THE ESSENTIALS
Before you start
- Portuguese insurance law prohibits transferring administrative-offence liability by insurance.
- Any associated civil liability is a separate matter.
- Paying for defence services is different from paying the fine.
The statutory prohibition concerns the sanction
Article 14(1)(a) of the Portuguese insurance contract regime prohibits contracts covering criminal, administrative-offence or disciplinary liability. A fine imposed on the business itself by the authority must not be confused with civil compensation sought by a customer.
Paragraph2 states that this prohibition does not extend to any associated civil liability. Data liability therefore does not make every consequence insurable, while the prohibition on covering the sanction does not mean every other incident expense is excluded. Each item needs its own assessment.
A civil claim requires a separate assessment
If an affected person seeks compensation, civil liability and the contract must be examined. Article 137 defines liability insurance by reference to an obligation to compensate third parties. Being legally permitted to insure that risk does not establish that a particular claim falls within the Cyber policy purchased.
Ask the proposal to distinguish potential claimants, the losses considered, exclusions and limits. A threatened claim, a sanction decision and a technical expense are different records; combining them into one loss estimate does not explain what each amount represents.
Defence and a fine are different benefits
Article 167 describes legal expenses insurance in terms of legal services and judicial or administrative proceedings. That serves a different function from transferring the sanction. A Cyber policy’s reference to defence does not itself confirm cover for any lawyer, procedure or fee.
Locate the relevant benefit, the conditions for using services, limits and the expense procedure. Where a proceeding carries a deadline, obtain competent assistance promptly; do not expect a commercial insurance discussion to resolve a procedural duty.
Nuno keeps three accounts separate
Nuno prepares three lines without inventing amounts: a possible sanction from the authority; a possible civil claim by an affected person; and requested technical or legal support. Clara asks that each future amount have its own record and explanation. For a small business, combining these accounts can create a false impression of available funds.
This editorial method does not determine an offence, a fine or coverage for an incident. To compare future protection, describe the business and its dependence on systems. For an existing incident, follow the plan and policy channels while the competent people assess data-protection obligations.
What to do
1. Separate a sanction imposed on the insured, a civil compensation claim and response or defence costs.
2. Ask for the relevant provision and legal basis for each item; a global limit is not proof of payment.
3. Refer notices and deadlines to competent technical and legal support through the appropriate process.
4. When comparing Cyber insurance, describe the business without posting customer databases, credentials or case files publicly.
KEEP THESE QUESTIONS
Your checklist for the next conversation
- Sanction and civil compensation separated.
- Relevant cost benefit and provision located.
- Deadlines and responsible people recorded.
- Sensitive information kept within the appropriate process.
FROM THE ARTICLE TO YOUR SITUATION
Let us discuss your situation
Tell us what you want to protect. We review your request and help compare relevant terms. Requesting a quotation does not activate insurance.
Sources and transparency
Content updated on .
Consultation dates are stated in individual references when available.
Numerical examples are fictional and explain concepts. Editorial interpretations are identified in the text.
Information from RMACHADO GROUP. This is not an insurance offer or individual advice. Covers, acceptance, exclusions, sums insured and costs depend on the policy. The intermediary does not underwrite the risks.