My Account
Data Centre Insurance in the UK: Construction, Engineering, Computer & Cyber Cover (Complete Guide)
Introduction: why data centres need specialist insurance
Data centres sit at the crossroads of construction risk, high-value engineering, and digital exposure. Whether you’re building a new facility, expanding a live site, or operating a colocation environment, the risk profile is very different to a standard commercial property.
A single incident can trigger multiple loss types at once: physical damage to plant, service interruption, contractual penalties, data restoration costs, and third‑party claims. The right insurance programme is usually a combination of construction engineering insurance, computer and machinery cover (often called engineering insurance or machinery breakdown), and cyber insurance.
This guide explains how these covers work together in the UK, what to watch for in the small print, and how to structure a policy that matches how your site actually operates.
What we mean by “data centre insurance”
There isn’t one universal “data centre policy”. Most operators and developers build a package that may include:
- Construction engineering insurance for new builds, refurbishments, and upgrades
- Contract works / CAR (Contractors’ All Risks) to protect the project works and materials
- Erection All Risks (EAR) for installation-heavy projects (e.g., M&E, switchgear, generators)
- Delay in Start-Up (DSU) / Advanced Loss of Profits (ALOP) to cover financial loss if completion is delayed by insured damage
- Engineering / machinery breakdown for operational plant and equipment
- Computer / electronic equipment cover for servers, network hardware, and control systems
- Cyber insurance for security incidents, ransomware, and data/privacy liabilities
- Business interruption (BI) and service interruption extensions
- Public and products liability and employers’ liability
- Professional indemnity (for design, consultancy, or managed services)
The key is designing the programme so there are no gaps between the “build phase” and “operate phase”, and so triggers and definitions align across policies.
Core risks for data centres (construction + operational)
Data centres face a blend of traditional property risks and specialist engineering and cyber exposures.
Construction and engineering risks
- Fire during fit-out (hot works, temporary electrics, packaging waste)
- Water damage (sprinkler discharge, burst pipes, drainage failures)
- Cable and containment issues (overheating, poor termination, insulation faults)
- Switchgear and transformer failures during commissioning
- Generator and UPS issues (load testing, fuel contamination, battery thermal runaway)
- Theft of copper, tools, plant, and high-value components
- Design or specification errors leading to rework or performance shortfall
- Damage to existing property during upgrades in a live environment
Operational risks
- Power events (surge, brownouts, grid failure, transfer switch failure)
- Cooling failures (chillers, CRAC/CRAH, pumps, valves, controls)
- Machinery breakdown (mechanical/electrical failure of plant)
- Fire and smoke damage (including damage from suppression systems)
- Water ingress from roof, plant rooms, or external flooding
- Supply chain and spares delays (long lead times for switchgear/transformers)
- Contractual penalties and SLA credits
- Cyber incidents (ransomware, DDoS, supply chain compromise)
Construction engineering insurance: protecting the build and upgrade phase
If you’re constructing a new data centre or undertaking major works, construction engineering insurance is the backbone.
Contractors’ All Risks (CAR) / Contract Works
CAR typically covers physical loss or damage to the works during the project, including:
- Permanent and temporary works
- Materials on site (and sometimes in transit)
- Plant and equipment (depending on structure)
For data centres, it’s common to need bespoke wording around:
- Phased handover (parts of the site become operational before practical completion)
- Testing and commissioning (high-risk period for M&E)
- Existing structures (upgrade within a live facility)
- Off-site storage of critical components
Erection All Risks (EAR)
EAR is often used where the project is dominated by installation and commissioning of machinery and electrical systems. This can be relevant for:
- Switchgear, transformers, busbars
- UPS systems and battery rooms
- Generators and fuel systems
- Cooling plant and controls
EAR can be paired with CAR or used as a standalone depending on the contract structure.
Testing and commissioning (T&C)
For data centres, T&C is where insurers focus. You’ll want clarity on:
- When T&C cover begins and ends
- Whether “hot testing” and load testing are included
- Any sub-limits for damage during commissioning
- Requirements for method statements, supervision, and sign-off
Delay in Start-Up (DSU) / Advanced Loss of Profits (ALOP)
DSU covers financial loss if an insured physical damage event delays completion. This can include:
- Loss of gross profit / revenue
- Increased cost of working (e.g., temporary capacity)
- Debt servicing or standing charges (depending on wording)
For colocation projects, DSU can be crucial if tenant contracts depend on a go-live date.
Key exclusions and pitfalls in construction cover
Common issues to check:
- Defective design / workmanship exclusions (and any “LEG” clauses)
- Wear and tear (not relevant to construction, but sometimes appears in endorsements)
- Consequential loss (DSU is the solution, but must be added)
- Flood and subsidence restrictions depending on location
- Hot works conditions and permits
- Security requirements (CCTV, fencing, guards, out-of-hours access)
Engineering insurance: machinery breakdown for operational resilience
Once the site is live, engineering insurance (machinery breakdown) helps where property insurance may not respond.
What machinery breakdown typically covers
Engineering insurance is designed for sudden and unforeseen physical damage caused by breakdown, such as:
- Electrical arcing in switchgear
- Motor burn-out
- Mechanical failure of pumps and compressors
- Control system failure leading to damage
In a data centre, it can apply to:
- UPS and battery systems
- Generators and ATS/STS systems
- Transformers and switchgear
- Chillers, cooling towers, pumps, valves
- Building management systems (where insured as part of plant)
Why it matters alongside property insurance
Property policies often cover insured perils like fire, storm, escape of water. Machinery breakdown fills the gap where the cause is internal failure rather than an external peril.
For example, a switchgear failure that causes physical damage and triggers shutdown may be better aligned to engineering cover than standard property cover.
Business interruption and service interruption extensions
Data centres often need BI that reflects:
- High dependency on utilities (power, telecoms)
- Service interruption from failure at a grid substation or third-party utility
- Long lead times for replacement parts
Check indemnity periods carefully. A short indemnity period can be a hidden problem if replacement switchgear has a 20–40 week lead time.
Computer and electronic equipment insurance: servers, network gear, and control systems
Computer insurance (often packaged as electronic equipment cover) focuses on high-value IT and electronic assets.
What it can cover
- Servers and storage arrays
- Network switches, routers, firewalls
- Racks and structured cabling (depending on definition)
- Monitoring systems and environmental sensors
- Access control and CCTV systems
Cover can extend to:
- Accidental damage
- Fire and theft
- Transit and temporary removal
- Data media (sometimes limited)
Things to clarify for data centres
- Whether equipment owned by customers/tenants is included or excluded
- How “equipment” is defined (is cabling included? are batteries included?)
- Any sub-limits for portable equipment (less relevant, but can appear)
- Claims settlement basis (new-for-old vs indemnity)
Cyber insurance: when the incident is digital (and the costs are real)
Cyber cover is no longer optional for many data centre operators, especially those providing managed services or hosting regulated clients.
Typical first-party cyber cover
- Incident response and forensics
- Ransomware negotiation and extortion payments (where legal)
- Data restoration and system rebuild
- Business interruption from a cyber event
- Extra expense to maintain operations
Typical third-party cyber cover
- Liability for failure to protect data
- Privacy and regulatory investigations (e.g., ICO)
- Defence costs and settlements
- Media liability (if you publish content)
Key cyber questions for data centres
- Does the policy cover outsourced providers and cloud dependencies?
- Is business interruption triggered by:
- network interruption only, or
- system failure (non-malicious outage) too?
- Are DDoS events covered, including mitigation costs?
- Are there exclusions for:
- unpatched vulnerabilities
- unsupported software
- critical infrastructure / nation-state attacks
Cyber insurance is heavily dependent on controls. Expect questions about MFA, patching, backups, segmentation, and incident response planning.
How these covers fit together (and where gaps happen)
The most common gaps appear at the boundaries:
- Handover from construction to operations: if practical completion is phased, make sure the policy recognises partial handover and ongoing works.
- Testing and commissioning: ensure T&C is covered under the construction policy, and that the operational engineering policy doesn’t exclude early-life failures.
- BI triggers: property/engineering BI may require physical damage; cyber BI requires a cyber trigger. If you want cover for non-damage outages, you need the right extensions.
- Tenant/customer equipment: clarify who insures what, and how liability is handled.
A well-structured programme aligns definitions of:
- Insured property
- Occurrence/event
- Indemnity period
- Waiting periods (time excess)
- Sub-limits for utilities and service interruption
What insurers will want to know (to price and underwrite correctly)
To get a strong quote and avoid surprises at claim time, be ready with:
- Site location(s), flood exposure, and construction details
- Total project value and timeline (for construction)
- Values split by building, plant, and IT equipment
- Power design (N, N+1, 2N), redundancy, and maintenance regime
- Fire detection/suppression approach (and any gas suppression)
- Security controls (physical + cyber)
- Tenant profile (regulated industries, critical services)
- Contractual obligations (SLAs, penalties, limitation of liability clauses)
- Business continuity and disaster recovery plans
Practical risk management that can reduce premiums
Insurers like evidence of control. Common improvements include:
- Documented maintenance schedules for UPS, generators, and switchgear
- Thermographic surveys and electrical testing
- Water leak detection and zoning
- Clear hot works permits and housekeeping standards
- Segmented networks, MFA, offline backups, and tested restore processes
- Incident response plan with named roles and suppliers
Even small changes (like better leak detection in plant rooms) can materially change the risk.
FAQs: data centre insurance (UK)
Do I need both machinery breakdown and computer insurance?
Often, yes. Machinery breakdown is aimed at plant and mechanical/electrical systems; computer/electronic equipment cover focuses on IT hardware and electronics. Many data centres need both because the loss scenarios are different.
Will a standard property policy cover a UPS failure?
Not always. If the failure is internal breakdown rather than an insured peril like fire, property insurance may not respond. Engineering/machinery breakdown is designed for that gap.
Does cyber insurance cover downtime from a ransomware attack?
Many policies can cover cyber business interruption, but triggers, waiting periods, and sub-limits vary. You’ll want to confirm how “interruption” is defined and whether dependent providers are included.
What about works in a live data centre?
You’ll likely need cover for damage to existing property and clear rules around access, supervision, and method statements. Insurers will also focus on hot works, dust control, and isolation procedures.
Can DSU cover lost revenue if the build is delayed?
Yes, if DSU/ALOP is added and the delay is caused by insured physical damage. It won’t cover pure contractual or planning delays.
Call to action
If you’re developing, upgrading, or operating a UK data centre, the right insurance programme should reflect your real-world risks: construction engineering exposures, high-value plant and equipment, and modern cyber threats.
If you’d like, share a few details (new build vs upgrade, target go-live date, and whether you provide colocation or managed services) and we can outline a sensible insurance structure and the key questions to ask insurers before you bind cover.