The conversation began with a straightforward question: "Are we covered if we have to notify patients under PDPL?" The chief financial officer of a healthcare provider in Riyadh had asked the question during a quarterly risk committee meeting, and no one in the room could answer with certainty. The organization held a cyber insurance policy, renewed annually through its broker, but no one had mapped the policy's coverage to the specific obligations imposed by the Saudi Personal Data Protection Law.
That uncertainty prompted a broker-neutral coverage review. What emerged was a gap that many Saudi organizations holding personal data may not yet recognize: the policy's exclusions and sub-limits did not align with the costs that a PDPL breach notification would actually trigger. This article describes how that gap was identified, which three sub-limits ultimately closed it, and what CFOs and risk managers at healthcare providers, retailers and service firms should verify in their own cyber insurance PDPL coverage Saudi Arabia arrangements before a breach occurs.
When a Coverage Review Becomes Necessary
Most organizations renew cyber insurance annually, often through a broker who presents a quote, highlights the headline limit, and confirms that "data breach" is covered. The policy document arrives, is filed, and is not examined in detail until a claim is contemplated. This approach works adequately when the regulatory environment is stable and breach obligations are well understood. It fails when new regulations introduce obligations that were not contemplated when the policy was originally written or when the organization's risk profile changes materially.
For Saudi organizations, the Personal Data Protection Law introduced specific obligations that may not be fully addressed by cyber policies written for other jurisdictions or purchased before PDPL came into force. PDPL, enforced by the Saudi Data and Artificial Intelligence Authority, requires controllers to notify the Authority and affected data subjects when a breach is likely to result in a risk to the rights and freedoms of individuals. Notification must occur without undue delay. The law does not prescribe the method or cost of notification, but it does impose the obligation.
A coverage review becomes necessary when:
- The organization's regulatory environment has changed since the policy was last negotiated in detail, not merely renewed.
- The organization holds categories of personal data that would trigger mandatory notification under PDPL.
- No one in the organization can describe, with reference to the policy wording, what is and is not covered in a breach scenario.
- The policy was purchased through a broker but has never been reviewed independently against the organization's actual risks.
- The organization is preparing for an audit or board inquiry into cyber risk and wants to confirm that financial exposures are adequately transferred.
The Gap That Appeared During the Review
The healthcare provider's policy was a standard cyber liability policy, purchased from a reputable insurer and renewed for three consecutive years. The schedule showed a headline limit of several million Saudi Riyals, and the policy wording included coverage for "data breach response costs." On its face, the policy appeared adequate.
The review began by collecting the policy wording, schedule and endorsements. The next step was to model the organization's top cyber loss scenarios. For a healthcare provider holding patient records, the most material scenario was a ransomware incident that also resulted in exfiltration of patient data, triggering PDPL notification obligations.
The scenario was then mapped to the policy's coverage sections, sub-limits, exclusions and conditions. Three gaps emerged:
First, the policy's definition of "breach response costs" was narrower than expected. It covered costs incurred to investigate the breach and restore systems, but notification expenses were subject to a separate sub-limit that was not listed on the schedule. The sub-limit was buried in the policy wording and was set at a fraction of the headline limit.
Second, the policy excluded costs incurred to comply with regulatory investigations unless a separate "regulatory defence" sub-limit applied. That sub-limit was also not highlighted on the schedule, and it carried a separate retention (deductible) that was higher than the main policy retention.
Third, forensic investigation costs were covered, but only if the investigation was conducted by a firm pre-approved by the insurer or if the insurer's prior written consent was obtained. The policy contained a condition that could void the claim if the organization engaged a forensic firm without notifying the insurer within a specified number of hours after discovering the breach.
None of these limitations were apparent from the schedule or the broker's summary. All were material to the organization's ability to meet its PDPL obligations without incurring uninsured costs.
The Three Sub-Limits That Closed the Gap
The coverage review identified three sub-limits that, if verified and negotiated appropriately, would close the gap between PDPL obligations and policy coverage:
1. Notification Expenses Sub-Limit
PDPL requires notification to the Saudi Data and Artificial Intelligence Authority and to affected individuals. For a healthcare provider with tens of thousands of patient records, notification can involve significant costs: legal review of the notification language, translation, postal or electronic delivery, call centre services to handle inquiries, and credit monitoring or identity protection services if offered to affected individuals.
The policy's notification expenses sub-limit was set at a level that would cover notification to a few hundred individuals, not tens of thousands. The review recommended that this sub-limit be increased to a level consistent with the organization's patient database size and that the definition of "notification expenses" be confirmed to include all costs reasonably incurred to meet PDPL obligations, not only postal costs.
2. Regulatory Defence Sub-Limit
PDPL empowers the Saudi Data and Artificial Intelligence Authority to investigate breaches and impose administrative fines. A regulatory investigation can require the organization to produce evidence, respond to inquiries, and engage legal and technical advisers to represent its interests. These costs are distinct from breach response costs and are often excluded from the main policy limit unless a separate regulatory defence sub-limit applies.
