A data company sells something you can't see or touch. A pipeline that cleans a client's customer records, a platform that turns event data into dashboards, an enrichment API that adds firmographics to a CRM, a consultancy that builds a forecasting model for a retailer's buying team. When it works, nobody notices. When it goes wrong, three different problems can land at once: the client loses money because they relied on bad numbers, people whose personal data you hold have legal rights against you, and the client's contract says you'll pay for all of it.

This guide is for UK data and analytics startups: data processing and engineering firms, data brokers and enrichment providers, analytics and business intelligence (BI) platforms, embedded analytics vendors, and BI or data science consultancies. It explains which insurance a data business needs, how UK data protection law decides who carries the liability, and how to read the data protection schedule an enterprise client sends you before you sign it.

Two boundaries first. If your product trains or runs machine learning models that make or shape decisions, the model risk (biased outputs, hallucinated summaries, automated decisions) is covered on AI Insurance for UK Startups; this page doesn't repeat it. If you sell marketing technology, where most of the risk is consent for email, SMS and cookies, read Martech Insurance for UK Startups. This page is about the business of collecting, processing, combining, analysing and supplying data.

Mesh'd Limited trading as Meshed is authorised and regulated by the Financial Conduct Authority under firm reference number 1033248. We arrange cover from the insurers on our panel and charge a flat 10% broker fee, with no admin add-ons. We don't publish prices, because the premium for a data business depends on what data you hold, whose it is, what clients do with your output, and what you've signed. Named customer quotes are off.

In one paragraph

Most UK data and analytics startups need technology professional indemnity (tech PI, also called tech E&O) and cyber as a pair, because the two claims you're most likely to face are "your output was wrong and we relied on it" and "you lost or exposed personal data". Add directors' and officers' (D&O) once you have outside investors or a board, employers' liability once you employ staff (a legal requirement in Great Britain, minimum £5 million), and crime if a payment-diversion fraud against your own business would hurt. Data brokers and enrichment providers need extra care, because they're usually a controller of the data they sell, and that changes both the law and the policy wording that matters.

Four types of data business, four risk profiles

"Data company" covers very different risks. Underwriters will place you in one of these profiles, or a blend, and the right wording follows from that.

1. The processing platform or data engineering firm

You move, transform, store or host data for clients under their instructions: ETL and pipeline tools, data warehouses run as a managed service, data cleansing and matching, migration projects. In data protection terms you're usually a processor: you act on behalf of the client, who decides why and how the personal data is used.

• Main exposures: a breach of client data in your environment, a pipeline bug that corrupts or deletes records, an outage that stops a client's reporting, a sub-processor failure that's legally your problem.

• Lead covers: cyber (including liability to clients and your own incident costs) and tech PI, with business interruption thinking for outages. See SaaS Business Interruption Insurance for UK Startups.

2. The data broker or enrichment provider

You build datasets and sell or license them: B2B contact data, company and firmographic data, location or footfall data, consumer segments, enrichment APIs that append attributes to a client's records. You decide what data to collect and why. That usually makes you a controller in your own right.

• Main exposures: challenges to how you source data, transparency failures (people don't know you hold their data), complaints and rights requests at volume, regulator scrutiny, inaccurate-data claims from clients, and IP claims over how datasets were compiled.

• Lead covers: tech PI with media and IP extensions, cyber with strong regulatory and privacy liability sections, D&O earlier than you'd expect. Underwriters ask more questions here than for any other profile on this page.

3. The analytics or BI platform

You sell software that turns a client's data into dashboards, reports, metrics, forecasts or alerts. The client loads their data; your product calculates and displays. You're usually a processor of the client's personal data, and a controller of your own account and usage data.

• Main exposures: a calculation error or a broken integration that produces wrong numbers a client relies on (pricing, stock, revenue reporting, regulatory returns), a multi-tenant breach that exposes one client's data to another, and outages at reporting deadlines.

• Lead covers: tech PI and cyber in roughly equal weight. If your clients are regulated firms and use you for compliance outputs, also read RegTech Insurance for UK Startups.

4. The BI or data science consultancy

You sell expertise: dashboards built to order, data strategy, analysis projects, warehouse builds, fractional data teams, working inside client systems or on extracts in your own environment.

