What general liability is written to do
Commercial general liability answers for bodily injury and property damage to others, plus certain personal and advertising injury, arising from the business's premises and operations. It is the policy a landlord or customer usually asks to see, and it does that job well.
Electronic data is a different matter. Many current general liability forms exclude damages arising from access to or disclosure of confidential information and limit or exclude electronic data as property, so a breach of customer records or a network outage generally falls outside the policy, even when the business's other operations are covered.
What cyber insurance is written to do
A cyber policy is built around the business's systems and data. Its first-party parts pay the business's own costs after an incident — forensics, legal advice, notifying affected people, restoring data, income lost during a network outage and, where included, extortion response. Its third-party parts respond to claims from customers, vendors or regulators over a data incident.
Many cyber policies also include social-engineering coverage for money an employee is tricked into sending, usually with a sublimit, which general liability does not address at all.
The gray areas worth checking
Some package policies add a small data-compromise endorsement. It can help with notification costs but is usually narrow and sublimited. Personal and advertising injury in a general liability policy sometimes raises questions after a privacy claim, but many forms exclude data-related injury from that coverage too.
Physical consequences are the other gap. A cyber policy often excludes bodily injury and property damage, while a general liability or property policy may exclude cyber causes. A business whose systems control physical equipment should read both together.
Putting the two together
For most businesses the answer is both: general liability for the physical world and cyber insurance for data, networks and fraudulent payments. Read each against three likely events — a slip-and-fall, a customer-data breach and a diverted payment — and confirm which policy answers each one. Our small business cyber insurance page covers the cyber side, including the cybersecurity controls insurers ask about, in more depth.
More on Cyber & Technology Risk
When a Contract Requires Cyber Insurance: What to Check Before You Sign
More owners, general contractors, lenders and agencies now write cyber insurance into their agreements. Here is how to read the requirement before it becomes a condition you cannot meet.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Wire Fraud and Payment Diversion: Cyber Insurance, Crime Insurance, or Both?
A redirected payment is the most common cyber-related loss for many businesses, and the one most likely to fall between policies. Here is how cyber and crime forms divide it.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Ransomware and Cyber Insurance: What a Policy May Do After an Attack
When systems are encrypted and a demand appears, a cyber policy can fund the response — but the steps in the first hours matter. Here is what to know before it happens.
By David Gleason · Published August 24, 2026 · Updated October 11, 2026
Frequently asked questions
Does general liability cover a data breach?
Generally no. Many current general liability forms exclude damages from access to or disclosure of confidential information and limit electronic data, so breach response and data-incident claims are usually left to a cyber policy.
Does a business owners policy include cyber coverage?
Some include or offer a data-compromise endorsement, but it is usually narrow and sublimited and may not include business interruption, extortion or social-engineering coverage.
Can a cyber policy replace general liability?
No. A cyber policy does not cover bodily injury or property damage from ordinary operations, and many cyber forms exclude them. The two policies cover different risks.
Which policy covers a fraudulent payment request?
Neither general liability nor property is written for it. A cyber policy's social-engineering coverage or a crime policy's fraudulent-instruction coverage may respond, depending on the forms. See wire fraud under cyber and crime policies.
What if a hacked system causes physical damage?
That is a gray area. Cyber forms often exclude property damage and bodily injury, and GL or property forms may exclude cyber causes, so the policies should be read together.