Your provider emails at 8.30am. An attacker accessed a shared platform overnight.
Your customer records may be involved. Staff cannot reach key systems. Clients are already asking whether their information is safe.
The supplier says it is investigating. Your business still has decisions to make that morning.
Compare payment routes before a breach happens
A supplier breach does not automatically make the supplier liable for your losses. Cyber insurance may fund covered response costs.
| Cost or issue | Cyber insurer route | Cloud route | Likely SME exposure |
|---|
| Forensic investigation | Often covered after notification and approval | May investigate its own environment only | Policy excess: check the schedule. The amount and whether it applies to each loss can vary materially. |
| Legal and ICO advice | Often covered as incident response | Rarely paid unless contract says so | Uninsured advice or excess |
| Customer notification | Usually covered if legally required | Often excluded as indirect loss | Cost if no [cover](https://dealergen.uk/reputational-harm-cover-may-last-only-weeks/) or sub-limit |
| Data restoration | May be covered, subject to wording | Usually limited to fixing its service | Betterment and excluded data loss |
| Business interruption | Only with system-failure or supplier-failure cover | SLA credits are common. Lost profit recovery is not. | Waiting periods of 8 to 24 hours are common |
| Third-party claims and defence | Often covered under liability sections | Only within liability cap and exclusions | Claims above policy or contract limits |
| Regulatory fines | Only where legally insurable and policy-covered | Usually excluded | An uninsurable fine cannot be paid by the insurer. Recovery from the provider depends on the contract, facts and applicable law. |
Cyber insurance is a funding contract. It does not prove that someone else caused the breach.
If the event fits the wording, the insurer can appoint lawyers and forensic specialists. The provider investigates its own potential fault.
Choose the insurance route first if customer, employee or payment data may be exposed. It can give forensic, legal or communication help within days. Treat supplier recovery as a second route, because it can take months. It may end at the contractual liability cap.
A cloud contract often limits liability to fees paid over the previous 12 months. It may use a similar period instead.
A firm paying £300 a month for a SaaS service may face a £3,600 cap. Its business interruption loss may be far larger.
The contract limit can leave a serious gap.
📦
Available on Amazon
An encrypted external drive can keep an offline copy of critical records. This helps while a cloud incident is investigated. It does not prevent a breach. It can shorten restoration after a covered system failure.
- Keeps an encrypted copy of key files away from the affected cloud account
- Supports faster recovery where cover includes data restoration costs
- Helps retain incident records, exports and evidence when cloud file access is disrupted
Search on Amazon →
The payment route changes with the facts of the incident. A SaaS breach may stem from the provider's vulnerable shared application.
In that case, the provider's liability may matter. The customer must still manage its own third-party data breach response.
In IaaS, the provider may secure physical infrastructure. The SME remains responsible for virtual-machine patching, storage permissions and identity settings.
A public backup bucket can count as the customer's failure. So can broad administrator access or stolen employee credentials.
For SME cyber incident response, record who controlled the affected layer. Do this before alleging fault or seeking recovery.
Check the contract before relying on a supplier claim. A cloud liability cap may cover fees paid in a defined period.
Broad exclusions can remove liability for lost profit, lost data, reputational harm and indirect loss. SLA credits often give a set remedy for availability failures.
The contract may call those credits the customer's only remedy for downtime. Look for data-protection indemnities and a duty to notify and cooperate.
Also check audit rights, information rights and the treatment of sub-processors. These clauses shape the facts you can get after an incident.
A provider should remain accountable for its sub-processors. The contract decides how you get incident facts and pursue losses.
UK GDPR keeps the SME responsible as controller
Where your SME decides why and how data is processed, it is the data controller. It remains responsible for the UK GDPR notification decision.
If it acts only as a processor, it must notify the controller without undue delay. It must also follow the contract's incident process.
The controller and processor split
The Information Commissioner's Office says some qualifying breaches need reporting within 72 hours of awareness. This applies where the breach may risk people's rights and freedoms.
Its guidance is available through the Information Commissioner's Office.
You do not need every technical fact before making an ICO assessment. You can update a report later.
A late report needs an explanation. A provider may need days or weeks to confirm affected records.
A provider's fault can support a later recovery claim. It does not transfer the controller's UK GDPR decision-making duty.
Protect cover in the first 72 hours
Early action can protect insurance cover and evidence.
Notify before appointing suppliers
Many SME cyber policies need consent before you instruct forensic investigators, lawyers, public relations advisers or ransomware negotiators. Panel firms are specialists chosen by the insurer.
This is like using the recovery service named in a breakdown policy. The insurer can then control costs and legal advice.
Preserve proof of fault and loss
Keep audit logs, administrator records, settings, screenshots, support tickets and provider emails. Ask for the supplier's timeline and affected services.
Also ask about data types, sub-processors, containment steps and root-cause findings. These records can support both the claim and later recovery.
Use this claim order:- Contain the issue without deleting evidence.
- Notify your insurer or broker. Follow its panel process.
- Request written incident facts from the provider.
- Assess ICO reporting within 72 hours.
- Measure uninsured loss. Ask the insurer about recovery against the supplier.
This guidance does not fully apply if your business processes no personal data. It also may not apply if cloud systems are not critical. An outage alone is different where there is no sign of access, loss, alteration or disclosure. This does not replace a review of your policy, cloud contract or specific incident. Firms regulated by the Financial Conduct Authority may have separate notification duties.
Insurers also assess whether the business had suitable controls before agreeing cover or paying a claim. Common questions cover multi-factor authentication, separate privileged accounts and tested offline backups.
They also cover timely patching and staff phishing controls. These steps matter in ransomware events.
Attackers may use a stolen cloud identity. They may not exploit the provider itself.
Keep proof of these controls and any management-approved exceptions. This can help the insurer assess forensic work and data breach response costs.
It can also help assess customer notification and business interruption cover. The cyber policy excess and sub-limits can still remain your responsibility.
Questions & answers
Do I report a provider breach to the ICO?
You report to the ICO within 72 hours if the breach may risk people's rights and freedoms. As controller, your SME makes that assessment. This remains true when the processor caused the incident.
Does an SLA pay for lost sales after a breach?
An SLA usually pays service credits for downtime, not lost sales after a data breach. Business interruption cover needs suitable cyber policy wording. It may have an 8 to 24-hour waiting period.
Can an insurer refuse cover for an insured data breach?
An insurer can dispute cover after late notice, an exclusion or unmet security conditions. It may also challenge unapproved adviser costs. Supplier-failure extensions may not cover all losses.
What evidence proves the cloud provider was at fault?
Provider timelines, audit logs, support tickets, settings and root-cause findings can help prove fault. Evidence must also show your credentials, permissions or settings did not materially contribute.
The essentials:- A cloud provider's breach does not remove an English SME's UK GDPR duties as controller.
- Cyber insurance can fund covered response work before a supplier dispute is settled.
- Service credits differ from payment for forensic, legal or lost-income costs.
- Fast insurer notice, preserved evidence and a documented ICO assessment protect stronger claim routes.
Who pays if my cloud provider has a data breach?
Your cyber insurer may pay covered response costs first. The provider may pay only within its contract limit.
Your SME can still bear the excess and excluded losses. It may also bear amounts above the policy or supplier cap.
Related sources
These articles can help you explore the topic in more depth:
