1. Forms
2. BP
3. BP-15-05

What the Form Is

The BP 15 05, titled "Exclusion – Access Or Disclosure Of Confidential Or Personal Information And Data-Related Liability – Limited Bodily Injury Exception Not Included," is an endorsement to the ISO Businessowners Coverage Form (BP 00 03). Its primary function is to remove coverage for certain liabilities associated with data breaches and other data-related incidents. Specifically, it excludes damages (other than those defined as "personal and advertising injury" under the policy, though the scope of this exclusion is broad) arising from any access to or disclosure of confidential or personal information. This includes items like patents, trade secrets, customer lists, financial information, credit card details, and health information. A key feature of this endorsement is that it eliminates the limited bodily injury exception that might be found in other similar data breach exclusion endorsements, such as the BP 15 04, making it a more restrictive option.

Classes of Business It Applies To

This endorsement can be applied to a wide range of businesses that handle sensitive information, thereby having an exposure to data-related liabilities. Examples include:

• Retail stores that collect and store customer payment information or loyalty program data.
• Professional service firms (e.g., accountants, consultants) that possess confidential client data.
• Small healthcare practices or clinics (though they often have specialized liability coverage) that handle patient health information.
• Any business with an online presence that collects user data or stores employee records electronically.
• Organizations that manage databases containing personal or proprietary information.

Essentially, any business insured under a Businessowners Policy that an insurer wishes to restrict coverage for data-related exposures could see this endorsement attached.

Special Considerations

The BP 15 05 is a significant exclusionary endorsement. Its use indicates an insurer's intent to substantially limit its exposure to losses stemming from data breaches and cyber incidents under the Businessowners policy.

• More Restrictive: It is explicitly more restrictive than the BP 15 04 because it does not provide an exception for bodily injury that might arise from the loss of or damage to electronic data.
• Coverage Gap: Businesses with this endorsement will have a significant gap in coverage for many common data breach scenarios and should be advised to seek specialized cyber liability insurance.
• Withdrawal: Some industry resources indicate that this form (BP 15 05) was slated for withdrawal. This suggests a potential shift in how insurers address cyber risks in BOPs, possibly moving towards different exclusionary endorsements or encouraging more comprehensive, standalone cyber policies. Agents should verify its current status and applicability in their specific jurisdiction and with the particular insurer.

Key Information for Agents and Underwriters

• Agents: It is crucial for agents to clearly communicate the impact of this endorsement to their clients. Policyholders must understand that this form significantly curtails coverage for data-related liabilities, and alternative solutions like a dedicated cyber liability policy should be strongly recommended.
• Underwriters: Underwriters may use this endorsement to manage the company's exposure to systemic cyber risks on Businessowners policies, particularly for classes of business with higher inherent data security risks where the insurer has a limited appetite for such exposures within the BOP. Attaching this endorsement signals that the BOP is not intended to cover these specific data risks.
• Risk Assessment: The presence of this endorsement should prompt a deeper conversation about the insured's data security practices and their overall cyber risk management strategy.
• Pricing: The premium for the Businessowners policy might reflect the removal of this potential area of coverage, although the primary impact is the significant reduction in coverage breadth for data-related incidents.