What is cyber insurance?
Cyber insurance pays for the cost of dealing with a cyber attack or data breach: experts to investigate and contain it, restoring your data and systems, the income you lose while you are offline, ransomware and extortion costs, and claims or regulator investigations from people whose data was exposed. It is also called cyber liability insurance, cyber cover or data breach insurance. In Kenya it is not compulsory, but the Data Protection Act 2019 makes your business answerable for the personal data it holds.
The risk in Kenya, in numbers
Kenya's national computer incident response team (KE-CIRT/CC) detected 11.12 billion cyber threat events between July 2025 and June 2026. These are attempted attacks and warning signals, not confirmed breaches, and DDoS attacks rose 114% over the year.
Source: Communications Authority of Kenya, Cybersecurity Report Q4 FY2025/26
37% of Kenyan organisations surveyed by Serianu had a cyber incident in the previous 12 months.
Source: Serianu, Africa Cybersecurity Report – Kenya 2024/25
Kenyan SMEs pay KES 2–15 million, and large companies KES 20–50 million (multinationals up to KES 100 million), to recover from a cyber attack, Serianu said in February 2026.
Source: The Star, 25 Feb 2026 (Serianu, at APA's cyber insurance launch)
Most attacks on Kenyan businesses do not need a website: they come through a staff email, a reused password, an unpatched computer or a convincing request to change a supplier's payment details.
Your own losses (first-party cover)
What the policy pays to get your business back on its feet.
Expert response
IT forensics to find and contain the attack, a lawyer to guide you on your legal duties, PR support, and the cost of notifying customers and the ODPC.
Restoring data and systems
Recovering, recreating or restoring data and software that was corrupted, encrypted or deleted.
Lost income
Profit lost and extra costs while your systems are down after a cyber incident, once any waiting period has passed.
Ransomware and extortion
Specialist negotiators and, with the insurer's consent and where the law allows, the extortion payment itself.
Claims against you (third-party cover)
What the policy pays when others hold you responsible.
Privacy and data liability
Defence costs and compensation when customers, patients or staff claim because their personal data was lost or leaked.
Network security liability
Claims when an attack on your systems spreads to, or is used against, your clients and suppliers.
Regulator investigations
Legal costs of responding to an ODPC or other regulator investigation, and fines only where they are insurable by law.
Online media liability
Defamation or copyright and trademark claims arising from your website, emails or social media content.
Fraud and stolen money: usually an add-on
Check these before you assume your money is protected.
Fake invoices and hacked email
A fraudster poses as a supplier or your director and your staff pay them. Usually covered only by a social-engineering add-on with its own sub-limit.
Hacker-made payments
Someone takes over your bank or payment account and moves money out. Funds-transfer fraud cover is normally an extension too.
M-Pesa and SIM-swap fraud
No Kenyan insurer's cyber page names these specifically. We check the wording before you rely on it.
Theft by your own staff
Belongs under fidelity guarantee or crime cover, and some of those wordings exclude computer system losses.
What cyber insurance does not cover
- War, cyber war and state-sponsored attacks
- Failure of power, internet or telecoms networks outside your control
- Incidents or circumstances you knew about before cover started
- Deliberate, dishonest or criminal acts by the business or its owners
- Physical damage to property and bodily injury (other policies cover these)
- Upgrading your systems beyond what you had before the attack
- Fines and penalties where the law does not allow them to be insured
- Money lost to fake invoices or payment fraud, unless you add social-engineering cover
Which Kenyan rules apply to your business?
Choose your type of business to see the main data and cyber rule, where you must report a breach, and whether cyber insurance is compulsory.
