🇨🇦 Cyber Insurance in Canada

The Canadian cyber threat landscape

Canada's organisations face an intensifying cyber threat environment. The Canadian Centre for Cyber Security (CCCS) reports that ransomware has emerged as the number one threat to Canadian businesses and critical infrastructure. Attacks on financial institutions, healthcare systems, government agencies, and energy providers are increasing in frequency and sophistication.

The financial impact is severe. Recent data indicates the average cost of a data breach in Canada is C$5.13 million, including investigation, notification, regulatory defence, and operational recovery. Small businesses, once considered less attractive targets, are increasingly compromised through supply chain attacks and as entry points to larger organisations.

Critical infrastructure across energy, healthcare, telecommunications, and finance faces sustained pressure from both state-sponsored and financially-motivated threat actors. This threat landscape has made cyber insurance an essential component of business resilience and risk management for Canadian organisations of all sizes.

Canadian cyber insurance costs

Premiums in Canada reflect business size, industry sector, risk profile, coverage limits, and geographic concentration of operations. The table below shows typical annual premiums in Canadian dollars (CAD) by business size:

Several factors influence Canadian cyber insurance premiums:

• Industry sector: Financial services, healthcare, public sector, and critical infrastructure operators pay premium rates due to regulatory requirements and incident frequency.
• Size and revenue: Larger organisations pay higher absolute premiums but may negotiate better per-unit rates. Micro and small businesses have seen competitive premium reductions in recent years.
• Geographic footprint: Organisations with operations across multiple provinces face higher premiums due to compliance complexity. Quebec-only operations may attract specific Quebec Law 25 pricing considerations.
• Security maturity: Businesses with strong cybersecurity governance, incident response plans, and employee training may qualify for premium discounts.
• Claims history: Prior cyber claims increase future premiums; some insurers may reduce coverage or exclude prior loss areas.
• Coverage customisation: Optional covers such as business interruption, cyber extortion, legal defence, and crisis management increase the base premium.
• Excess (deductible): Choosing a higher deductible reduces premiums; standard deductibles range from C$5K to C$50K for SMBs.

Canadian regulatory landscape

Canada's privacy and cybersecurity regulatory environment is complex, with federal, provincial, and sector-specific frameworks. The landscape is also evolving rapidly, with new laws introducing significantly heightened compliance obligations.

PIPEDA (Personal Information Protection and Electronic Documents Act)

PIPEDA is Canada's primary federal privacy law, applying to private-sector organisations handling personal information. It mandates breach notification to affected individuals and the Privacy Commissioner of Canada if a breach creates a real risk of significant harm. The Privacy Commissioner can investigate, and organisations must demonstrate reasonable security measures. Cyber insurance should cover investigation costs, notification expenses, and regulatory defence.

Provincial Privacy Laws

Several provinces have their own privacy laws that apply alongside or instead of PIPEDA:

• PIPA (Alberta & British Columbia): Substantially similar to PIPEDA with provincial variation; mandatory breach reporting requirements apply.
• Quebec Law 25 (Bill 64): Quebec's newly reformed privacy law represents a significant leap in compliance complexity. It introduces GDPR-like elements including a private right of action for individuals, allowing them to directly sue organisations for privacy violations. Penalties for violations reach C$10 million or 2% of global revenue for first violations, and C$20 million or 4% of global revenue for subsequent violations. This is a material compliance risk that significantly impacts cyber insurance requirements for Quebec operations. Look for policies explicitly covering Quebec Law 25 compliance, investigation, and defence costs.
• PHIPA (Ontario): Ontario's Health Information Privacy Act applies to health information custodians; breach notification and Privacy Commissioner reporting are mandatory.

OSFI B-13 (Office of the Superintendent of Financial Institutions)

OSFI B-13 applies to federally regulated financial institutions and sets out technology and cyber risk management expectations. Compliance includes governance, risk assessment, incident response, and board oversight. Cyber insurance for financial services should cover OSFI investigation and remediation costs.

Anti-Spam Legislation (CASL)

CASL imposes strict requirements on electronic marketing communications. Breaches can trigger CRA enforcement and significant penalties. Some cyber policies include cover for CASL investigation costs and defence.

Digital Charter Implementation Act (Bill C-27)

Bill C-27 is progressing through parliament and will establish a unified federal privacy framework to replace PIPEDA. Its provisions are still evolving, but expect enhanced individual rights, higher penalties, and mandatory cyber incident reporting obligations. Cyber insurance will need to adapt to cover these emerging requirements.

Canadian cyber insurance providers

Canada's cyber insurance market includes Canadian specialists, traditional domestic insurers, and international carriers.

