You lose a client’s data. Which of your policies picks up the phone?
A laptop with a client’s files goes missing. A shared folder was left open. Your cyber policy and your professional liability policy both have something to say, and they do not say the same thing. Knowing which one answers is the difference between a covered claim and two insurers pointing at each other.
Build the practice file Read the short answer firstYour systems and your breach costs.
Your advice and your client’s loss.
Handing data to a vendor does not hand off the duty.
When a consultant loses client data, is it a cyber claim or an E&O claim?
Both can be involved, and the split matters. The breach itself, the notification, the forensic work and the credit monitoring, that is cyber. The client suing you because losing their data caused them a financial loss, that is usually professional liability. A policy built for one will not stretch to the other.
In British Columbia the starting point is BC’s own Personal Information Protection Act, overseen by the Office of the Information and Privacy Commissioner for British Columbia. The Province of BC says: “Your organization is responsible for all personal information it handles, including those shared with contractors.” BC’s Act is not always the only one. When personal information crosses a provincial or a national border in the course of business, the federal law, PIPEDA, covers that movement, whatever province you are based in, while the BC Act keeps covering what stays here. PIPEDA always applies to federally regulated businesses such as banks, airlines and telecoms. That matters after a loss, because PIPEDA carries a reporting duty. Where it applies and the breach creates a real risk of significant harm, the organization has to report the breach to the Privacy Commissioner of Canada and tell the people affected, and it has to keep a record of every breach for two years. If your clients are outside BC, check which law you are working under. Read the Privacy Commissioner of Canada on when PIPEDA applies (opens in a new tab). Your cloud provider losing it is still your breach. Your subcontractor losing it is still your breach.
It is easy to assume the client’s own cyber policy will handle it, because it is the client’s data. Under BC’s Act, responsibility follows the organization that handles the information. The Province puts it plainly: “Your organization is responsible for all personal information it handles, including those shared with contractors.” If it was in your custody when it went, the duty and the first costs start with you, and your client will see it the same way. Read the Province of BC on protecting personal information (opens in a new tab).
Four things to line up before something goes missing.
Which policy holds the breach costs
Notification, forensics and legal advice sit in cyber. Check your E&O does not assume they are somewhere else, and your cyber does not exclude data you hold for clients.
Whether your E&O sees data loss as a professional service
Some wordings treat losing client data as an error in your service. Some carve it out to cyber. Read the exclusion, not the summary.
What your contracts promise
If you signed a clause promising a standard of data protection, that promise is a contract. Your policies answer for negligence.
Where the data actually lives
Your laptop, your cloud, your sub’s laptop. Under BC’s Act it stays your responsibility wherever it is held. Your policies may not agree with each other about that.
Three consultants, three losses. All three are illustrations, not client files.
The laptop on the train
A management consultant lost a laptop holding a client’s staff data. Cyber paid for notification and forensics. The client then sued for the cost of its own breach response. That part went to E&O.
The sub who lost it
An IT consultant used a subcontractor who left a database open. The client did not sue the sub. It sued the consultant it had hired, because that was who it had trusted with the data.
The two insurers who both said no
A consultant had E&O that excluded data loss and no cyber at all. Both routes were closed. The claim was paid from the firm’s own account.
The questions consultants ask about this.
We are small. Do we really need both?
The two answer different losses, so the question is which loss you are actually exposed to. That is a conversation with a licensed broker who has read your contracts, not something a web page can settle.
The client’s data sits on their system, not ours. Are we clear?
If you can reach it, you have custody of it while you are in there. Ask what your agreement says about your access.
Does cyber cover the client suing us?
Some cyber wordings include third party liability for a breach. Many do not. This is the gap to check first.
Our cloud provider lost it, not us.
Handing data to a service provider does not hand over your responsibility for it. Your client will see it the same way.
We signed a data protection clause. Does that change anything?
Yes. A promise in a contract can go beyond negligence, and your policies answer for negligence. Send us the clause.
Two that sit next to this one: what errors and omissions cover actually answers for, and what a cyber policy leaves out.
Not the question you came with? Send it through the short contact form and we will answer the one you actually have.
Two policies, one loss, and only one of them should be arguing.
Send us both wordings and your standard client agreement. We will tell you where the gap is.
Checked for technical accuracy by Amrit Sidhu of S&S Insurance Services Ltd. Last checked 28 September 2026.