for the PI limit required by each client, tender, or framework.
- Check whether cyber cover includes privacy liability, incident response, and business interruption.
- List freelancers, hosting providers, and SaaS platforms with client-data access.
- Compare excesses, restoration limits, and extortion sub-limits.
- Confirm the PI retroactive date and keep claims-made cover uninterrupted.
This comparison matters less if your business provides no digital services. It also matters less if you hold no third-party systems or data. You may still need other business insurance. Ask a qualified broker, insurer, or legal adviser to review a claim, tender clause, or client contract.
Freelancers, hosting companies, and SaaS providers can cause losses even without an agency hack. A freelance developer may introduce vulnerable code.
A hosting provider may suffer an outage. A marketing platform may suspend an account.
The client may still pursue the agency under its contract. Identify who has administrator access and who processes personal data.
Check whether subcontractors hold their own PI and cyber liability insurance. Also check outsourced service-provider interruption cover.
This cover is often called contingent business interruption. Some policies exclude supplier technology failure without a qualifying security incident.
Contracts should assign responsibility clearly. They should require prompt incident notification and avoid indemnities above the insurance bought.
What people ask
Do UK digital agencies need both PI and cyber
Most agencies need both where they deliver professional work and hold client data, credentials, or system access. PI handles alleged client financial loss. Cyber pays for breach response and related liabilities.
Does professional indemnity cover ransomware?
Professional indemnity rarely covers ransomware recovery unless the wording clearly says it does. Ransomware usually needs cyber cover. Cyber may pay for forensics, extortion, restoration, and business interruption.
Can an ICO fine be insured?
An ICO fine may be uninsurable where the law bars indemnity. Cyber cover may still pay defence costs, legal advice, forensics, and notification support. Terms still apply.
What PI limit does a digital agency need?
A digital agency often needs £1 million to £5 million PI where contracts require it. The right limit depends on client turnover and contractual indemnities. It also depends on likely loss and defence-cost treatment.
The essential points:- PI and cyber insurance solve different problems, even when one coding error starts both.
- Keep PI active on a claims-made basis and protect its retroactive date.
- Check cyber exclusions, incident sub-limits, and excesses before relying on PI.
- For most England digital agencies with client access or data, both covers are the sounder choice.
Related sources
These articles can help you explore the topic in more depth:
