Electronic data processing insurance for South African businesses

Your bookkeeper sends the payroll file on a Friday afternoon and nothing unusual happens, until Saturday morning, when a thunderstorm knocks out the municipal supply to your Boksburg office for ninety minutes. The surge on reconnection takes out the workstation, the external backup drive plugged into it, and the network-attached storage unit in the server cupboard. The hardware is replaceable. Recreating eighteen months of financial records from paper source documents is a different project, measured in weeks and in the salary of whoever you pull off their actual job to do it. That is the gap electronic data processing cover is designed to sit in.

What is electronic data processing insurance?

Electronic data processing insurance, often abbreviated to EDP insurance, is a commercial cover designed specifically for the computers, servers, peripherals, and stored data a business depends on to operate. Where a standard office contents policy treats your server as furniture, an EDP policy recognises that the machine's replacement cost and the value of what it stores are two separate numbers, and insures both. It covers sudden and accidental physical damage, theft, power surge damage, and the cost of restoring or reconstructing data lost as a result of an insured event.

Key Takeaways

• EDP insurance is a standalone or endorsement-based cover for hardware, software, media, and data, it isn't included automatically in a commercial contents policy.
• It responds to physical damage, theft, power surge damage, and data loss caused by an insured peril, and it can extend to increased costs of working while your systems are down.
• South African businesses are increasingly data-dependent: financial records, client databases, diagnostic systems, and stock management platforms all carry a value the hardware alone doesn't reflect.
• The sum insured must reflect current replacement values for hardware and realistic reconstruction costs for data, because underinsurance applies here as it does to any other asset class.
• EDP cover works alongside, not instead of, cyber insurance: EDP responds to physical events; cyber insurance responds to network intrusions, ransomware, and data-breach liability.

What EDP cover actually responds to

EDP insurance responds to physical and electrical events damaging or destroying your IT assets. The core trigger is sudden and accidental damage: a server dropped during an office move, a water pipe failing above the server room, a power surge following load-shedding reconnection, or a fire reaching the comms cabinet before the suppression system activates. Theft of hardware, including laptops removed from a vehicle or a workstation taken in a smash-and-grab, also falls within the standard scope.

The cover splits into three layers working together. The first is hardware replacement, the cost of buying equivalent equipment to what was damaged or stolen, at current market prices rather than the depreciated book value. The second is software and media reinstatement, the cost of reloading licensed software, recovering media, and where recovery isn't possible, repurchasing licences. The third, and often the most significant in financial terms, is data reconstruction, the cost of rebuilding records unable to be recovered from backup, using staff time, external contractors, and source documents. A logistics business losing its routing and delivery history, or a professional services firm whose client files can't be recovered, faces a cost dwarfing the hardware it ran on.

Some EDP policies extend to an increased cost of working section, which pays the additional expense of running your business while the damaged system is being restored, such as renting temporary equipment or paying for emergency IT support. This extension operates similarly to the business interruption cover sitting alongside a commercial property policy: it covers the additional cost of keeping trading, not the loss of income itself. If you need both, and most businesses genuinely data-dependent do, the two extensions need to be structured together, not picked up separately at renewal as an afterthought.

Why a standard contents policy isn't enough

A commercial contents policy typically values IT equipment at its book value or its market value at the time of the loss. For a two-year-old server, that figure may be a fraction of what it costs to replace it with equivalent capacity today. Hardware prices haven't deflated uniformly: solid-state storage, high-availability servers, and enterprise networking equipment have all moved in price in ways a 2022 sum insured won't reflect in 2026.

More critically, a contents policy says nothing about data. The insurer replaces the box. What was in the box is your problem. For a manufacturing business whose ERP system, the software running production scheduling, stock control, and financial reporting, sits on that server, "replacing the box" is the beginning of a project taking months and costing multiples of the hardware value. South African businesses are following a global pattern of deepening data dependency: the Prudential Authority's review of AI and data use in financial services confirms operational processes increasingly depend on data systems whose disruption halts core functions. The same dependency exists in every data-intensive business, from accounting practices to medical facilities to logistics operators.

