IT Services in India: Managing Cyber Risk and Professional Liability

India's IT services industry generated revenues exceeding USD 245 billion in FY2025, employing over 5.4 million professionals across Bengaluru, Hyderabad, Pune, Chennai, and Gurugram. The sector spans IT outsourcing, business process management, software product development, cloud services, and emerging areas like AI/ML services.

From an insurance perspective, IT services companies face two primary risk categories: cyber risk (data breaches, ransomware, system failures) and professional liability (errors, omissions, and contractual failures in service delivery). Unlike manufacturing, physical asset exposure is minimal — the risk is overwhelmingly in the digital and contractual domain. This makes accurate risk assessment challenging for traditional underwriters accustomed to tangible property risks.

Indian IT services companies are both targets and custodians of cyber risk. They process and store vast volumes of client data, including personally identifiable information (PII) of millions of end-users across multiple jurisdictions. A data breach at an Indian IT services provider can trigger notification obligations under GDPR (for European clients), CCPA (for Californian clients), and the Digital Personal Data Protection Act, 2023 (DPDP Act) domestically.

CERT-In reported over 1.39 million cybersecurity incidents in 2023 alone. Ransomware attacks targeting Indian IT companies have increased sharply, with average ransom demands reaching INR 5-15 crore for mid-sized firms. The CERT-In Directions of April 2022 mandate six-hour incident reporting, VPN log maintenance, and system clock synchronisation — compliance failures carry penalties and can invalidate insurance claims.

Professional indemnity (PI) or Technology Errors and Omissions (Tech E&O) insurance is the foundational coverage for IT services companies. It covers claims arising from negligent acts, errors, or omissions in the provision of professional services — software bugs that crash a client's system, project delivery failures, data migration errors, or inadequate cybersecurity implementations.

Master Service Agreements (MSAs) with global clients routinely mandate PI cover with minimum limits of USD 5-10 million. Indian IT companies servicing BFSI clients face particularly stringent requirements, as financial regulators in the US, UK, and EU require their regulated entities to ensure vendor insurance adequacy. Premium rates for Tech E&O in India typically range from 0.3-0.8% of the limit of indemnity, depending on revenue, client concentration, and claims history.

The Digital Personal Data Protection Act, 2023 represents a watershed for Indian IT companies' liability exposure. The Act imposes obligations on data fiduciaries and data processors regarding consent, purpose limitation, data minimisation, and breach notification. Penalties for non-compliance can reach INR 250 crore per instance.

For IT services companies acting as data processors for their clients, the DPDP Act creates direct statutory liability that supplements existing contractual obligations. Cyber insurance policies must be evaluated for whether they adequately cover DPDP Act regulatory defence costs, penalty coverage (where insurable), and breach notification expenses. Underwriters are increasingly assessing data governance frameworks, privacy impact assessments, and data protection officer appointments when evaluating cyber risk for IT companies.

Business interruption for IT services companies manifests differently from physical-damage-triggered BI. A ransomware attack rendering systems inoperable, a cloud service outage, or a DDoS attack can halt service delivery across multiple client engagements simultaneously without any physical damage occurring.

Cyber business interruption coverage — available as an extension within cyber insurance policies — addresses this gap. However, waiting period deductibles (typically 8-12 hours), sub-limits, and the challenge of quantifying revenue loss for project-based businesses create coverage adequacy questions. An IT company in Bengaluru that suffered a 72-hour ransomware-induced outage estimated its combined revenue loss and recovery costs at INR 22 crore, underscoring the need for adequate limits.

A well-structured insurance programme for an Indian IT services company should include: cyber liability insurance covering first-party losses (breach response, data recovery, business interruption) and third-party claims (privacy liability, regulatory defence); professional indemnity / Tech E&O covering service delivery failures; directors and officers liability given increasing personal accountability under DPDP Act and Companies Act; and crime/fidelity insurance covering employee fraud and social engineering losses.

The key challenge is ensuring these policies work together without gaps or overlaps. A claim may involve elements of cyber breach, professional negligence, and regulatory investigation simultaneously. Policy wordings must be reviewed for consistency in trigger definitions, hammer clauses, and allocation of defence costs across overlapping coverages.