• Main exposures: negligent advice or analysis (a forecast the client built a decision on), missed deadlines, staff mishandling client data, contractor and freelancer arrangements that leave gaps.

• Lead covers: professional indemnity first, then cyber if you hold client data on your own systems. Our general guide to Professional Indemnity Insurance UK explains how PI works; the sections below cover what's specific to data work.

Many startups are a blend (an analytics platform with an enrichment add-on is part profile 3, part profile 2), and the proposal form needs to say so.

Controller or processor? The question that decides your exposure

UK data protection law gives different duties, and different liability, to controllers and processors. Underwriters ask which you are, and the answer changes how a claim would play out.

Under Article 4 of the UK GDPR, a controller decides the purposes and means of processing personal data, and a processor processes personal data on a controller's behalf. Article 28 says the processing must be governed by a written contract that sets out what the processor may do, including that it processes personal data only on the controller's documented instructions, keeps it confidential, takes the security measures Article 32 requires, helps the controller meet its obligations, deletes or returns data at the end, and allows audits.

Four rules in the UK GDPR matter most for insurance:

• Processors can be liable to individuals. Under Article 82(2), a controller is liable for damage caused by processing that infringes the UK GDPR. A processor is liable only where it hasn't complied with obligations aimed specifically at processors, or has acted outside or against the controller's lawful instructions.

• Liability to the individual can be for the whole damage. Under Article 82(4), where more than one controller or processor is involved in the same processing and each is responsible, each can be held liable for the entire damage, so the individual gets compensated. Article 82(5) then lets the one who paid claim back the other's share. So you can be pursued first and left to recover from your client or supplier later.

• Step outside instructions and you become a controller. Article 28(10) says that a processor that infringes the regulation by determining the purposes and means of processing is treated as a controller for that processing. Reusing client data to improve your own product, build benchmarks, or enrich another client's dataset can trip this rule if the contract doesn't allow it.

• You stay responsible for your sub-processors. Under Article 28(4), if your sub-processor (your cloud host, a support tool, an offshore labelling team) fails to meet its data protection obligations, you remain fully liable to the controller for its performance.

So describe your role product by product on the proposal form, rather than calling yourself "a processor" across the board, and check that your cyber policy's privacy liability section covers you both as processor and as controller, and covers liability you take on under a data processing agreement, not just liability imposed by law.

Where claims against data companies come from

Six claim patterns cover most of what a data or analytics startup could face. For each one, here's what happens, which policy should respond, and where the gaps tend to be.

1. The wrong number. A transformation step double-counts refunds for two quarters. The client's finance team reports inflated revenue to its board and lender, then has to restate. They claim the cost of the restatement, the advisers they hired to fix it, and the loss from decisions made on bad figures. Policy: tech PI. Watch for: exclusions for "financial guarantees" or for failing to meet a performance standard you promised, and contract clauses that make you guarantee accuracy rather than promise reasonable care.

2. The breach. An attacker gets into a misconfigured storage bucket holding a client's customer records. You need forensic investigators, lawyers and a notification plan; the client needs your help with its own obligations; individuals may claim. Policy: cyber. Watch for: conditions about multi-factor authentication and backups that you must meet, how the policy treats incidents at your cloud provider, and whether contractual liability to the client is covered.

3. The unlawful source. A regulator or individuals challenge how your dataset was built: scraped against a site's terms, bought from a supplier with no lawful basis to sell it, or combined in ways people weren't told about. Policy: cyber privacy liability and regulatory sections, sometimes tech PI. Watch for: exclusions for "wrongful collection" of data, which some wordings include, and whether defence costs for regulatory investigations are covered.

4. The IP claim. A data owner says you copied a substantial part of their database, or a client says your deliverable infringes someone else's rights. In the UK, a database can be protected by copyright and by a separate database right, which is infringed by extracting or re-utilising all or a substantial part of its contents without consent (Copyright and Rights in Databases Regulations 1997, regulations 13 and 16). Policy: tech PI with an IP or media extension. Watch for: patent exclusions (common and usually fine for data businesses) and exclusions for deliberate breaches of licence terms.