The policy in question included a regulatory defence sub-limit, but it was set at a level that would cover only the early stages of an investigation. The review recommended that this sub-limit be increased and that the retention applicable to regulatory defence costs be aligned with the main policy retention to avoid a situation where the organization would be required to pay a second, higher deductible before coverage attached.
3. Forensic Investigation Sub-Limit
PDPL does not prescribe the technical measures an organization must take to investigate a breach, but it does require the organization to assess the breach's scope and impact before notifying the Authority and affected individuals. This assessment typically requires forensic investigation: log analysis, malware analysis, data flow mapping, and determination of what data was accessed or exfiltrated.
The policy covered forensic investigation costs, but it imposed a condition that the organization notify the insurer and obtain consent before engaging a forensic firm. The condition included a tight notification window—measured in hours, not days—that could be difficult to meet if the breach was discovered outside business hours or if the organization's incident response plan did not include a step to notify the insurer immediately.
The review recommended that the organization either negotiate a longer notification window or pre-arrange with the insurer a list of approved forensic firms that could be engaged without prior consent. It also recommended that the forensic investigation sub-limit be confirmed as separate from and additional to the main policy limit, rather than nested within it.
How the Coverage Review Was Conducted
The review followed a structured process. First, the organization provided the policy wording, schedule and all endorsements. This included not only the main policy document but also any amendments, exclusions or conditions added at renewal.
Second, the organization's top cyber loss scenarios were modeled. For the healthcare provider, these included ransomware with data exfiltration, insider data theft, and accidental disclosure of patient records. Each scenario was described in terms of the sequence of events, the costs that would be incurred, and the regulatory obligations that would be triggered.
Third, each scenario was compared against the policy's coverage sections, limits, sub-limits, exclusions and conditions. This comparison identified which costs would be covered, which would be subject to sub-limits or separate retentions, and which would be excluded entirely.
Fourth, the findings were documented in a coverage gap report. The report listed each gap, explained why it mattered, and provided specific recommendations for closing it. The report also included a scenario-to-coverage map that showed, for each modeled scenario, which policy sections would respond and which would not. Finally, the report provided renewal negotiation points: specific questions to raise with the broker and insurer at the next renewal, and specific amendments to request in the policy wording.
The entire assessment was completed in two to three weeks.
What CFOs and Risk Managers Should Verify Before Renewal
The case illustrates a broader lesson for Saudi organizations holding personal data. Cyber insurance is not a standard product. Policies vary widely in their definitions, sub-limits, exclusions and conditions, and these variations are often not apparent from the schedule or broker summary. A policy that appears adequate on its face may exclude or limit coverage for the very costs that PDPL would trigger.
Before renewing cyber insurance, CFOs and risk managers should verify the following:
- Notification expenses: Confirm that the policy includes a sub-limit for notification expenses that is consistent with the size of your data holdings. Confirm that the definition of notification expenses includes all costs reasonably incurred to meet PDPL obligations, including legal review, translation, delivery, call centre services and any remedial services offered to affected individuals.
- Regulatory defence: Confirm that the policy includes a separate sub-limit for regulatory defence costs, including legal and technical advisers engaged to respond to an investigation by the Saudi Data and Artificial Intelligence Authority. Confirm that the retention applicable to regulatory defence costs is not higher than the main policy retention.
- Forensic investigation: Confirm that forensic investigation costs are covered and that the sub-limit is adequate. Confirm the conditions under which you must notify the insurer and obtain consent before engaging a forensic firm, and confirm that these conditions are realistic given your incident response plan and the likely timing of a breach discovery.
- Exclusions: Review the policy's exclusions carefully. Common exclusions that can void coverage include failure to implement "reasonable" security measures (often undefined), failure to notify the insurer within a specified time, and losses arising from known vulnerabilities that were not remediated.
- Conditions: Review the policy's conditions, particularly those that require you to take specific actions within a specified time after discovering a breach. Confirm that these conditions are consistent with your incident response plan and that your team knows what must be done to preserve coverage.
A broker-neutral coverage review provides an independent assessment of these points. It compares your policy against your actual risks, not against a generic checklist, and it identifies gaps that may not be apparent to your broker or insurer.
Closing the Gap
The healthcare provider's coverage review identified three sub-limits that needed to be increased and several conditions that needed to be clarified. The organization used the findings to negotiate amendments at the next renewal. The result was a policy that aligned more closely with the organization's PDPL obligations and that provided greater certainty about what would and would not be covered in a breach scenario.
For organizations that have not yet reviewed their cyber insurance against PDPL requirements, the time to do so is before a breach occurs. A Cyber Insurance Coverage Review provides a broker-neutral assessment of your policy against your actual risks. The review collects your policy wording, schedule and endorsements, models your top cyber loss scenarios, compares coverage, limits and exclusions per scenario, and advises on gaps and renewal negotiation points. Deliverables include a coverage gap report, a scenario-to-coverage map, and renewal negotiation points. The assessment is completed in two to three weeks and is mapped to PDPL and the SAMA Cyber Security Framework. It is a technical and risk review, not legal advice; your legal and broker advisers remain responsible for policy interpretation.