| Your business | Main rule | Report a breach or attack | Cyber insurance compulsory? |
|---|---|---|---|
| Any business with KES 5M+ turnover or more than 10 staff | Register with the ODPC and keep personal data secure (DPA s.41) | ODPC within 72 hours if there is a real risk of harm | No |
| Smaller businesses (below both thresholds) | Registration is optional outside the listed sectors, but the Act's security and compensation rules still apply | ODPC within 72 hours if there is a real risk of harm | No |
| Hospitals, clinics, labs & pharmacies | Must register with the ODPC whatever their size; health data is sensitive data; Digital Health Act security rules | ODPC within 72 hours | No |
| Banks & payment service providers | CBK cybersecurity guidance: board-approved strategy, testing, incident reporting | CBK within 24 hours, plus the ODPC within 72 hours | No (CBK says consider it) |
| Deposit-taking SACCOs | SASRA (April 2026): 24/7 cyber monitoring and offline backups | ODPC within 72 hours | No |
| Schools, hotels, property managers & transport firms | Must register with the ODPC whatever their size | ODPC within 72 hours | No |
| Critical infrastructure operators | CII Regulations 2024: annual cyber-risk assessments | Sector cybersecurity centre within 24 hours | No |
| Suppliers to large clients, lenders or donors | Your contract may set security and insurance conditions | As your contract says, plus the ODPC | Sometimes, by contract |
Data protection and cyber rules by type of business in Kenya (October 2026)
- Main rule
- Register with the ODPC and keep personal data secure (DPA s.41)
- Report a breach or attack
- ODPC within 72 hours if there is a real risk of harm
- Cyber insurance compulsory?
- No
- Main rule
- Registration is optional outside the listed sectors, but the Act's security and compensation rules still apply
- Report a breach or attack
- ODPC within 72 hours if there is a real risk of harm
- Cyber insurance compulsory?
- No
- Main rule
- Must register with the ODPC whatever their size; health data is sensitive data; Digital Health Act security rules
- Report a breach or attack
- ODPC within 72 hours
- Cyber insurance compulsory?
- No
- Main rule
- CBK cybersecurity guidance: board-approved strategy, testing, incident reporting
- Report a breach or attack
- CBK within 24 hours, plus the ODPC within 72 hours
- Cyber insurance compulsory?
- No (CBK says consider it)
- Main rule
- SASRA (April 2026): 24/7 cyber monitoring and offline backups
- Report a breach or attack
- ODPC within 72 hours
- Cyber insurance compulsory?
- No
- Main rule
- Must register with the ODPC whatever their size
- Report a breach or attack
- ODPC within 72 hours
- Cyber insurance compulsory?
- No
- Main rule
- CII Regulations 2024: annual cyber-risk assessments
- Report a breach or attack
- Sector cybersecurity centre within 24 hours
- Cyber insurance compulsory?
- No
- Main rule
- Your contract may set security and insurance conditions
- Report a breach or attack
- As your contract says, plus the ODPC
- Cyber insurance compulsory?
- Sometimes, by contract
Checked 6 Oct 2026. Sources are listed at the end of this page.
What the Data Protection Act means for your business
If a data breach creates a real risk of harm, you must notify the Data Commissioner within 72 hours of becoming aware of it, and tell the people affected in writing. A service provider holding data for you must tell you within 48 hours (Data Protection Act 2019, s.43).
Source: Data Protection Act 2019, s.43
The ODPC can fine a business up to KES 5 million or 1% of its annual turnover, whichever is lower (s.63). Separate criminal offences under the Act carry fines of up to KES 3 million, prison, or both (s.73).
Kenyan law does not say whether ODPC fines can be insured, and no court or regulator has ruled on it. Policies that include fines say they pay only 'where insurable by law', so treat fines cover as uncertain.
Source: Data Protection Act 2019 and regulations (silent on insurability)
Anyone who suffers damage, including distress, because a business broke the Data Protection Act can claim compensation from it, and the business is liable unless it proves it was not responsible (s.65). The ODPC can also order compensation when it decides a complaint.
Source: Data Protection Act 2019, s.65; Enforcement Regulations reg. 14
The ODPC has fined Oppo Kenya and the digital lender Whitepath KES 5 million each and Roma School KES 4.55 million, and in April 2026 ordered St Luke's Orthopaedic & Trauma Hospital, Eldoret, to pay a patient KES 525,000 after records were disclosed to the wrong person.
Cyber insurance cannot do your compliance for you, but it pays for the lawyers, forensic experts and notifications that help you meet these deadlines, and for the claims that follow a breach.
Who offers cyber insurance in Kenya?