5. The regulator. The Information Commission investigates after a complaint or breach report. You need lawyers even if no fine follows. Policy: cyber regulatory defence costs. Watch for: whether fines are covered at all (see below), and whether the policy needs a breach to trigger cover or responds to a stand-alone investigation.

6. The indemnity. Your enterprise contract says you'll indemnify the client, uncapped, for "any losses arising from a breach of this data protection schedule". The client claims costs a court might never have awarded. Policy: possibly none. Most PI and cyber policies cover liability you would have had anyway, and limit or exclude liability you only have because you agreed to it in a contract. This is the gap that catches the most data startups, and it's dealt with in the clause section below.

The policies, one by one

Technology professional indemnity (tech PI / E&O)

This is the policy for "you got it wrong and we lost money". For a data business, check that it covers:

• Your services and your software. Advice-only PI wordings can fit a platform badly; tech PI combines both.

• Breach of contract, not only negligence. Most data disputes are framed as contract claims. Where you supply a service in the course of a business, the law implies a term that you'll carry it out with reasonable care and skill (Supply of Goods and Services Act 1982, section 13). Contracts often go further, and your PI should cover civil liability broadly, not only negligence.

• Data loss and corruption at a client. Make sure a claim for corrupted or deleted client data isn't pushed out of PI and left uncovered by cyber.

• IP infringement, excluding patents if necessary.

• Retroactive date. PI is usually written on a claims-made basis, so it responds to claims made during the policy period for work done after the retroactive date. Don't let it reset when you change insurer: a data error can surface long after the work.

• A limit that fits your exposure, not just the number in a client's template.

Cyber

Cyber has first-party sections for your own incident costs (forensics, legal advice, notification, data restoration, business interruption, extortion response) and third-party sections for liability to clients and individuals and for regulatory investigations. Our Cyber Insurance UK guide explains the product. For a data business, check:

• Privacy liability as controller and as processor, including data you hold for clients.

• Breach notification support. As a processor, you must notify the controller without undue delay after becoming aware of a personal data breach (UK GDPR Article 33(2)). The controller must usually notify the Information Commission within 72 hours where feasible, unless the breach is unlikely to result in a risk to individuals (Article 33(1)). Your clients will want contractual notice windows tighter than "without undue delay", so the incident response provider in your policy must be able to move quickly.

• Security conditions. Underwriters expect multi-factor authentication, tested backups, patching and access control. Article 32 requires security appropriate to the risk. The UK government's Cyber Essentials scheme covers five basic technical controls, and Cyber Essentials Plus adds independent testing; many enterprise buyers ask for one or the other.

• Contractual liability, especially liability under data processing agreements.

• Cloud and dependency outages, if you stop when a key provider stops.

Directors' and officers' (D&O)

D&O covers directors personally for claims about how they ran the company. For data businesses it matters early, because regulators, investors and liquidators can all ask what the board knew about data practices. UK company law limits how far a company can protect its own directors: section 232 of the Companies Act 2006 makes most company indemnities for a director's liability void, but section 233 allows the company to buy insurance for them. That's why D&O exists as a separate policy. See Directors and Officers Insurance UK.

Employers' liability, crime and the rest

• Employers' liability is compulsory once you employ staff in Great Britain, with a minimum of £5 million for any one occurrence (Employers' Liability (Compulsory Insurance) Regulations 1998, regulation 3). See Employers' Liability Insurance UK.

• Crime covers theft by employees and, depending on the wording, social engineering fraud such as fake supplier bank details. See Crime and Fidelity Insurance for UK Startups.

• Public liability is usually a small line unless you have visitors, events, or staff on client premises.

Data brokers and enrichment: the transparency problem

If you sell or license data about people you've never dealt with, the most important legal duty is to tell them. Article 14 of the UK GDPR sets out the information a controller must give people when it gets their personal data from somewhere other than them: who you are, why you're processing their data and on what legal basis, the categories of data, who receives it, where it came from, and their rights. Article 14(3) says this must be provided within a reasonable period and at the latest within one month, or earlier if you contact the person or disclose the data to someone else. Exceptions exist, including where providing the information is impossible or would involve disproportionate effort (Article 14(5)), but they're narrow and you must be able to justify relying on them.

