Costs
Canadian Small Business Cyber Insurance: What $1 Million Costs in CAD
Canadian small business cyber insurance with a $1 million limit runs roughly $1,500 to $6,000 CAD a year, and the exclusions decide the real payout.
What to take away
- A $1 million cyber liability limit for a Canadian small business usually costs about $1,500 to $6,000 CAD a year.
- Those figures are illustrative broker quotes from Ontario and BC, not a national rate card.
- The premium is recurring and modest. Notification and call centre work is often excluded, and runs $5,000 to $25,000 per incident.
- Sub-limits decide the payout, not the headline limit. Ransomware is often capped near $250,000.
- Two firms with identical revenue can be quoted very different numbers because local insurer appetite differs.
Line by line: recurring premium and event-driven costs
A $1 million limit is usually one shared pot. Four lines are charged as annual premium. Two lines are paid from the limit when an incident happens, and one of them often sits outside it.
The figures below are illustrative CAD amounts from broker quotes in Ontario and BC. They are not a national rate card.
| Line | How it is charged | Illustrative cost (CAD) |
|---|---|---|
| Network security liability | Recurring premium | 300 to 900 a year |
| Privacy liability | Recurring premium | 350 to 1,100 a year |
| Breach response | Recurring premium | 400 to 1,400 a year |
| Business interruption | Recurring premium | 250 to 900 a year |
| Ransomware and social engineering | Event driven, paid from the limit | No extra premium, capped at 100,000 to 250,000 |
| Notification and call centre | Event driven, often outside the limit | 5,000 to 25,000 per incident |
Two rows deserve attention. Ransomware and social engineering are event driven and usually sub-limited. Notification and call centre work are also event driven, and many small policies leave them outside the limit entirely.
Before you compare quotes, know what Canadian cyber insurers ask before covering a small business, because the application questionnaire moves the number more than the limit does.
Underwriters price on annual revenue, the type and volume of personal information you hold, your sector, and the controls you can evidence. Federal cyber insurance guidance for small businesses lists the same pricing variables.
Example: an 18-person Ontario marketing agency
An Ontario marketing agency with 18 staff holds client contact lists and one HR system. Brokers quoted a $1 million limit at $2,200 to $2,600 CAD a year. Ransomware was capped at $250,000.
The insurer required MFA on email and cloud admin accounts, tested offline backups, and an incident response plan naming an outside lawyer. Pre-binding remediation came to about $9,000.
That remediation is worth more than three years of premium at the quoted rate. Read the declarations and exclusions in a commercial policy before you sign off on a sub-limit that looks generous on the cover page.
Why Ontario and BC quotes differ
Insurer appetite moves the number, not the province alone. Two brokers in the same city can reach different markets, and one may hold a facility the other does not. That is why a renewal can jump without any change in your own business.
Ontario brokers place this cover with domestic mutuals and specialty cyber writers. BC brokers use the same writers plus a few regional programs. Canadian capacity is thinner than US capacity, so one bad quarter can tighten a line for everyone.
The Ontario and BC quotes behind the $1,500 to $6,000 band came from brokers as indicative pricing for small firms, current at publication. No regulator publishes a Canadian cyber rate card, so treat any single number as a starting point.
Geography alone does not explain a quote. The comparison of why a New York City contractor and a rural Texas contractor pay different premiums shows how local loss costs and litigation feed the same calculation.
Costs that fall outside the premium
Recovery capability is its own line item. Forensics, legal fees, notification mailings and call centre hours scale with the number of records exposed, not with the limit you bought.
The Canadian Centre for Cyber Security guidance for small businesses covers the controls that hold those costs down. Treat them as budget rather than as a policy clause.
- Which lines carry a sub-limit, and how much ransomware cover sits inside the $1 million?
- Are the insurer's breach response vendors allowed to bill beyond the limit?
- Does the retainer cover forensics, legal fees and call centre hours, or only the first two?
- What remediation does the insurer require at renewal, and what does it cost?
Due diligence under PIPEDA continues whether or not you are insured. The Office of the Privacy Commissioner's PIPEDA overview sets out the notification duty behind the largest one-off cost.
Business interruption sits beside cyber cover in most small packages. The coinsurance formula in a worked business interruption coinsurance example shows why a short outage can still consume a large share of a limit.
