Boards and risk managers need to ensure that their insurance programs are calibrated.
Insurers will need to navigate divergences across APAC’s legal and regulatory regimes in an era when cybersecurity and data privacy regulations are rapidly evolving, according to Aon.
Jurisdictions such as Australia and India are strengthening enforcement frameworks and increasing maximum penalties, whilst Mainland China is expanding extraterritorial reach and clarifying security and reporting obligations.
Across markets— Indonesia, Japan, Malaysia, New Zealand, Singapore, South Korea, Thailand and Vietnam—recent legislative reforms have tightened breach notification requirements and extended enforcement powers, Aon said in its report, “The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability.”
Boards and risk managers face the challenge of navigating the legal and regulatory regime divergences, and the need to ensure that their insurance programs are calibrated to this evolving landscape, Aon said.
“[They] may need to ensure that insurance programs—spanning cyber, D&O and professional indemnity—are calibrated to this evolving landscape with limits, structure and coverage designed to align to plausible worst-case scenarios,” the report said.
Aon warned that regulatory change can materially shift loss outcomes and, in turn, the adequacy of cyber insurance limits.
“As enforcement hardens, programs that once appeared conservative may quickly look thin against foreseeable losses,” it said.
In more developed regimes, experience shows that once enforcement becomes established, scrutiny can escalate rapidly and extend into adjacent regulatory frameworks, Aon said.
Currently, 13 of 14 Asia Pacific jurisdictions studied by Aon may insure fines, with indemnity only expressly prohibited in China.
Penalties vary across markets, with New Zealand only approximately $6,000 compared to Australia’s $35m or 30% of the company’s annual turnover.