The leading UK case is the Information Commissioner's 2020 enforcement notice against Experian's marketing services business, issued after a two-year investigation into how credit reference agencies used people's personal data for direct marketing. Experian appealed. The First-tier Tribunal allowed most of the appeal in February 2023, and the Upper Tribunal dismissed the Commissioner's further appeal in April 2024 ([2024] UKUT 105 (AAC)). The regulator didn't take it further. The lesson isn't that transparency doesn't matter. A large, well-advised business spent more than three years in the tribunals, after a two-year investigation, arguing over privacy notices, what people would reasonably expect, and the effort of telling them. A startup facing the same questions needs legal defence costs cover in place before they arrive.

Practical steps that help both your compliance and your insurance:

• Map your sources. For every dataset, record where it came from, under what terms, and on what lawful basis under Article 6. Since the Data (Use and Access) Act 2025 the list of lawful bases includes a "recognised legitimate interest" (Article 6(1)(ea)), which covers specific listed purposes. Most commercial data selling still relies on ordinary legitimate interests under Article 6(1)(f), which needs a balancing test you can show.

• Carry out a data protection impact assessment (DPIA) where processing is likely to result in a high risk to individuals (Article 35). The ICO's list of processing likely to be high risk includes data matching (combining, comparing or matching personal data from multiple sources) and "invisible processing", where data wasn't obtained from the person and the controller relies on the Article 14 disproportionate effort exception.

• Handle complaints properly. Since 19 June 2026, people can complain directly to a controller about an alleged infringement, and the controller must make it easy to complain (for example, with an electronic complaint form), acknowledge the complaint within 30 days and respond without undue delay (Data Protection Act 2018, section 164A).

• Check supplier contracts. If you buy data, get warranties about how it was collected and an indemnity from a supplier that's good for the money, and keep records of processing (Article 30).

Fines, penalties and what insurance can't do

UK data protection fines can be large. The Data Protection Act 2018 (section 157) sets two maximums for infringements of the UK GDPR: the higher maximum is £17.5 million or 4% of total annual worldwide turnover for an undertaking, whichever is higher, and the standard maximum is £8.7 million or 2%. Article 83 of the UK GDPR says which infringements fall into which band.

Whether a fine can be insured is a different question. Many cyber policies cover fines and penalties only "where insurable by law", and UK law doesn't clearly allow a business to insure itself against a regulatory penalty for its own wrongdoing. Treat fines cover as uncertain and focus on what insurance reliably does: pay for lawyers to respond to an investigation, pay to fix the incident, and pay compensation and defence costs for civil claims.

The same caution applies to clients. If a client asks you to promise to reimburse their regulatory fines, don't agree without legal advice. You may be accepting a liability that no policy will meet.

Group claims and the "loss of control" question

One incident at a data company can affect many people at once. In Lloyd v Google LLC [2021] UKSC 50, the Supreme Court refused to let a representative claim for damages proceed on behalf of more than four million iPhone users under the old Data Protection Act 1998, because compensation required each person to show damage or distress, which would need individual assessment. That made one form of mass data claim harder to bring, but it didn't end group litigation: Article 82 of the UK GDPR allows compensation for material or non-material damage, and claimants can still join together. Size the cyber limit for a many-claimant scenario and check how the policy aggregates claims from one incident.

Reading an enterprise client's data protection schedule

Enterprise clients (banks, retailers, health organisations, public bodies) will send a master services agreement with a data protection schedule, and usually a security questionnaire as well. Here's how the common clauses interact with your insurance.

Under the Unfair Contract Terms Act 1977, a clause that limits your liability when you deal on your written standard terms must be reasonable (sections 3 and 11). Where a clause caps liability at a set sum, the court looks at your resources and whether you could have covered yourself by insurance (section 11(4)). In practice, negotiation matters more than the Act. Our MSA, Security Questionnaire and Insurance Evidence guide walks through the insurance evidence clients ask for, and the SaaS buyer insurance questionnaire pack covers SOC 2 and ISO 27001 requests.

International data

Transfers of personal data outside the UK must follow Chapter V of the UK GDPR (from Article 44): broadly, to a country covered by UK adequacy regulations or with appropriate safeguards in place. Tell underwriters where data is stored and accessed, and check territorial and jurisdiction limits if you have US clients or data subjects, where litigation costs run higher.

