Insurance broker / Insurance questions / Cyber insurance

Do small businesses in Germany need cyber insurance?

In short

Most do, as soon as orders, customer data or invoicing depend on a computer. A small business in Germany usually pays about EUR 200 to 1,000 a year. The average reported cyber loss in 2025 was around EUR 43,000. The policy does not replace backups and updates, and without them you may not get cover at all.

Request a quote +49 3375 29 12 77

Do small businesses in Germany need cyber insurance?

What it costs

Guide figures from published tariff examples for freelancers and small firms in Germany, mostly with a EUR 1,000 deductible.

Example	Typical range
Micro business, trade or hospitality, turnover up to EUR 500,000	from about EUR 400 a year
Association, turnover EUR 150,000 to 250,000, sum insured EUR 250,000	from about EUR 530 a year
Software firm, turnover up to EUR 1 million, sum insured EUR 250,000	from about EUR 650 a year
Software firm, turnover up to EUR 1 million, sum insured EUR 1 million	from about EUR 1,060 a year
Rule of thumb by turnover	about 0.1 to 0.5 percent of annual turnover

Guide values as of September 2026 from publicly quoted tariff examples. Your premium depends on your sector, turnover, sum insured and IT security; we obtain the exact quote for you. The loss amounts in the worked example are guide values from our quoting practice (Richtwert aus der Angebotspraxis).

Worked example

Trade business, 8 staff, EUR 800,000 turnover

A ransomware attack shuts down scheduling and invoicing for ten working days.

IT forensics and recovery	about EUR 15,000
Downtime, ten working days	about EUR 25,000
Legal advice and report to the authority	about EUR 3,000
Premium for a EUR 250,000 sum insured	about EUR 600 to 900 a year

Around EUR 43,000 of loss against less than EUR 1,000 in premium a year. You pay the EUR 1,000 deductible yourself.

Why small businesses are hit

Attackers do not look for famous names, they look for weak spots. One outdated program or one stolen password is enough, and your computers, stock system and accounting are encrypted.

Small firms rarely have their own IT team or the reserves to sit still for two weeks. That downtime is often the largest cost, not repairing the hardware.

What is different if you run a business from abroad

If you know cyber cover from the UK or the US, the building blocks will look familiar. In Germany, however, data protection is enforced by state data protection authorities, and a data breach usually has to be reported within 72 hours under the GDPR.

Policy wording, risk questionnaires and claim letters are usually in German, and the German text is what counts in a claim. Have your IT provider check the technical questions, even if you answer them in English first.

What cyber insurance pays

The benefits fall into three groups: help in an emergency, your own costs and claims from others.

Ransom payments are a special case. Each policy handles them differently, and you should never pay without talking to the incident hotline and the police first.

Module	What it covers
Incident response	IT forensics, legal advice and help reporting to the data protection authority
First-party loss	restoring data and systems
Business interruption	lost profit and running costs while you cannot work
Third-party liability	claims from customers whose data was stolen
Social engineering fraud	money lost through fake payment instructions, only in some policies

When you probably do not need it

If you hardly use a computer, store no customer data and could easily cope with a few days of downtime, the risk is limited.

If a service provider runs all your IT, first check what their contract covers. Claims from your own customers usually stay with you, though.

What insurers ask before they offer cover

Before quoting, the insurer checks your IT security: regular backups kept separate from the network, current updates, antivirus, one login per person and two-factor authentication for remote access and email.

Wrong answers can cost you your cover in a claim, so fill in the questionnaire together with your IT provider. Good security often lowers the premium as well.

Step by step

Work out which processes stop without computers and how long you could cope.
Fix backups, updates and two-factor authentication before you apply.
Answer the risk questions honestly, together with your IT provider.
Choose the sum insured based on possible downtime and the customer data you hold.
Keep the incident hotline number somewhere you can reach offline.

Checklist

Business interruption included, with a short waiting period
24/7 incident response with IT forensics
Third-party claims after a data breach covered
Fraud through fake payment instructions addressed
IT security obligations known and achievable
No overlap with your general liability and electronics insurance

Common mistakes

Thinking a small firm is not interesting to attackers
Filling in the questionnaire without asking your IT provider
Storing the hotline number only on the computer that gets encrypted
Choosing a sum insured that is too low and forgetting downtime

Questions and answers

Frequently asked

Does my business liability insurance pay after a hack?

Usually not. It covers damage to others, but not your own costs or your downtime. Data losses of third parties are often only narrowly covered.

Do freelancers without staff need cyber insurance?

If you store client data or your income depends on your laptop, yes. Small policies start at a few hundred euros a year.

Is ransom covered?

Each policy handles this differently. Never pay on your own; agree every step with the incident hotline and the police.

What if an employee falls for a fake email?

That is a common way in and is usually covered. Staff training lowers the risk and some policies require it.

Can I get the policy documents in English?

Some insurers offer English service, many do not. The German wording applies in a claim, so ask us when a clause is unclear.

Is the premium tax deductible?

As a business insurance the premium is usually a business expense. Ask your tax adviser for your case.

Sources

NAMMERT insurance broker

Request a quote: Cyber insurance

We compare several insurers and come back with a proposal. Free for you; the insurer pays our fee. You can write in English.

1Who is it for?

Personal My company

Company Industry Number of employees Annual turnover (roughly)

2Which insurance?

Choose as many as you like. For each one, the details an insurer needs for a quote appear below.

Personal

Business

Please review all my existing policies

3Details

Cyber insurance for businesses in Germany

Annual company turnover * Number of employees * Sector and business activity * Do you sell online or accept card payments? * How is your data backed up? * Is multi-factor authentication set up for email and remote access? * Security incidents in the last five years * Preferred limit of indemnity Rule of thumb: cost of three to four weeks of downtime plus recovery

4Your current policy

Current insurer Policy ends on What matters more to you?

5How can we reach you?

Name * Email * Phone Postcode Town Preferred contact Anything else we should know