A standard contents policy isn't structured to respond to that gap. An EDP policy is.

The load-shedding and power surge exposure

South Africa has created a risk class most international EDP policy wordings weren't designed with in mind. Repeated load-shedding cycles, abrupt power cuts followed by reconnection, produce voltage irregularities damaging sensitive electronics. The surge on reconnection is the more damaging event, because it can push voltage above the tolerance of unprotected equipment in the fraction of a second before a circuit breaker responds.

Most businesses have invested in UPS units (uninterruptible power supply systems, battery-based devices keeping equipment running during an outage and regulating the voltage on reconnection) and surge suppressors. But UPS units have a rated capacity and a service life, and a suppressor absorbing several moderate surges may not perform when a large one arrives. Many EDP claims in South Africa arise from the edge case: the protection was present but had degraded, and the policy question becomes whether the insurer treats this as sudden and accidental damage or as a maintenance failure.

The distinction in the wording counts. An EDP policy covering power surge damage without a broad maintenance exclusion responds to this loss. A policy with a poorly defined "gradual deterioration" exclusion may not. When reviewing an EDP policy, the power-surge clause and any associated exclusions deserve specific attention, not a skim, but a read-through of the exact wording with someone who can explain what each phrase means in a claims context. The exclusion is rarely on the page where the cover is described; it tends to sit two sections later, in a different font size.

What electronic data processing insurance excludes

Understanding what the policy doesn't cover is as important as knowing what it does. EDP insurance isn't cyber insurance, and the distinction counts for more than the naming suggests. EDP insurance responds to physical events, a fire, a flood, a surge, a theft. It doesn't respond to a network intrusion, a ransomware attack encrypting your files without touching the hardware, a phishing event giving an attacker access to your systems, or a data breach exposing client information. Those losses are the domain of cyber insurance, and the global cyber insurance market reached approximately USD 15 billion in 2024, reflecting how significant and how fast-growing that separate risk class has become.

The standard EDP exclusions your policy is likely to contain include: wear and tear and gradual deterioration; mechanical or electrical breakdown not caused by an insured external event (a distinction counting for ageing equipment); wilful damage or neglect; loss of data due to operator error where no physical damage occurred; software viruses and malware (cyber cover territory); and consequential loss beyond what the policy explicitly extends to. Business interruption flowing from an EDP event, the revenue you lose while your systems are down, not merely the extra cost of operating, requires a specific extension or a separate business interruption policy triggered by the EDP event.

The peer-reviewed literature on digital transformation in insurance notes businesses becoming more digitalised face a more layered risk architecture: physical damage, cyber risk, and business interruption are three distinct exposures overlapping without being interchangeable. Insureds treating them as one tend to find, at claim time, they've covered the centre of the Venn diagram without insuring its edges.

How to set the sum insured correctly

Underinsurance in EDP cover is common and expensive. The sum insured needs to reflect two distinct values, and most businesses set only one. The first is the hardware replacement value: the cost of buying equivalent equipment at today's prices, not the book value or the price you paid two years ago. The South African digital insurance platforms market is evolving rapidly, which means the replacement cost of enterprise hardware shifts with supply chains, exchange rates, and technology cycles. A server insured at its 2023 purchase price may cost 30 to 40 percent more to replace in 2026, depending on the specification and the rand's movement against the dollar.

The second value is data reconstruction cost: the realistic estimate of what it would cost to rebuild your records if they couldn't be recovered. This requires an honest assessment of what you hold, in what format, and whether source documents exist from which records could be recreated. A business moving to paperless records five years ago with limited external backup carries a higher reconstruction exposure than one with weekly offsite backups and a well-tested recovery plan. Both need cover, but the numbers will differ materially.

The table below illustrates how the two components interact for three common business types.

EDP sum insured components by business type

Figures are illustrative. Actual values depend on equipment age, specification, and the volume and nature of stored data.

