A cyber insurance policy sounds like full protection once someone breaks into your account or encrypts a device. In a claim, however, the wording of the policy terms often decides the outcome, not the headline on the product page. This guide explains which clauses matter, where insurers typically draw the line and how to check what is really covered before you sign. For a general overview of private cover, see our article on private cyber insurance.
Short answer: A cyber insurance policy only pays within the agreed cover. Exclusions, policy duties and your answers in the application determine whether a loss is paid. If you breach a duty, section 28 of the German Insurance Contract Act (VVG) sets the consequences: intentional breaches can lead to a full loss of cover, and grossly negligent breaches allow a reduction. Last updated: November 2026.
The most important points at a glance
- Only what the policy terms name is covered. If a risk is missing from the contract, there is generally no protection for it.
- Exclusions remove certain events or types of loss. They often appear in their own section after the description of cover.
- Policy duties (Obliegenheiten) are obligations you must meet before a loss happens. Breaching them can affect your claim.
- For gross negligence, the insurer may reduce its payment in proportion to the seriousness of the fault (section 28 para. 2 VVG).
- Answer all questions in the application completely. Incorrect answers can have consequences under section 19 VVG.
What exactly is an exclusion, and why is it buried so deep?
An exclusion defines which events or losses the policy does not cover. Insurers usually place them in a section that follows the description of benefits. There you may find that certain types of loss, financial losses or incidents arising from particular situations are left out. Which exclusions apply differs between providers and tariffs, so comparing the terms directly is more useful than reading advertising claims.
Which policy duties apply before a loss?
Policy duties are behavioural obligations you must keep before the insured event occurs, for example security measures the contract requires. The law governs the consequences of a breach in section 28 VVG. Under this provision, the insurer may terminate the contract within one month of learning about the breach, without observing a notice period. This right to terminate does not apply if the breach was neither intentional nor grossly negligent.
For the benefit itself, the degree of fault is decisive. The table below summarises how the section is structured. It does not replace a review of your own contract.
| Case under section 28 VVG | Possible consequence | What you can do |
|---|---|---|
| Intentional breach | Full loss of cover, if the contract provides for it (para. 2) | Read the contractual requirements and follow them consistently |
| Grossly negligent breach | Reduction of the payment according to the seriousness of the fault (para. 2) | Be able to show that you took due care, because you carry the burden of proof |
| Breach without causing the loss | Benefit remains payable (para. 3), except for fraudulent breaches | Still report the loss and document the lack of connection |
How do answers in the application affect your cover?
Before the contract is concluded, you must disclose the circumstances the insurer asks about. Section 19 VVG governs this duty. It is not unlimited: whether a breach has consequences depends on how it came about. Under section 19 para. 3 VVG, the insurer loses its right to withdraw if the duty to disclose was breached neither intentionally nor through gross negligence. Still, answer questions about devices, use and security measures fully and honestly.
When does the insured risk change?
If an insured risk increases after the contract begins, section 23 VVG on increases in risk applies. One example would be using a device for work when the policy assumes purely private use. Report such changes early, so that you do not have to argue about a later disclosure when a claim arises.
Which exclusions should you look for first?
In cyber cover, certain clauses are frequent points of dispute. When you review a tariff, look specifically for the following points:
- Whether losses caused by phishing, fraud or incorrectly executed transfers are covered. Tariffs differ considerably on this point.
- Which security measures the contract names as a condition, for example access protection or data backups.
- Whether use for self-employed or professional activity is excluded.
- Whether exclusions apply to incidents that were already known or occurred before the policy started.
- Which deadline applies for reporting a loss, and in which form the report must be made.
- Whether deductibles, sublimits or maximum amounts apply to particular types of loss.
An everyday example
Assumption: after a fake invoice email, you confirm a payment and the money is gone. Whether the cyber policy pays depends on the tariff. If fraud and misdirected transfers are expressly named in the benefits, that is a first indication. If the exclusions section contains a clause on payments that the insured person triggers themselves, the claim becomes difficult. This is exactly where the product sheet alone is not enough.
How do you find the relevant clauses?
- Read the complete policy terms, not only the product sheet. Search specifically for the headings exclusions, policy duties and reporting obligations.
- Note every security requirement and check whether you can realistically keep it in daily life.
- Compare two or three tariffs using the same clauses in a table of your own.
- Ask the provider in writing how it would assess a specific case before you sign.
If you would like to go through the terms with someone, you can arrange a personal consultation with Academycon. The process is described on the page How we work.
Frequently asked questions
Does cyber insurance pay out after phishing?
That depends on the tariff. Check whether phishing and fraud are named in the benefits and whether exclusions apply to payments you trigger yourself. There is no general answer, because the terms differ.
Can the insurer be completely released from liability because a security measure was missing?
Yes, if the contract provides for loss of cover for this duty and you breach it intentionally. For gross negligence, the insurer may reduce its payment. If there is no causal link between the breach and the loss, the benefit remains payable under section 28 para. 3 VVG, unless the breach was fraudulent.
Do I have to report a loss immediately?
The policy terms set reporting deadlines, and the exact deadline is in your contract, not in this guide. Regardless of the deadline, reporting early makes it easier to establish the cause and the extent of the loss.
Is cyber insurance the same as contents insurance?
No. Contents and liability policies cover different risks. Whether cyber risks such as data theft or extortion are included there depends on the specific terms. For an overview of basic cover, see our article on insurance during studies (in German).
Is cyber insurance worth it if I only browse privately?
The article on private cyber insurance (in German) answers this question in more detail. In short, even a private tariff only reaches as far as its clauses allow.
What to do now
- Read the exclusions and policy duties in full before you submit an application.
- Answer all questions in the application and keep a copy for your records.
- Set up your devices according to the security requirements named in the contract.
- Report changes in use, such as professional use, promptly.
Related guides
- Insurance for students: an overview (in German), as a starting point for all topics in this group
- Cyber insurance for private individuals: is it worth it for students?
- Cyber protection in the home office: what new graduates should cover
- Insurance during studies: liability, contents and accident cover (in German)
Sources: Section 28 VVG, breach of a contractual duty (in German) (accessed November 2026); Section 19 VVG, duty to disclose (in German) (accessed November 2026); Section 23 VVG, increase in risk (in German) (accessed November 2026).
Last updated: November 2026. This guide is general information, not individual advice.
