APRA’s Cyber Data Shift: What Consultants Should Watch

Until now, cyber insurance has been reported within a wider public liability grouping, while management liability has sat under professional indemnity. That structure made it harder for businesses, insurers and advisers to see how these increasingly important covers were performing as distinct risks. For consultants, particularly those handling client data, technology projects, strategy advice or outsourced operational functions, the change should gradually make market signals easier to interpret.

The immediate benefit is transparency. More specific data can help the market better understand premium trends, claims frequency and the types of losses emerging across cyber and management liability portfolios. Over time, that may support more disciplined underwriting and more informed conversations at renewal. It does not mean premiums will automatically fall, but it may reduce some of the guesswork around rapidly evolving risk classes.

There are also implementation challenges. Some insurers provide cyber protection as a standalone policy, while others include elements of cyber cover inside management liability or broader business packages. Separating premium and claims information from bundled products is not always straightforward. APRA has indicated it will maintain aggregation and masking protections, but insurers will still need consistent definitions and reporting processes to make the data meaningful.

For consulting firms, the message is to avoid treating cyber, management liability and professional indemnity as interchangeable. Professional indemnity remains central where advice, design, analysis or recommendations cause client loss. Cyber cover is more concerned with incidents such as data compromise, business interruption, ransomware response and digital recovery costs. Management liability may respond to governance, employment and company management exposures. The gaps between these policies can matter as much as the overlaps.

Consultants preparing for renewal should use this development as a prompt to review how their policies interact. Useful questions include:

• Is cyber cover standalone, bundled, or limited to a narrow extension?
• Do policy limits reflect the value and sensitivity of client information handled by the business?
• Are directors, principals and senior contractors protected for management decisions?
• Do notification obligations and exclusions align across policies?

As clearer public data emerges, firms may find insurers asking more detailed questions about controls, governance and incident response. That makes early preparation valuable. Working with experienced insurance brokers can help consultants identify whether their current structure is fit for purpose, while businesses seeking suitable cover should compare insurance options before renewal pressure narrows their choices.