Only three Kenyan insurers publish a cyber insurance product, and none publishes prices, limits or a policy wording. We also approach insurers that quote cyber on request.
| Insurer | How it is sold | Who it is for | What the insurer highlights |
|---|---|---|---|
| APA Insurance | Standalone cyber policy (launched February 2026) | Large companies and SMEs | Local incident-response specialists; cover extends to lost devices, paper records and insider misuse |
| Britam | Standalone cyber policy (in the market since 2019) | All businesses, corporates and SMEs | Data restoration, reputational costs, cyber extortion, business interruption and media liability |
| NCBA Insurance (formerly AIG Kenya) | Standalone policy with optional add-ons | Corporates and SMEs | 24/7 breach hotline; free IT forensics, legal and PR advice on discovery; insurable regulatory fines |
| Geminia | A cyber and computer-crime section of its Bankers Blanket policy | Banks, SACCOs and microfinance institutions | For financial institutions only; not a standalone cyber policy |
- How it is sold
- Standalone cyber policy (launched February 2026)
- Who it is for
- Large companies and SMEs
- What the insurer highlights
- Local incident-response specialists; cover extends to lost devices, paper records and insider misuse
- How it is sold
- Standalone cyber policy (in the market since 2019)
- Who it is for
- All businesses, corporates and SMEs
- What the insurer highlights
- Data restoration, reputational costs, cyber extortion, business interruption and media liability
- How it is sold
- Standalone policy with optional add-ons
- Who it is for
- Corporates and SMEs
- What the insurer highlights
- 24/7 breach hotline; free IT forensics, legal and PR advice on discovery; insurable regulatory fines
- How it is sold
- A cyber and computer-crime section of its Bankers Blanket policy
- Who it is for
- Banks, SACCOs and microfinance institutions
- What the insurer highlights
- For financial institutions only; not a standalone cyber policy
The right choice depends on your sector, the records you hold and how you take payments. We set each insurer's limits, add-ons and conditions side by side for you.
Doesn't my other insurance cover this?
Usually not. Traditional policies were written for physical risks, which leaves gaps after a cyber attack.
| Cover | What it pays for | Where it stops for cyber |
|---|---|---|
| Professional indemnity | Claims that your professional advice or service was negligent | Does not pay your own costs after an attack: forensics, data restoration, ransom or notifying customers |
| Electronic equipment | Physical damage to computers and devices | Restores data only after physical damage, not after a hack or a virus |
| Business interruption (fire policy) | Lost profit after a fire or other insured physical damage | A cyber outage with no physical damage does not trigger it |
| Fidelity guarantee | Money or property stolen by your employees | Some Kenyan wordings exclude computer system losses |
| Cyber insurance | Your response and recovery costs, lost income and claims against you after a cyber incident | Fake-invoice fraud usually needs an add-on |
- What it pays for
- Claims that your professional advice or service was negligent
- Where it stops for cyber
- Does not pay your own costs after an attack: forensics, data restoration, ransom or notifying customers
- What it pays for
- Physical damage to computers and devices
- Where it stops for cyber
- Restores data only after physical damage, not after a hack or a virus
- What it pays for
- Lost profit after a fire or other insured physical damage
- Where it stops for cyber
- A cyber outage with no physical damage does not trigger it
- What it pays for
- Money or property stolen by your employees
- Where it stops for cyber
- Some Kenyan wordings exclude computer system losses
- What it pays for
- Your response and recovery costs, lost income and claims against you after a cyber incident
- Where it stops for cyber
- Fake-invoice fraud usually needs an add-on
Four terms that decide whether a claim is paid
Call first, spend second
Policies give you an incident line and approved forensic, legal and PR experts. Ransom payments, and usually other costs, need the insurer's consent first, so call before you spend.
Fraud sub-limits
Losses from fake invoices and hacked email are usually covered only by a social-engineering add-on, with its own lower sub-limit and excess. It often pays only if staff followed a call-back or dual-approval check.
Waiting periods
Business interruption cover can start only after a waiting period, so losses in the first hours of an outage stay with you. Check how long it is, and whether an IT supplier's outage counts.
Security conditions
Your cover rests on the security you declare on the proposal form: multi-factor authentication, tested offline backups, software updates and staff training. Answer accurately and keep those controls in place, or a claim can be reduced or refused.
We check these four terms on every cyber quote and explain them to you in plain English before you buy.
How much does cyber insurance cost in Kenya?