The numbers in that table aren't the premium. They are what determines whether the claim pays out in full or whether the average clause cuts the settlement. The average clause, the mechanism reducing your claim in proportion to the gap between your sum insured and the actual replacement cost, applies to EDP cover as it does to buildings and stock. Setting the numbers correctly at inception and reviewing them annually isn't optional for a business where the data is worth more than the machines holding it.

EDP cover and the digitally dependent business

The research on operational digitalisation in South African businesses confirms what most business owners already sense: digitisation creates competitive advantage, but it also concentrates operational risk onto systems able to fail. A business running on paper ten years ago could lose a filing cabinet and keep trading. The same business today, running its invoicing, stock, HR, and client management through interconnected software platforms, faces a very different failure profile if the system goes down.

The importance of data-driven decision making in modern businesses is well established, and the corollary is straightforward: if the data is integral to how you make decisions and run operations, its loss carries an operational cost your insurance needs to reflect. EDP cover for a business at this level of dependency should include the data reconstruction extension, the increased cost of working extension, and a review of how the EDP and business interruption policies interact, because a system outage lasting three weeks will produce both types of loss simultaneously.

How the risk sits when the equipment belongs to someone else

Not every piece of equipment in your business is yours. Many South African businesses lease servers, rent point-of-sale terminals, or operate diagnostic equipment under a finance or rental agreement. The question of who insures leased equipment, and for what value, is one of the more reliably overlooked points at policy inception.

If the lease agreement requires you to insure the equipment, the sum insured must reflect the lessor's replacement cost, not your depreciated carrying value. If the agreement requires you to return the equipment in working order or pay the residual balance, a loss exceeding your sum insured leaves you paying the shortfall to the lessor while also absorbing the operational disruption. The lease documentation and the EDP policy schedule need to be read alongside each other, not because this is interesting reading, but because the mismatch between them is exactly what produces a gap at claim time.

The cover belonging alongside EDP insurance

EDP insurance and cyber insurance are frequently confused for the same product and shouldn't be, because the exposures they respond to don't overlap in the way most people assume. EDP responds when the physical event is the cause. Cyber insurance responds when the digital intrusion, the ransomware, the phishing attack, the data breach, is the cause. A fire destroying your server room is an EDP claim. An attacker encrypting the same server remotely without damaging it physically is a cyber claim.

What the two share is the outcome: your business can't operate as it was. What they don't share is the trigger, and the policy responding is determined by the trigger, not the outcome. A business with EDP cover and no cyber cover is exposed to network intrusion events. A business with cyber cover and no EDP cover is exposed to physical damage and power events. Most businesses with a meaningful data estate need both, structured so the two policies respond to their respective triggers without gaps between them.

When a server is a server, and when it is not

EDP insurance tends to be taken seriously by businesses in industries where the connection between data and money is visible: financial services, healthcare, logistics, and professional services. In businesses where the IT setup feels more incidental, a workstation here, a shared drive there, the cover is either absent or set at figures making sense in a different decade.

The honest question isn't whether your business has computers. Every business does. The question is what would happen if they stopped working for two weeks. If the answer is "we'd be in trouble but we'd manage", a modest EDP policy with reasonable data reconstruction cover is probably sufficient. If the answer is "we wouldn't be able to trade, invoice, manage stock, or service clients", the EDP cover needs to reflect that dependency in its structure and its sums insured, and it needs to sit next to a business interruption extension responding when the system failure translates into lost revenue.

When the hardware is valued but the data is not

Most EDP claims falling short do so because the data reconstruction element was either excluded or set at a figure bearing no relationship to the actual reconstruction cost. The hardware gets replaced. The data, client records, financial history, diagnostic images, proprietary databases, can't be recovered from the backup never tested, and the reconstruction cost runs past the limit in the first week.

This is a predictable outcome, and it is avoidable. The electronic data processing insurance policy correctly structured for your business names a realistic data reconstruction limit, an increased cost of working extension matched to your actual operational exposure, and hardware replacement values reviewed against current market prices rather than last year's schedule.