Specialist Cyber Providers

• BOXX Insurance: Canadian-founded cyber specialist with strong domestic market presence; known for personalized service and responsive claims.
• Coalition Canada: International specialist with Canadian operations; offers platform-based underwriting and incident response support.
• CFC Underwriting: Global specialist with established Canadian team; competitive for mid-market and enterprise risks.

Traditional Domestic Insurers

• Intact Insurance: Major Canadian insurer with comprehensive cyber offerings across all segments.
• Chubb Canada: International insurer with strong Canadian cyber capability and enterprise focus.
• Aviva Canada: Established carrier with competitive SME cyber products.
• RSA Canada: Multi-line insurer with growing cyber presence.
• Zurich Canada: International insurer offering cyber to mid-market and enterprise.

Lloyd's Syndicates

International specialist underwriters operate through Lloyd's of London and are accessed via Canadian brokers. These carriers provide competitive pricing for larger risks and complex coverage requirements.

Broker Licensing

Cyber insurance brokers in Canada must be licensed in the province(s) where they operate. Licensing is administered by provincial insurance regulators. When selecting a broker, verify their provincial licence with the appropriate regulator.

Canada-specific coverage considerations

When selecting cyber insurance for your Canadian business, ensure these Canada-specific features are included:

Bilingual Notification Requirements

Quebec and increasingly other provinces require breach notification in both English and French. Your cyber insurance should cover the cost of bilingual notification services, translation services, and communication with Quebec's Commission d'accès à l'information (CAI). Bilingual crisis management support is essential for Quebec-based organisations.

Provincial vs. Federal Jurisdiction Complexity

Organisations operating across multiple provinces face overlapping compliance obligations. Your cyber insurance should provide coverage for investigation and response across federal, provincial, and local levels. If you operate in Quebec, ensure coverage explicitly addresses Quebec Law 25 compliance, investigation, and defence — this is a non-negotiable requirement given the severity of potential penalties.

Cross-Border Coverage (US-Canada Operations)

Many Canadian businesses have customers or operations in the United States, which brings exposure to US state privacy laws (CCPA, Virginia CDPA, etc.) and federal laws (HIPAA, GLBA). Ensure your cyber insurance extends to US regulatory compliance and defence costs. Some policies offer US-denominated coverage sublimits; negotiate for equal coverage across both jurisdictions.

Quebec Law 25 Compliance Costs

If your organisation operates in Quebec, Quebec Law 25 coverage is critical. The law's private right of action and elevated penalties (up to C$20 million or 4% of global revenue) create material financial exposure. Your cyber insurance must explicitly cover investigation costs, expert defence, settlement negotiation, and regulatory defence for Quebec Law 25 violations. This should be a top-line feature of your policy, not an afterthought.

OSFI Regulatory Coverage

If your organisation is a federally regulated financial institution, ensure your cyber insurance covers OSFI investigation costs, compliance remediation, regulatory fines, and defence costs arising from cyber incidents affecting customer data or critical systems.

Canadian Dollar vs. USD-Denominated Policies

Some insurers offer cyber policies with coverage limits denominated in US dollars, which can create foreign exchange risk during large claims. Where possible, negotiate CAD-denominated coverage, or at minimum ensure the exchange rate is fixed at binding or include a currency hedge provision.

Getting cyber insurance in Canada

Obtaining cyber insurance in Canada requires working through a licensed broker:

Step 1: Assess Your Risk Profile

Identify your cyber risk exposure: data types handled, customer base, compliance obligations, critical systems, previous incidents, and geographic footprint (especially if Quebec-based or multi-province).

Step 2: Select a Licensed Broker

Engage a licensed broker with cybersecurity expertise and experience in your sector and province. If you operate in Quebec, prioritise brokers experienced with Quebec Law 25 compliance requirements.

Step 3: Complete Your Proposal

Provide accurate, detailed information about your business operations, IT infrastructure, security controls, employee count, revenue, and claims history. Misrepresentations can invalidate coverage.

Step 4: Obtain Quotes

Your broker will obtain quotes from multiple insurers. Review coverage scope, limits, excesses, response support services, and guidance on compliance obligations (especially Quebec Law 25 if applicable).

Step 5: Bind and Review

Once you've selected a policy, your broker will arrange binding cover. Carefully review the policy wording to understand covered perils, exclusions, conditions, and support services.

CyberPolicyFinder Can Help

CyberPolicyFinder matches you with specialist cyber insurance brokers in Canada at no cost. Answer a few quick questions about your business and location, and we'll connect you with a broker who understands your provincial requirements and can negotiate competitive terms. It's free, fast, and comes with no obligation.

Other countries

Cyber insurance requirements and costs vary significantly by jurisdiction. If you operate in multiple countries, read our guides for your other markets: