Notification costs

Notification costs are the cyber policy line that pays for the notices the law requires after a data breach, to individuals and to regulators, from drafting to mailing. Article 34 of Regulation (EU) 2016/679: when a breach creates a high risk, the controller tells the individuals “without undue delay.” Section 1798.82 of the California Civil Code: thirty days since January 1, 2026. Those two texts, plus fifty state statutes, create the spend a cyber policy calls notification costs. The line pays for drafting letters and emails (with counsel), printing and postage, address lookups when the file is stale, substitute notice through the press or a website when not everyone can be reached, regulatory filings and translations. Depending on the wording, it carries the call center and the credit monitoring offer, or pushes them to neighboring lines. Two ways to cap it. The common one is a dollar sublimit inside the policy aggregate. The other, born in the U.S. market, counts notified individuals: the policy pays to notify a set number of people, sometimes outside the aggregate, which shields the rest of the program when the file is large. The underwriter thinks in cost per notified person, and the record count of the customer file becomes a rating input. Where claims stall is voluntary notice. Many wordings pay only for notification “required by law or regulation.” An insured that writes to its whole file to protect the brand, when only its California residents and European customers were owed notice, finds the voluntary share uninsured unless a prior-consent clause applies. Panel vendors matter as well: some forms cut reimbursement when the insured goes off panel. One caveat: some wordings accept voluntary notice with the insurer's written consent.