Restoring Data May End Before Business Interruption Does
A ransomware incident may end in days. Your business can still lose money for weeks.
Data recovery cover pays to restore or recreate affected data. Business interruption cover addresses lost income and certain extra costs during downtime.
These covers are not interchangeable.
Match each limit to the cost it must pay
Data recovery is not data recreation
Data recovery costs pay to restore affected data from backups or another usable copy. Data recreation means rebuilding records from emails, invoices and staff memory.
A policy may cover restoration. It may cap recreation or exclude it altogether.
The difference can be costly.
Business interruption follows gross profit
Business interruption insurance addresses income lost after a qualifying cyber event. It usually uses gross profit rather than turnover.
Test the limit against peak daily gross profit. Include realistic downtime, continuing costs and urgent workarounds.
Turnover is not the loss.
Recovery or interruption: who each suits
Prioritise a strong business interruption limit when key systems stop sales, bookings, fulfilment, billing or client service. Focus more on recovery where manual trading causes little income loss.
A spreadsheet, phone and manual process may keep some firms trading. They rarely work for several days in a busy online business.
Business interruption should usually have the larger limit when systems directly earn income. Data recovery still needs its own realistic allowance.
Choose this if: your business earns money through systems that cannot be replaced by a spreadsheet, phone and manual process for several days. In that case, business interruption should usually have the larger limit. Data recovery needs its own realistic allowance.
Where sub-limits shrink a cyber claim
Compare the policy sections side by side
| Test | Data recovery | Business interruption |
|---|
| What it normally pays | Backup restoration, data retrieval, restoration specialists | Lost gross profit, selected continuing costs, sometimes extra expense |
| Main measure | Technical work and supplier invoices | Trading records, gross profit and length of disruption |
| Typical timing | Hours to days for restoration, longer for recreation | Often reduced by a 12, 24 or 48-hour waiting period |
| Common omission | Manual recreation, hardware, remediation or cloud transfer fees | Supplier outage, service credits, short indemnity period or low sub-limit |
| Evidence needed | Backup logs, scope of work and invoices | Accounts, sales trends, payroll and outage timeline |
The table shows why one large overall limit can mislead. A smaller cap may apply to the cost you need most.
Read each section alongside the others.
Waiting periods and shared limits
A waiting period is time that must pass before business interruption cover begins. It is like an excess measured in hours.
A policy sub-limit is a smaller cap inside the overall limit. A shared aggregate means each paid cost reduces the amount left.
The most common error is assuming the headline limit applies to every cost. It often does not.
A £250,000 gap in plain numbers
One incident can drain four different pots
1. Forensics
£40k
2. Restore data
£25k
3. Lost gross profit
£180k
4. Workarounds
£35k
A £150k shared aggregate cannot pay £280k of eligible costs in full.
A £150k shared aggregate cannot pay £280k of eligible costs in full, leaving the business to fund the uncovered £130k.
The arithmetic is simple, but shared limits can fail in practice. Forensic costs may use much of the pot before trading losses are known.
Notify early and preserve the claim trail
Financial recovery also depends on claim handling. It does not depend only on the cyber insurance limits bought.
Notify the insurer or broker when the policy requires it. Do this even if the full loss is unknown.
A ransomware incident can begin as a suspected security event. It can then cause several weeks of interruption.
Keep incident timestamps, backup logs, supplier notices, invoices and sales records. Keep records of decisions to use manual workarounds.
Where the policy appoints providers, get approval before committing large costs. This applies to forensic, legal, public-relations and restoration providers.
Emergency wording may allow urgent work first. Check that wording before an incident.
A clear timeline links the outage to recovery work and lost gross profit. It helps separate data recovery, extra expense and business interruption costs.
Size cover around real recovery times
Use RTO and RPO in everyday terms
Your recovery time objective (RTO) is the longest acceptable system outage. Your recovery point objective (RPO) is the data loss you can accept.
A 24-hour backup cycle can leave one day of orders and changes to recreate. That work may take longer than restoring files.
Think of RTO as repair time. Think of RPO as the pages missing from a diary.
Test four outage scenarios
| Incident | Likely pressure point | Limit to test |
|---|
| Ransomware attack | Containment can extend downtime beyond file restoration | Forensics, recovery, gross profit and overtime |
| Cloud or SaaS outage | Your systems work, but the named supplier is unavailable | Contingent business interruption and supplier definition |
| Data corruption | Backups may be incomplete or also corrupted | Data recreation, consultants and validation time |
| Managed provider failure | Cover may need a qualifying security failure | Dependent supplier trigger and waiting period |
Test each scenario against your own systems. A cloud outage may not trigger cover without the right supplier wording.
The result should guide your limit choice.
Check the wording before renewal
Check whether recovery includes recreation, cloud restoration and specialist costs. Check whether forensics and extra expense share an aggregate.
Check whether cloud, SaaS, payment and managed-service outages are covered. Also check the trigger, waiting period and indemnity period.
Choose this if: your firm relies on cloud systems, online sales or customer records to earn income. Set interruption cover around peak gross profit and credible downtime. Keep a separate allowance for restoration and recreation.
This comparison matters less if your business has no material digital dependency. It also matters less if manual trading causes little income loss. It cannot determine whether a claim will be paid. Cover depends on the full wording, definitions, exclusions, endorsements and incident facts.
What people ask
Does cyber insurance cover business interruption?
It can cover lost gross profit and selected continuing costs after a qualifying cyber event. Check the waiting period, indemnity period and supplier outage cover.
Does cyber insurance cover data recovery?
It may pay to restore backups, retrieve data and hire specialists. It may not fully pay for recreation, hardware, improvements or corrupted backups.
Should I prioritise data recovery or business interruption?
Prioritise business interruption when an outage stops sales, fulfilment, billing or paid client work. Prioritise data recovery where manual trading remains possible but specialist rebuilding costs more.
How do GDPR costs affect these limits?
UK GDPR notification, legal and regulatory costs are usually separate from lost-income cover. Check privacy-response and legal-defence sub-limits, because fines may be excluded or restricted.
Which limit should you choose?
For most digitally dependent SMEs in England, start with a larger business interruption limit and realistic indemnity period. Back it with separate data recovery and recreation cover.
Base the decision on peak daily gross profit and credible downtime. Include the time needed to validate data and return to normal operations.
Choose data recovery first only when downtime barely affects income. That is less common for firms that sell, book or bill online.
