About this service
Cyber insurance — the financial insurance of damage caused by cyber incidents — is becoming an increasingly common risk-management tool for Georgian companies. Georgian law knows no separate statutory type of „cyber insurance“: insuring a cyber risk is built on the general norms of the insurance chapter of the Civil Code, and it is those norms that determine what the insurer compensates, how a claim passes against third parties, and what the policyholder must know before concluding the contract. This service is intended both for companies acquiring a cyber policy and for parties already in a relationship with an insurer who need compensation for the consequences of an insured event.
The legal nature of the insurance contract
An insurance contract is a contract regulated by the Civil Code, and extending it to cyber risks does not change its nature. The norm added by Article 843 of the Code shows the structure of such a contract well: under a health-insurance contract the insurer is obliged to reimburse the treatment costs connected with a worsening of the insured person's condition, and other services agreed by the contract, according to the procedure and conditions established by that same contract; such a contract may also be concluded by the policyholder for the benefit of the insured person. Transferred to cyber insurance, this formula means exactly what a practitioner must know: what is reimbursed and under which procedure is all defined by the contract and the policy — which is why the policy text must be analysed before purchase, not after.
Liability insurance — protection against third-party claims
The most painful part of a cyber incident is often not one's own loss but the claims of third parties — customers and partners — over leaked data or a suspended service. This is where the construction of liability insurance engages: under Article 839, under such a contract the insurer is obliged to release the policyholder from the obligation imposed on it toward a third party by liability arising during the period of insurance. In the cyber-insurance context this means: where the policy covers liability insurance, the insurer financially backs the company's dealings with third parties. It matters that the norm concerns liability arising during the period of insurance — the time frame in the policy is critical.
Compensation in money
Article 820 establishes a simple but important rule: in loss insurance the insurer must compensate the loss in money. This means the insurance payout is not a restoration of the service or the system in kind — the insurer compensates the established loss in monetary form. For a cyber incident the practical conclusion follows: the loss must be calculated and documented — the cost of recovery work, third-party-related expenses, lost income within the limits the contract provides — so that the monetary compensation is substantiated.
Transfer of the claim to the insurer and recourse
Article 832 regulates claiming compensation from third parties: where the policyholder is able to bring a claim for compensation against a third party, that claim passes to the insurer if the insurer compensates the policyholder for the loss. A claim against the organiser of a cyber attack thus passes to the insurer where the company cannot pursue it — another layer of protection. At the same time, where the policyholder refuses its claim against the third party or the right to secure it, the insurer is released from the obligation to compensate the loss to the extent it could have recovered. There is also an exception: where the policyholder's right concerns family members living with it, the transfer of the right is excluded where the family member caused the loss intentionally. The practical corollary: a policyholder should not play with the claim against the third party — it directly reduces its own compensation.
Transfer of the right to receive the benefit
Article 847 concerns the transfer of the right to receive compensation to a third party: in cumulative insurance the policyholder may transfer the right to receive the benefit to a third party and may replace that person with another, unless the contract provides otherwise; the third party holding the right to the benefit may exercise it only upon the occurrence of the insured event, unless the policyholder has indicated otherwise. In cyber insurance this mechanism is used where, for example, a company wishes the compensation to go directly to an affected client or a financial partner — and the procedure for this is shaped precisely by the contract.
How we can help
When reviewing a cyber-insurance policy we analyse exactly what the law demands of the contract: which events count as insured, which losses are compensated in money and which liability toward third parties is covered; how the transfer of the claim works and what duties the policyholder owes in protecting the insurer's rights. On the occurrence of an insured event we help document and calculate the loss and communicate correctly with the insurer — and where necessary, prepare a claim for compensation. Contact us for a concrete assessment of your policy or of the terms proposed before purchase.