A Fintech Has a Data Breach. Is That Professional Indemnity or Cyber Liability?

A software error that costs a client money sits with professional indemnity. A data breach sits with cyber liability. A fintech or non-bank lender needs to think about both and about a third thing most small businesses never have to: the privacy obligations that come with handling someone else’s credit file.

Does professional indemnity cover a fintech’s data breach?

Generally no. Professional indemnity responds to a client’s claim that the fintech’s own service or advice caused them a financial loss, a lending decision, a calculation error, a failed implementation. A data breach is a different kind of event altogether, an attack on or failure of the fintech’s own systems rather than a flaw in the advice it gave. That’s the distinction the rest of this comes down to.

So where does professional indemnity still come into it?

Wherever the fintech’s own service or software caused a client a financial loss. None of these need a data breach to have happened for professional indemnity to respond:

• A platform that miscalculates a repayment schedule
• A lending decision driven by a flawed model
• A failed integration that cost a client money

For an AFS licensee serving retail clients, this side of the cover isn’t optional either. There are typically higher professional indemnity requirements for lenders serving retail clients under an AFSL, with ASIC setting out directly what counts as adequate.¹

And what does cyber liability cover that PI doesn’t?

Cyber liability typically covers, subject to the specific policy wording:

• Incident response
• Breach notification costs
• Business interruption following an attack
• Third-party liability claims arising from the breach itself

This is the cover built specifically for the finance sector’s elevated breach exposure. Which brings up the part of this that catches a lot of lenders off guard.

Does a lender face privacy obligations on top of all that?

Yes, and this sits alongside the insurance question rather than inside it. Handling credit information puts a lender under a specific set of privacy rules, on top of the general rules every other business follows.² A breach of those rules is treated as a breach of the Privacy Act in its own right, separate from the standard data breach notification duty that applies regardless of industry. It’s one more reason a lender’s cyber cover needs to be built for this sector specifically.

Why does this sector carry more cyber exposure than a typical small business?

Because finance is consistently one of the most targeted sectors in Australia. OAIC figures for January to June 2025 put finance second only to health for reported data breaches, at 14% of all notifications nationally.³ A business holding credit files and payment data sits squarely inside that exposure by default. That’s exactly why professional indemnity, cyber liability and the privacy obligations above all belong in the same conversation, looked at together as one picture rather than three separate boxes.

Key Takeaways

The information in this article is general in nature and does not constitute legal, financial or insurance advice. Please speak with a qualified adviser about your specific circumstances.

Footnotes

1. Regulatory Guide 126: Compensation and insurance arrangements for AFS licensees, ASIC ↩

2. On credit reporting, OAIC ↩

3. Latest notifiable data breach statistics for January to June 2025, OAIC ↩