Technology errors and omissions insurance for when your software lets a client down.

California's breach lawsuit rule: Civil Code 1798.150

The CCPA's only private right to sue is for breaches. Under Civil Code 1798.150, a consumer can bring a civil action when nonencrypted and nonredacted personal information (as Civil Code 1798.81.5 defines it), or an email address with a password or security question and answer, is subject to unauthorized access and exfiltration, theft or disclosure because the business violated its duty to implement and maintain reasonable security.

• Damages: the statute sets not less than $100 and not more than $750 per consumer per incident, or actual damages, whichever is greater. Those amounts are adjusted every odd-numbered year; the California Privacy Protection Agency set them at $107 to $799 effective January 1, 2025.
• What the court weighs: the nature and seriousness of the misconduct, the number of violations, how long it went on, willfulness, and the business's assets, liabilities and net worth.
• 30-day notice and cure: before suing for statutory damages, individually or as a class, the consumer must give 30 days' written notice naming the provisions allegedly violated. If a cure is possible and the business cures within those 30 days and gives an express written statement, no statutory damages action may be brought. Adding reasonable security after the breach is not a cure for that breach. An individual suing only for actual pecuniary damages needs no notice.

Civil Code 1798.81.5(c) is why customer contracts ask about security: a business that discloses Californians' personal information under a contract with a nonaffiliated third party not already covered by the statute's security duty must require that party, by contract, to keep reasonable security. When you sign that clause, I send it to the underwriter with your cyber and tech E&O application.

Limitation of liability, indemnity and Civil Code 1668

Enterprise SaaS and services agreements move risk in two directions. IRMI describes a limitation of liability clause as one that caps the liability one contracting party may have to the other. An indemnity, or hold harmless, clause makes you answer for certain legal liabilities of your customer. IRMI sorts these into limited, intermediate and broad forms; under the broad form you hold the customer harmless even for suits based on the customer's sole negligence, and IRMI notes broad forms are unenforceable in a number of states.

California sets an outer limit in Civil Code 1668: "All contracts which have for their object, directly or indirectly, to exempt any one from responsibility for his own fraud, or willful injury to the person or property of another, or violation of law, whether willful or negligent, are against the policy of the law." What that means for a particular clause is a question for your attorney. I don't give legal advice.

What I pull out of an MSA before it goes to an underwriter:

• The cap amount and every carve-out from it, such as data breach, confidentiality, IP infringement or indemnity obligations.
• Who you indemnify, for what, and whether the wording reaches the customer's own negligence.
• Security and breach-notice duties you accept, including notice deadlines shorter than the statute's.
• The insurance section: required lines, limits, and any request to name the customer on your policy.

Official sources

• California Civil Code 1798.150 (CCPA private right of action), California Legislative Information
• California Privacy Protection Agency: Updated Monetary Thresholds in CCPA
• California Civil Code 1798.81.5 (reasonable security), California Legislative Information
• California Civil Code 1798.82 (breach notification), California Legislative Information
• SB 446 (2025), Chapter 319: Data breaches: customer notification
• California Civil Code 1668, California Legislative Information
• IRMI: Limitation of Liability Clause
• IRMI: Hold Harmless Agreement
• IRMI: Technology Errors and Omissions Insurance
• Crum & Forster Specialty Ins. Co. v. DVO, Inc., No. 18-2571 (7th Cir. Sept. 23, 2019), GovInfo