No Kenyan insurer publishes cyber rates, so these are planning ranges published by Kenyan intermediaries in 2026, not a tariff. Your premium depends on your sector, the records you hold, your security controls, your claims history, and the limit and excess you choose.
| Business size (annual revenue) | Indicative premium |
|---|---|
| Small: KES 5M – 20M | 80,000 – 200,000 |
| Medium: KES 20M – 100M | 200,000 – 500,000 |
| Large: over KES 100M | 500,000 – 2,000,000+ |
Indicative annual cyber insurance premium by business size (KES a year)
- Indicative premium
- 80,000 – 200,000
- Indicative premium
- 200,000 – 500,000
- Indicative premium
- 500,000 – 2,000,000+
Limits commonly range from KES 5 million for a small business to KES 250 million or more for large companies. Statutory levies of 0.45% plus KES 40 stamp duty are added to the premium.
What insurers ask before they quote
- Business name and KRA PIN
- What the business does, annual turnover and number of staff
- The personal data you hold (customer, staff, card or health records) and roughly how many records
- How you take payments: M-Pesa till or paybill, cards, online checkout
- Your security: multi-factor authentication, offline backups you have tested, software updates, antivirus and staff training
- Any past cyber incidents or losses
- The limit and excess you want, and any contract that requires cover
Strong controls, especially multi-factor authentication and tested offline backups, make cover easier to get and can lower your premium.
If you are hacked: the first 24 hours
- Call your insurer's incident line, or us, as soon as you notice the attack. Early notice is a policy condition and gets experts to you fast.
- Disconnect affected computers from the network, but do not wipe, reset or rebuild them before the forensic team has looked.
- Do not pay a ransom or reply to the attackers without the insurer's consent.
- Write down when you first became aware of the breach: the 72-hour deadline to notify the ODPC starts then.
- Change passwords from a clean device and warn staff and key customers about fake payment requests in your name.
- Keep a record of every cost and every hour of lost trading for the claim.
Why arrange cyber insurance through Naveah Capital?
We compare the cyber market
Few Kenyan insurers publish a cyber product. We approach them, and others that quote on request, and set their terms side by side.
We read the small print
Fraud sub-limits, waiting periods, consent clauses and security conditions: the details that decide a claim.
We help with the questionnaire
Insurers price on your security controls. We help you answer the proposal form accurately, so a claim is not refused over a wrong answer.
We stay with you after an attack
From the first call to the insurer's incident line, through the ODPC deadline, to the claim settlement.
Frequently asked questions
What is cyber insurance?
Cyber insurance pays for the cost of dealing with a cyber attack or data breach: experts to investigate and contain it, restoring your data and systems, income lost while you are offline, ransomware and extortion costs, and claims or regulator investigations from people whose data was exposed. It is also called cyber liability insurance, cyber cover or data breach insurance.
Is cyber insurance compulsory in Kenya?
No. No Kenyan law or regulator makes cyber insurance compulsory for any sector (checked October 2026). CBK tells banks and payment service providers to consider it, and a client, lender, donor or tender may require it in a contract. What the law does require is that you protect personal data, register with the ODPC if you meet its thresholds, and report serious breaches within 72 hours.
How much does cyber insurance cost in Kenya?
No Kenyan insurer publishes cyber rates; every policy is priced individually. Estimates published by Kenyan intermediaries in 2026 put small businesses at roughly KES 80,000–200,000 a year, medium businesses at about KES 200,000–500,000 and large companies from KES 500,000 to KES 2 million or more. Statutory levies of 0.45% plus KES 40 stamp duty are added.
Does cyber insurance cover ransomware?
Usually, yes. Kenyan cyber policies list cyber extortion and ransomware, paying for specialist negotiators, restoring your systems and the income you lose. Some also pay the ransom itself where the law allows, but only with the insurer's consent, and some put ransom under its own sub-limit or excess. Check the extortion section before you rely on it.
Does it cover fake invoices, hacked email or M-Pesa fraud?
Not automatically. Money lost to fake invoices, hacked email or diverted payments (social engineering) is usually covered only if you add a social-engineering or cybercrime extension, with its own lower limit and excess, and often only if staff followed a call-back or dual-approval check. No Kenyan insurer's cyber page names M-Pesa or SIM-swap fraud specifically, so we check the wording for you.
Are ODPC fines covered?