The conditions for a loss are already present

Running a business in South Africa without adequate EDP cover is like storing your most valuable records in a room with a skylight and no weatherproofing: nothing terrible has happened yet, but the conditions for it are already present.

The hardware can be replaced. The data can sometimes be reconstructed. The weeks it takes, and what those weeks cost, are the part most businesses haven't accounted for. An EDP policy covering all three layers, equipment, data, and operational cost, closes the gap before the gap becomes the story.

You shouldn't have to find out at claim time your most valuable business assets were never actually covered. With Mont Blanc Financial Services you won't.

Contact Mont Blanc Financial Services to review your current IT cover, set the sums insured correctly, and make sure your EDP policy and cyber cover respond where each one should.

If you're unsure which questions to ask when reviewing your electronic data processing insurance, or how EDP cover fits alongside your existing computer insurance, the answers below address the most common points of confusion.

Frequently Asked Questions

What does electronic data processing insurance typically cover?

Electronic data processing insurance typically covers three categories of loss arising from a sudden and accidental physical event. The first is hardware: the replacement cost of computers, servers, workstations, peripherals, and associated equipment damaged or stolen as a result of an insured peril. The second is software and media: the cost of reloading licensed programmes and reinstating media from backup where possible. The third is data reconstruction: the cost of rebuilding records unable to be recovered, using staff time, specialist contractors, or source documents.

Many EDP policies extend to an increased cost of working, the additional expense your business incurs while the system is being restored, such as renting temporary equipment or outsourcing processing work. This extension doesn't pay lost revenue; it pays the extra cost of keeping operations going. If your business would lose income, not merely incur extra costs, a business interruption extension or a separate business interruption policy needs to be structured alongside the EDP cover. The interaction between the two policies should be confirmed before a claim arises, not during one. An accounting practice, for example, whose client portal goes down for three weeks during tax season faces both types of loss running simultaneously.

What is typically excluded from electronic data processing insurance?

EDP insurance doesn't cover cyber events: ransomware, network intrusions, data breaches, and phishing losses are the domain of cyber insurance, which responds to digital attacks rather than physical damage. Standard EDP exclusions also include wear and tear, gradual deterioration, mechanical or electrical breakdown not caused by an insured external event, operator error where no physical damage occurred, wilful damage, and loss caused by software viruses or malware.

Business interruption, the revenue your business loses while systems are down, is excluded unless you have specifically added a business interruption extension to the EDP policy. Leased equipment may also fall outside scope if the policy wasn't structured to include it. The most common cause of a short or declined EDP claim isn't fraud: it is that the cover was set up without reading the exclusions alongside the insuring clauses, so the event sits in a gap between the two. Reviewing the exclusions section with your broker before a loss occurs, not during one, is the most reliable way to confirm your cover does what you expect.

What is considered EDPE and what equipment qualifies?

EDPE stands for Electronic Data Processing Equipment, the term used in policy wordings and underwriting schedules to define the assets the cover applies to. It includes computers in the conventional sense: desktops, laptops, servers, and workstations. It also extends to equipment processing data as its primary function, even where it doesn't look like a conventional computer: medical diagnostic machines, laboratory analysers, programmable manufacturing equipment, point-of-sale terminals, and network infrastructure components such as routers, switches, and storage arrays.

The test applied by most underwriters is functional rather than categorical: if the equipment's primary purpose is to receive, store, process, or transmit data, it is likely to qualify as EDPE. Equipment incidentally containing electronics, a photocopier with a memory chip, an air-conditioning unit with a digital controller, may or may not qualify, depending on the wording. If your business operates equipment in a grey area, the schedule should name it specifically and an underwriting confirmation should be obtained in writing. A verbal assurance something is covered isn't cover; the schedule is. Your broker can request written confirmation from the underwriter and attach it to the policy file so there is no ambiguity if a claim arises.