Estimated reading time: 6 minutes
Aon and Wotton Kearney mapped cyber fines across 14 Asia Pacific jurisdictions. In 11, a fine may be insurable. In two, the answer is unclear. When it comes to mainland China, the law rules it out.
A cyber fine in Sydney and the same fine in Shanghai land very differently on an insurance policy. In Australia, no statute bars insuring a privacy fine. Cyber policies there often cover fines to the extent the law allows. In mainland China, liability insurance cannot cover administrative or criminal fines at all.
That split runs through a new report from broker Aon and law firm Wotton Kearney. The Changing Cyber Risk Landscape in APAC: Regulation, Fines and Insurability sets out cyber and privacy law in 14 jurisdictions as of June 2026. For each, it covers maximum fines, breach reporting, ransom payments, and the insurability of cyber fines.
The Insurability Of Cyber Fines, Market By Market
Aon’s summary says 13 of 14 jurisdictions may insure fines. The report’s own table splits that count further.
In 11 markets, a cyber fine may be insurable where no law expressly prohibits it. Cover is more likely when the fine follows innocent or negligent conduct rather than deliberate, reckless or criminal conduct. Those markets are Australia, Hong Kong, India, Indonesia, Japan, Malaysia, New Zealand, the Philippines, Singapore, South Korea and Thailand.
In Taiwan and Vietnam, insurability is uncertain. The report says fines there are likely uninsurable if they are meant to punish or deter. Taiwan’s Insurance Act does not prohibit cover, but indemnity could face a public policy challenge.
China is the one clear prohibition. Its rules for liability insurance bar cover for administrative or criminal fines. The report calls the position “clear and categorical.”
South Korea’s rating carries a caveat. The report says fines there are “generally not insurable” under the Civil Code’s public order rule. There are two exceptions. One is a personal information leakage product that covers data breach penalties. The other is regulator-approved extensions to directors and officers policies.
Cyber Fines And Penalties Keep Rising
Maximum fines range from about $6,000 in New Zealand to more than $35 million in Australia. India’s ceiling is about $30 million. China’s is about $7.3 million or 5% of revenue.
Aon says about half the jurisdictions reviewed apply revenue-linked penalties. Singapore can fine up to 10% of annual turnover. South Korea’s cap is 3% of turnover. Vietnam’s is 5%.
Australia shows how fast exposure can build. The penalty for a serious privacy breach is the greatest of the three figures. They are AUD 50 million, three times the benefit gained, or 30% of adjusted turnover. The privacy regulator can now issue infringement notices of up to AUD 330,000 without going to court. A statutory privacy tort took effect on 10 June 2025.
The report warns that courts could narrow the insurability of cyber fines over time. That risk grows if Australia converges with GDPR-style enforcement, it says.
Breach Notification From One Hour To 30 Days
Mandatory data breach reporting applies in 13 of the 14 markets. Hong Kong is the exception. Aon puts reporting deadlines across the region at between one hour and 30 days.
China sets the fastest clock. Incidents involving critical information infrastructure must reach the relevant authorities and police within one hour. Other network operators get four hours.
The report also maps ransom rules. No jurisdiction reviewed bans payment outright. Since 30 May 2025, Australia has required in-scope businesses to report ransom payments within 72 hours. Reports go to the Australian Signals Directorate. In Japan, cyber policies typically do not cover ransom payments. No ransom or kidnapping policies are currently approved there, the report says.
Get The Cyber Insurance News Upload
Subscribe to our weekly newsletter!
Limits Under Pressure
Aon says cyber claims in the region rose 233% in 2025 and a further 80% in the first half of 2026. Emma Carolan, Aon’s head of cyber claims and coverage for APAC, described claims rising “more than fivefold in just two years.” The report does not specify the claims base behind those figures.
Brent Rieth, Aon’s global head of cyber solutions, said cyber limit adequacy is “generally low compared to foreseeable losses.” Marsh research found the same pattern in the UK, where 67% of clients buy limits insufficient for a one-in-100-year loss.
The report urges multinational firms to stress-test limits, sublimits, retentions, towers and local policies against realistic scenarios. It points to cyber, directors and officers, and professional indemnity programs together. It also recommends tabletop exercises that include regulator-led investigations in several countries at once.
The worst time to find those gaps, Carolan said, is in the middle of a major incident.
FAQ – Insurability of Cyber Fines
Are cyber fines insurable in Asia Pacific?
It depends on the market. Aon and Wotton Kearney found fines may be insurable in 11 of 14 jurisdictions where no law prohibits it, uncertain in Taiwan and Vietnam, and expressly prohibited in mainland China.
When is a cyber fine more likely to be covered?
When it follows innocent or negligent conduct. Fines arising from deliberate, reckless or criminal conduct are much harder to insure, and fines meant to punish or deter may be uninsurable.
What is the largest cyber fine in the region?
Australia’s. Serious privacy breaches can draw the greater of AUD 50 million, three times the benefit gained, or 30 percent of adjusted turnover.
How fast must breaches be reported?
Mandatory data breach reporting applies in 13 of 14 markets, all except Hong Kong. Deadlines run from one hour for critical infrastructure incidents in China to 30 days.
Can companies pay ransoms in APAC?
No jurisdiction reviewed bans payment outright, but sanctions and counter-terrorism laws apply. Australia requires in-scope businesses to report ransom payments within 72 hours, and Japanese cyber policies typically exclude ransom.
What should risk managers do?
Aon recommends stress-testing cyber, D&O and professional indemnity limits against realistic multi-country scenarios and running tabletop exercises that include regulator investigations.
Related Cyber Insurance Posts
- Cowbell Wants The Cyber Policy Out Of The Drawer
- Cyber Insurance Coverage Reality Check: Key Lessons From EMEA Cyber Fine Trends(Opens in a new browser tab)
- Ransomware, AI, and Fines: Hiscox Report Urges SME Cybersecurity Action(Opens in a new browser tab)
- CrowdStrike Launches “Falcon for Insurability” to Enhance Cyber Insurance Eligibility(Opens in a new browser tab)
- CrowdStrike Cybersecurity Report – Six Key Takeaways for 2025(Opens in a new browser tab)