Explainer
Cyber Insurance for Small Businesses in South Africa (2026)
What cyber insurance pays for, how POPIA fits in, the one published price, and three ways a South African small business can buy it: online, bank or broker.
Most small businesses do not think of themselves as a target. iTOO, the specialist behind two of the three small-business cyber routes I found this week, says the opposite: attacks like ransomware are indiscriminate, and smaller companies with simpler IT are often easier to break into and hit harder by the cost of recovering.
Your ordinary business policy was not written for this. This guide explains what cyber insurance actually pays for, how POPIAThe Protection of Personal Information Act, South Africa's data protection law. It sets rules for how a business collects, stores and protects personal information about people, and the Information Regulator enforces it.In this guidePOPIA caps an administrative fine from the Information Regulator at R10 million. That is the ceiling, not the likely fine for a small business: the Regulator weighs how many people were affected and whether the breach could have been prevented. fits in without the scare figures, what it costs where a price is published, and the three ways a South African small business can buy it: through its bank with Standard Bank, online with Bi-me, or through a broker with Santam. I use those three as the examples all the way through, so each one's place is clear by the time you reach it.
What cyber insurance pays for
A cyber policy is triggered by two kinds of event. iTOO calls them a network breach, where someone gets into your systems through hacking, malware, a denial-of-service attack or a stolen device, and a privacy breach, where personal or confidential information about staff, clients or suppliers is leaked, exposed or misused.
The response
Forensic investigators to find the cause and the extent, legal and public relations advice, crisis communications, and notifying the people whose data was affected. iTOO calls this incident response; Bi-me calls it crisis management and notification.
Your own losses
Restoring or recollecting lost data, lost income while systems are down, cyber extortion, and on iTOO's policy, theft of funds and some regulatory fines where the law allows them to be insured.
Claims against you
Defence and settlement when clients or others claim for a privacy breach, for an attack launched through your systems, or for content your business published online.
Limits and sub-limits differ for each part, so read the schedule for each one, not only the headline limit.
One condition in Bi-me's description is worth knowing before you tell anyone about your cover: the insurer can cancel cyber extortion cover if it becomes public that your business has it. Keep the policy to the people who need to know.
POPIA, without the scare figures
POPIA caps an administrative fine from the Information Regulator at R10 million. That is a ceiling, not a likely fine for a small business, and the Regulator weighs the kind of information involved, how many people were affected, the likelihood of harm and whether the breach could have been prevented.
You will also see an average data-breach cost of about R44 million quoted on insurer pages, from IBM research. That is an average across organisations of every size, including very large ones, and it tells a five-person business very little. The more useful question for you is what a breach would cost to investigate, how long you could work without your systems, and how many clients you would have to notify.
A policy cannot always pay a fine
iTOO lists regulatory fines as a cover and Bi-me describes fines and penalties for a privacy breach as covered where they are legally insurable. Some fines cannot lawfully be insured at all. Ask the insurer, in writing, what its wording pays towards a POPIA fine.
What it costs
Standard Bank is the only seller I found that publishes a cyber price: from R160 a month, depending on your cover requirements and risk rating. Bi-me and Santam quote individually, and iTOO quotes through brokers.
iTOO's proposal form shows what drives the quote. It asks for technical questions to be completed by your IT team or provider, and it singles out the number of records you hold, because each question affects the premium. The more personal records you keep, and the weaker your controls, the more it costs. The cost guide sets this price beside every other published business insurance price.
Three ways to buy it
Two of the three routes lead to the same specialist, iTOO, with Hollard as the insurer, and the third is Santam's own cover. So the choice is as much about how you want to buy as about the policy: online, through a bank's brokerage, or through a broker with the whole of your business in view.
If you would rather not read all three, answer the three questions below and they will point you to the way of buying that fits your business. They point to a route, not to an insurer, and each route is explained in full straight after.
Not sure which route is yours?
Three quick questions point you to your route
Answer for your own business. This points to a way of buying, and names who sells it that way.
1How much personal information do you hold?
2Do you already use an insurance broker?
3What matters most right now?
Before you answer
Start with a published price, for most small businesses
A starting price shows you what cyber cover costs before you share anything about your business.
The trade-off: a starting price may not include the limit or sub-limits you need.
This points to a type of cover from how you answer, and names who sells it that way, from each insurer's own site on 24 September 2026. It is general information, not advice: read the policy wording, or speak to a licensed broker, before you buy.
1. Standard Bank - a published price
Standard Bank's Commercial Cyber Insurance is the only one with a price on the page, from R160 a month, and the bank describes it as sold online end to end, or through a call-back. It is sold by Standard Bank Insurance Brokers, underwritten by Hollard, and claims go to iTOO's incident response line.
1Published price
Standard Bank Commercial Cyber Insurance
Why it's first
Standard Bank publishes a cyber starting price and sells the Hollard policy online.
