Editorial & Advertiser disclosure

Global Banking & Finance Review® is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website.

Home > Top Stories > Aon and DLA Piper review insurability of GDPR fines across Europe

Aon and DLA Piper review insurability of GDPR fines across Europe

Published by Gbaf News

Posted on May 23, 2018

6 min read

Last updated: January 21, 2026

GAC reprimands Stellantis over joint venture plans in China - Global Banking & Finance Review — The image illustrates the tense relationship between Guangzhou Automobile Group (GAC) and Stellantis over the proposed increase in stake for their joint venture, highlighting the complexities of foreign investment in China's automotive market.

Companies in Asia must carefully consider their exposure to EU citizen data and their compliance with obligations under that regime. Data breaches, and other cyber events, could see businesses face major fines, but these may be outweighed by legal and investigative costs, business interruption losses and exposure to third party liability.

Aon (NYSE:AON) and DLA Piper have launched a guide ‘The price of data security’, ahead of the General Data Protection Regulation (GDPR), effective from 25 May 2018.

The guide reviews the insurability of GDPR fines across Europe, which can reach up to €20 million or, if higher, up to 4% of a group’s annual global turnover. It also looks at insurability of costs associated with GDPR non-compliance (e.g. litigation, investigation and compensation), as well as the insurability of non-GDPR regulatory fines.

The guide highlights that there are currently only a few jurisdictions in Europe where civil fines can be covered by insurance and, even then, there must be no deliberate wrongdoing or gross negligence on the part of the insured. Criminal penalties are almost never insurable. GDPR administrative fines are civil in nature, but the GDPR also allows European Member States to impose their own penalties for personal data violations.

Key findings include:

GDPR fines were found to be insurable in only two of the countries reviewed — Finland and Norway;
In 20 out of 30 reviewed jurisdictions GDPR fines would generally not be regarded as insurable, including the UK, France, Italy and Spain;
In eight of the jurisdictions it is unclear whether GDPR fines would be insurable. In these jurisdictions specific details around individual cases, for example the conduct of the insured and whether the fine is classed as criminal, will need to be considered.

Whilst the insurability of GDPR fines may be limited, insurance forms a key component of an organisation’s risk management strategy to manage costs associated with GDPR non-compliance and resulting business disruption losses. Such costs could include legal fees and litigation, regulatory investigation, remediation and other costs associated with compensation and notification to impacted data subjects.

Andrew Mahony, Regional Director, Financial Services & Professions Group, Asia, Aon commented:

“To prepare for the GDPR, companies in Asia must carefully consider their exposure to EU citizen data and their compliance with obligations under that regime. Data breaches, and other cyber events, could see businesses face major fines, but these may be outweighed by legal and investigative costs, business interruption losses and exposure to third party liability, all of which are insurable. Organisations should work closely with their insurance partners to ensure that they have an appropriate risk transfer solution in place.”

Organisations may also face damage to both their reputation and market position if impacted by a high-profile data breach.

Prakash (PK) Paran, Partner and Co-Chair, Global Insurance Sector at DLA Piper added:

“While there are only a few jurisdictions where GDPR fines are insurable, insurance against legal costs and liabilities following a data breach is widely available across Europe and may provide valuable cover to organisations. However, corporate groups still need to consider reputational damage and impact on existing customers, the wider market, and their relationships with regulators, all of which may go beyond quantifiable financial losses. Prevention is better than the cure.”

To download the full report ‘The price of data security: A guide to the insurability of GDPR fines across Europe‘ please visit Aon’s website.

Companies in Asia must carefully consider their exposure to EU citizen data and their compliance with obligations under that regime. Data breaches, and other cyber events, could see businesses face major fines, but these may be outweighed by legal and investigative costs, business interruption losses and exposure to third party liability.

Aon (NYSE:AON) and DLA Piper have launched a guide ‘The price of data security’, ahead of the General Data Protection Regulation (GDPR), effective from 25 May 2018.

The guide reviews the insurability of GDPR fines across Europe, which can reach up to €20 million or, if higher, up to 4% of a group’s annual global turnover. It also looks at insurability of costs associated with GDPR non-compliance (e.g. litigation, investigation and compensation), as well as the insurability of non-GDPR regulatory fines.

The guide highlights that there are currently only a few jurisdictions in Europe where civil fines can be covered by insurance and, even then, there must be no deliberate wrongdoing or gross negligence on the part of the insured. Criminal penalties are almost never insurable. GDPR administrative fines are civil in nature, but the GDPR also allows European Member States to impose their own penalties for personal data violations.

Key findings include:

GDPR fines were found to be insurable in only two of the countries reviewed — Finland and Norway;
In 20 out of 30 reviewed jurisdictions GDPR fines would generally not be regarded as insurable, including the UK, France, Italy and Spain;
In eight of the jurisdictions it is unclear whether GDPR fines would be insurable. In these jurisdictions specific details around individual cases, for example the conduct of the insured and whether the fine is classed as criminal, will need to be considered.

Whilst the insurability of GDPR fines may be limited, insurance forms a key component of an organisation’s risk management strategy to manage costs associated with GDPR non-compliance and resulting business disruption losses. Such costs could include legal fees and litigation, regulatory investigation, remediation and other costs associated with compensation and notification to impacted data subjects.

Andrew Mahony, Regional Director, Financial Services & Professions Group, Asia, Aon commented:

“To prepare for the GDPR, companies in Asia must carefully consider their exposure to EU citizen data and their compliance with obligations under that regime. Data breaches, and other cyber events, could see businesses face major fines, but these may be outweighed by legal and investigative costs, business interruption losses and exposure to third party liability, all of which are insurable. Organisations should work closely with their insurance partners to ensure that they have an appropriate risk transfer solution in place.”

Organisations may also face damage to both their reputation and market position if impacted by a high-profile data breach.

Prakash (PK) Paran, Partner and Co-Chair, Global Insurance Sector at DLA Piper added:

“While there are only a few jurisdictions where GDPR fines are insurable, insurance against legal costs and liabilities following a data breach is widely available across Europe and may provide valuable cover to organisations. However, corporate groups still need to consider reputational damage and impact on existing customers, the wider market, and their relationships with regulators, all of which may go beyond quantifiable financial losses. Prevention is better than the cure.”

To download the full report ‘The price of data security: A guide to the insurability of GDPR fines across Europe‘ please visit Aon’s website.