Courier businesses and microbusinesses often hold more sensitive data than they realise. A driver’s phone may show addresses, contact numbers, live locations and notes during one shift.
When courier firms need cyber cover most
Courier firms need cyber cover when daily work depends on dispatch apps, driver phones, stored addresses, payment links or cloud software. A data breach happens when someone accesses, loses or sends personal information without permission.
Data held during a normal delivery
Names, addresses, door codes and safe-place notes can identify a person. Proof-of-delivery photos, driver locations and phone numbers can identify them too.
UK GDPR and the Data Protection Act 2018 require suitable security. The Information Commissioner's Office guidance on reporting breaches bases reporting on risk to people.
Four signs the risk is material
Your need is stronger if any of these apply:
- Drivers share one dispatch password, because one lost handset can expose active jobs.
- Customer data is downloaded to phones, because a phone lock may not remove app access.
- Bookings stop without one supplier, because a SaaS outage can leave drivers without routes.
- Staff can change bank details by email, because phishing can lead to payment fraud.
Treat driver phone security and dispatch app security as daily business security. They are not just an IT task.
Require a screen lock, MFA, device encryption and remote removal of business access. Remove business access when a phone is lost or a driver leaves.
Limit downloads where possible. Proof-of-delivery photos, route data, addresses and safe-place notes can remain available after a shift.
Separate driver accounts make unusual activity easier to spot. These controls reduce the harm from a lost handset.
They also help show that access to personal data is proportionate under UK GDPR.
What cyber cover pays beyond motor insurance
Cyber cover can pay digital incident costs that motor, public liability and goods in transit policies usually exclude. It may cover forensic work, data recovery, legal advice, customer contact and extortion support.
It may also cover qualifying business interruption. Policy wording, excess and limits still apply.
| Incident | Policy most likely to respond | What it normally pays for | Common gap |
|---|
| Van collision | Motor or fleet | Road liability and vehicle damage | Hacked booking account |
| Parcel stolen in transit | Goods in transit | Physical loss of goods | Recipient address breach |
| Customer injured at collection | Public liability | Injury or property damage claim | Ransomware recovery |
| Dispatch system locked | Cyber insurance | Recovery and covered downtime | Routine supplier fault, if excluded |
Business interruption has a waiting time
Business interruption means lost income after a covered event stops normal trading. Check if the policy waits 12 to 24 hours before paying.
A short but costly outage may fall inside that waiting period.
Fraud needs its own question
Phishing is a fake message that steals passwords or gets payment approval. Ask if social engineering fraud is included.
Check whether its sub-limit is lower than the main policy limit.
App and supplier failures can stop deliveries
A dispatch failure may be insured only with dependent business interruption. This covers downtime caused by an outside technology provider.
Routine glitches, maintenance and poor service may not qualify.
A loss can build up quickly
A five-driver firm may lose bookings if its allocation platform fails for two days. It may refund customers and pay staff to plan routes by hand.
Costs can include customer calls, overtime, temporary devices and insurer evidence.
A practical test: Estimate the cost of 24 hours without dispatch, email and proof-of-delivery records. Add lost sales, driver time, refunds, manual routing and outside support. That total gives a better limit starting point than one laptop’s replacement price.
Ask about third-party technology failure
Ask if cover applies to fleet management, proof-of-delivery, route planning and payment software. Ask if the supplier must suffer a malicious attack before a claim qualifies.
A dispatch incident: where costs can arise
1. Phone or login lost
Access to jobs or email
2. Routes stop
Missed collections and refunds
3. Data checked
Forensics and legal advice
4. Work restored
Recovery and customer contact
Cover may apply only if event, costs and waiting period meet policy terms.
Put realistic figures against likely incidents before choosing a limit. Consider a five-driver operation that loses cloud dispatch access for two working days.
It could lose £1,200 in delivery income. Refunds could cost £500, overtime £350 and outside IT support £750.
That creates a £2,800 loss before any policy excess. A stolen business phone could need £150 for replacement hardware.
It could also need £400 for urgent account recovery. Manual route planning could take several hours.
For phishing payment fraud, one false bank-detail change may create the main risk. Check the fraud sub-limit before assuming the full cyber limit applies.
Price, excess and exclusions need checking
UK cyber insurance cost depends on turnover, data volume, past incidents and security controls. It also depends on your chosen limit and reliance on technology.
An excess is the amount you pay before the insurer pays.
Controls insurers expect to see
Insurers expect MFA and tested backups. They also expect prompt removal of departing drivers’ access.
They may ask about phishing awareness. Keep a short plan with your software provider, bank, insurer and customer contacts.
Read the exclusions before buying
Check exclusions for unpatched systems, deliberate acts and contractual penalties. Also check unapproved transfers and known problems.
Cyber extortion support may be available. No policy guarantees every ransom payment or stops stolen data appearing online.
This approach is less relevant for a self-employed courier with no customer data. It is also less relevant without business accounts or platforms. This can include situations where payments are handled fully by third parties. Even then, check client contracts and data protection duties that may apply.
Before requesting quotes, list your apps, users, stored data and supplier links. Also list the cost of one lost trading day.
This helps you compare like-for-like terms.
For a microbusiness, the first attack hours may matter more than the final settlement. Ask if a courier cyber policy gives a 24/7 incident-response number.
Ask what happens after you call. This may include a breach coach, IT forensic support, legal advice and help notifying customers.
Some policies only repay approved costs after the event. Others arrange suppliers directly.
Check if the service covers ransomware recovery, address breaches, phishing fraud and compromised email. Check out-of-hours support before appointing your own technician.
Frequently asked questions
Does a courier need cyber insurance?
A courier may need it if phones, dispatch accounts, email or supplier platforms hold data. It may also help where those tools can stop work.
Does motor insurance cover a hacked app?
No. Motor insurance usually covers driving liability, accidents and vehicle damage. It does not usually cover hacked dispatch software.
What does cyber insurance cover for a delivery business?
It may cover forensic work, legal advice, data recovery and customer notification. It may also cover extortion and qualifying lost income.
How much cyber cover should a small courier buy?
Start with 24 hours without dispatch, email and proof-of-delivery tools. Add specialist response costs before choosing a limit.
Can I claim if my delivery software provider fails?
You can claim only if dependent business interruption is included. The cause must meet the policy definition, and routine faults are often excluded.
Choose cover around your delivery workflow
Choose cover around the tools that keep deliveries moving, not a phone’s value. Match it to dispatch, customer data, driver access, payments and suppliers.
Then compare excesses, sub-limits and waiting periods in writing.
