Recent studies call into question whether a company can insure against the unprecedented huge fines for violating the complex and vague EU privacy law, the General Data Protection Regulation (GDPR), or whether such insurance would cover liabilities arising from the new class action suits available under the GDPR. Companies with international exposure should check their cyber insurance policies to determine coverage of EU fines.
via Your Cyber Insurance Policy May Not Cover GDPR Fines and Liabilities | Womble Bond Dickinson.