- CoversExtortion, malware, hacking, denial of service, insider misuse, device theft
- InsurerHollard, with iTOO
- How you buyOnline, call-back or 0860 123 999
- LicenceFSP 224
- Sells toa business that wants to see a price first
- Check in your quotethe limit and excess the R160 includes
you'll go to www.standardbank.co.za
Best for: a small business that wants to see a price before it speaks to anyone.
2. Bi-me - online, with limits up to R15 million
Bi-me sells iTOO's cyber cover online, with limits available up to R15 million, and says a quote takes about five minutes. Its page lists crisis management and notification costs, forensic and legal expenses, data restoration, network Business interruptionCover for the income a business loses, and the extra costs it carries, while it cannot operate normally after an insured event.In this guideBi-me's cyber cover lists network business interruption: the income you lose while your systems are down after an attack., cyber extortion and digital media liability.
2Highest online limit
Bi-me Cyber Liability
Why it's on this list
Bi-me quotes iTOO cyber cover online with limits up to R15 million.
- LimitsUp to R15 million
- IncludesResponse, data restoration, lost income, extortion, media liability
- UnderwriteriTOO
- LicenceFSP 51534
- Sells toa business that holds client data and wants a higher limit online
- Check in your quotethe sub-limits for extortion and business interruption
you'll go to bi-me.co.za
Best for: a business holding a lot of client data, such as a practice, clinic or online shop, that wants a higher limit than a starting price suggests and would rather buy online than by phone.
3. Santam or any broker - cyber with the rest of your cover
Santam lists cyber insurance as an option on its business liability cover, arranged through an intermediary. A broker can also quote iTOO's own small-business cyber product on iTOO's DigiEase platform, which is for companies with revenue under R250 million wanting up to R25 million of cover, and which iTOO sells only through brokers.
3With your business policy
Santam Cyber Insurance
Why it's on this list
Santam adds cyber cover to its business liability options through intermediaries.
- How you buyThrough an intermediary
- Combines withSantam business and liability cover
- Also via brokersiTOO DigiEase SME, up to R25 million
- LicenceFSP 3416
- Sells toa business that wants cyber on the same schedule as its other cover
- Check in your quotehow cyber claims are handled, and by whom
you'll go to www.santam.co.za
Best for: a business with a broker already, or one whose revenue, data or systems need a limit or wording above what an online quote offers.
Before you apply
Count your records
Roughly how many people's personal information you hold: clients, staff, suppliers. iTOO's form singles this out because it drives the premium.
Ask your IT person to answer the technical questions
Backups, multi-factor authentication, antivirus and who has admin access. iTOO asks for these to be completed by your IT team or provider, and a wrong answer can undo a claim.
List the systems you cannot work without
Your accounting software, point of sale, email and client database. That list tells you how much business interruption cover to ask for.
Check your cloud providers' cover
If a supplier stores your client data, ask what their own cover is. Bi-me suggests considering it when you choose a limit.
Then compare quotes on the same limit, the same excess and the same sub-limits for extortion and lost income.
The bottom line
Cyber insurance is for the week after something goes wrong: paying people who know how to contain it, telling your clients properly, getting your data back and covering the income you lose meanwhile. POPIA is a reason to take that seriously, not a reason to panic.
If you want a price first, Standard Bank publishes one from R160 a month. If you hold a lot of client data and want to buy online, Bi-me offers limits up to R15 million. If you already have a broker, or need more than an online quote, Santam and iTOO's broker-only product are the route.
If you skipped ahead, the three questions at the start of the list point you to a buying route.
Questions people actually ask
How much does cyber insurance cost in South Africa?
Standard Bank publishes Commercial Cyber Insurance from R160 a month, depending on cover requirements and risk rating, on 17 September 2026.Bi-me, Santam and iTOO's brokers quote individually, and the number of personal records you hold and your IT controls drive the premium.
Does POPIA require cyber insurance?
No. POPIA requires you to protect personal information and caps an Information Regulator administrative fine at R10 million, but it does not require insurance.Cyber insurance pays response, recovery and liability costs after a breach, and pays fines only where the wording and the law allow.
Does cyber insurance cover ransomware?
The policies described by iTOO, Bi-me and Standard Bank include cyber extortion and malware, including ransomware.Bi-me notes that the insurer can cancel extortion cover if it becomes public that your business has it.
Who underwrites small business cyber insurance in South Africa?
iTOO Special Risks (FSP 47230), with Hollard as insurer, sits behind the cyber cover sold by Bi-me and Standard Bank on 17 September 2026, and Santam offers its own.iTOO's own SME product, DigiEase, is sold only through brokers.
Does my business policy already cover cyber attacks?
Usually not in any depth.Cyber cover is sold as its own policy or as a specific option, as Santam lists it on its business liability cover. Check your wording for cyber exclusions before assuming you are covered.