What underwriters ask a data company

Expect a proposal form, often with a call, covering:

1. What you do, product by product, and your controller/processor role for each.

2. What data you hold: volume of records, whether it includes special category data (health, biometrics and so on), children's data, or financial data.

3. Where the data comes from, for brokers and enrichment providers: sources, licences, lawful bases.

4. Security controls: MFA, endpoint protection, backups, encryption, access reviews, logging, and any Cyber Essentials, ISO 27001 or SOC 2 work.

5. Contracts: your standard terms, your liability cap, and whether you've accepted uncapped data indemnities.

6. Clients: sectors, largest clients, and whether outputs feed regulatory or safety decisions.

7. Incidents and complaints, and your revenue split by product and country.

Answer fully. Under the Insurance Act 2015 (section 3), a business must make a fair presentation of the risk before the contract is entered into, which includes disclosing every material circumstance it knows or ought to know. A data broker that describes itself as "an analytics platform" risks a reduced claim later.

A 30-day insurance readiness plan for a data startup

If an enterprise deal or a funding round is forcing the issue, this is a sensible order of work.

Week 1: know your role and your data. List each product, your role (controller, processor or both), the personal data involved, and where it's stored. Pull together your records of processing, privacy notices and data protection fee registration. Under the Data Protection (Charges and Information) Regulations 2018, organisations that process personal data, including sole traders, generally need to pay a data protection fee unless they're exempt.

Week 2: read your contracts. Standard terms, your largest client's draft and signed data processing agreements. Highlight uncapped indemnities, fines clauses, accuracy guarantees and insurance requirements.

Week 3: tighten the controls underwriters ask about. MFA on email and admin accounts, tested backups, offboarding, and a written incident response plan with named roles. If clients ask for it, start Cyber Essentials.

Week 4: place the cover. Bring your role map, contracts and controls summary to a broker. Agree tech PI and cyber limits that match your contracts, add D&O and employers' liability where they apply, then go back to the client with your insurance evidence and proposed super-cap.

FAQs

What insurance does a data analytics company need in the UK?

Usually technology professional indemnity and cyber as the core pair, D&O once you have investors or a board, and employers' liability once you employ staff. Crime and public liability depend on how you operate. Data brokers and enrichment providers usually need broader privacy and regulatory cover than platforms or consultancies.

Is a data processor liable under UK GDPR?

Yes, in some situations. Under Article 82, a processor is liable for damage where it hasn't complied with obligations aimed at processors or has acted outside or against the controller's lawful instructions. A processor that decides the purposes and means of processing for itself is treated as a controller for that processing (Article 28(10)).

Does professional indemnity cover data protection claims?

Partly, depending on the wording. PI is designed for claims that your services or software caused financial loss. Data breach and privacy claims are usually better covered by cyber. Most data businesses need both, with the boundary between them checked so a claim doesn't fall between the two.

Can insurance pay a UK data protection fine?

Don't rely on it. Many policies cover fines only where insurable by law, and it isn't clear that UK law allows a business to insure against its own regulatory penalties. Cyber cover for legal costs during an investigation is more dependable.

Do data brokers need different insurance?

Usually yes. Brokers and enrichment providers are typically controllers of the data they sell, so they carry transparency duties under Article 14 and face more regulatory and privacy liability risk. Look for strong privacy liability, regulatory defence and IP cover, and check for exclusions about wrongful collection of data.

We're an analytics consultancy working on client systems. Do we need cyber?

If you only work inside the client's systems on their equipment, PI may be your main need. If you take data extracts, keep client data on your own laptops or cloud, or run your own tools, you need cyber too.

Do you cover freelance data analysts and sole traders?

Sole traders are in scope for many covers, including professional indemnity. We don't currently place cyber cover for sole traders, so speak to us and we'll be clear about what we can and can't arrange.

Talk to us

If you process, sell or analyse data for UK businesses and want your PI, cyber and contracts to line up, speak to us. Bring a one-page description of each product and your role in it, your standard terms, and the data protection schedule from your largest client. We'll tell you what the insurers on our panel will need and where your gaps are.

Mesh'd Limited t/a Meshed / Meshed Cover · FCA FRN 1033248 · flat 10% broker fee · limited companies, partnerships and sole traders · no fake prices · Speak to us