Possibly, but do not count on it. The Data Protection Act does not say whether ODPC fines can be insured, so policies that include fines pay only 'where insurable by law'. The ODPC can fine up to KES 5 million or 1% of annual turnover, whichever is lower. Policies cover more reliably the legal cost of responding to an ODPC investigation and compensation claims from the people affected.
Does a small business with no website need cyber insurance?
Often, yes. If you rely on email, staff phones, an M-Pesa till, cloud files or customer records, you can be attacked or tricked into paying a fraudster. Serianu says Kenyan SMEs spend KES 2–15 million recovering from an attack, and APA, Britam and NCBA Insurance all offer cyber cover to SMEs.
What does cyber insurance not cover?
War and state-sponsored attacks, failures of power, internet or telecoms networks, incidents you knew about before cover started, deliberate or criminal acts by the business or its owners, physical damage and injury, upgrading your systems beyond what you had, and fines where the law does not allow them to be insured. Fake-invoice fraud needs an add-on.
Doesn't my business or professional indemnity insurance already cover this?
Rarely. Professional indemnity covers claims that your professional work was negligent, not your own recovery costs. Electronic equipment cover pays for physical damage and restores data only after physical damage. Business interruption on a fire policy needs physical damage to start, and some fidelity guarantee wordings exclude computer system losses. A cyber policy fills those gaps.
What do I need to get a cyber insurance quote?
Your business details and turnover, the type and number of personal records you hold, how you take payments, your security controls (multi-factor authentication, offline backups, software updates, staff training), any past incidents and the limit you want. We send you the insurer's proposal form and help you complete it accurately.
What should I do if my business is hacked?
Call your insurer's incident line, or us, straight away. Disconnect affected devices but do not wipe them, do not pay or reply to attackers without the insurer's consent, and note when you became aware: you may need to notify the ODPC within 72 hours. Keep a record of every cost and lost sale for the claim.
Why buy cyber insurance through Naveah Capital?
Few Kenyan insurers publish a cyber product and none publishes prices or wordings, so the terms are hard to compare yourself. We get quotes, put the limits, sub-limits, waiting periods and exclusions side by side, help with the security questionnaire, and stay with you if you have to claim. Our advice costs you nothing extra.
Find out what cyber cover would cost
Tell us what your business does and its turnover. We compare insurers' cyber terms and come back with options.
Licensed by IRA · No obligation · We reply within 1 hour
Sources
- Communications Authority of Kenya, Cybersecurity Report Q4 FY2025/26
- Serianu, Africa Cybersecurity Report – Kenya 2024/25
- The Star, 25 Feb 2026 (Serianu, at APA's cyber insurance launch)
- ODPC Guidance Note on Registration of Data Controllers and Data Processors
- Data Protection Act 2019, s.65; Enforcement Regulations reg. 14
- ODPC Guidance Note on Processing of Health Data; Digital Health Act 2023
- CBK Guidance Note on Cybersecurity for the Banking Sector (2017)
- Sacco Review, Apr 2026 (SASRA directive)
- Computer Misuse and Cybercrimes (Critical Information Infrastructure and Cybercrime Management) Regulations 2024
- DPA 2019, CBK guidance, CMCA regulations 2024, IRA and SASRA guidance (checked Oct 2026)
- Data Protection Act 2019, s.43
- Data Protection Act 2019, s.63 and s.73
- Data Protection Act 2019 and regulations (silent on insurability)
- ODPC penalty notices and determinations, 2022–2026
- APA Insurance, Cyber Insurance (product page and Feb 2026 launch)
- Britam, Cyber Insurance (product page and brochure)
- NCBA Insurance, Cyber Insurance
- Geminia, Bankers Blanket Insurance
- Kenyan insurer and intermediary cyber pages (APA, Britam, NCBA Insurance and others), checked 6 Oct 2026
- Indicative cyber premium ranges published by Kenyan insurance intermediaries, checked 6 October 2026
Facts and published prices checked 6 Oct 2026; last reviewed October 2026 by Naveah Capital. Premium ranges are planning estimates, not a quote or a promise. Naveah Capital Insurance Agency is an IRA-licensed insurance agency in Nairobi; this page is general information, and your policy wording decides your cover.
IRA Licensed
KSB Member
Reviews 4.9