Does my insurance cover my app if I launch it worldwide?
Often only partly. Many tech E&O policies cover mistakes made anywhere but only promise to defend claims brought in the US, its territories or Canada, and outside those places the insurer may only have the right, not the duty, to defend. Before a worldwide launch, ask for worldwide territory with a duty to defend, and a cyber policy that answers foreign privacy laws such as the GDPR.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
An app store launch is a worldwide launch
When you publish to the App Store or Google Play, the default is usually every country the store serves. You did not plan an international business. You have one anyway, with users who can sue where they live and regulators who can write to you where your users live.
Most small business insurance was written with a US business in mind. That is fine for a bakery. For software that anyone in the world can download, the two clauses to read before launch are the territory clause on the tech E&O and the privacy law section on the cyber.
Duty to defend against right to defend
A duty to defend means the insurer must take on your defense. It hires or approves the lawyer and pays as the case goes, and you hand over the papers. A right to defend means the insurer may take part if it chooses, and otherwise you find a lawyer, pay the bills and ask to be paid back under the policy terms.
Many tech E&O forms say they cover your mistakes anywhere in the world, which sounds complete. Read the next line. The specimen in our library adds that the claim must be brought in the US, its territories, Puerto Rico or Canada. Its worldwide endorsement reaches claims brought anywhere, but outside those places the insurer reimburses you and has no duty to defend. For a founder, that is the difference between forwarding a lawsuit and running one in a foreign court with your own money first.
Ask the insurer three plain questions. Where can a claim be brought and still be covered? Where does the duty to defend apply? Does the limit or the retention change outside the US? Then match the answers to the countries your users are actually in.
Cyber and foreign privacy law
The GDPR reaches a US company that offers its app to people in the EU, paid or free. It asks you to report a breach to the regulator within 72 hours where feasible and, for most apps serving EU users from outside the EU, to name a representative in the EU. The UK has its own version that works much the same way.
Health and fitness apps carry the heavier version of this. The GDPR treats data concerning health as a special category, and a blood pressure reading is plainly health data. Weight, heart rate and workout logs tied to a named user can be too, depending on what they reveal. Special category data needs a specific legal basis, usually the user’s explicit consent, and breaking those rules sits in the highest fine tier.
So the cyber policy has to do more than pay for a US breach notice. Check that it covers breach response and notification under foreign laws, regulatory defense for a GDPR proceeding and privacy claims brought outside the US. Whether a regulator’s fine itself can be paid by insurance depends on the country and the wording, so ask rather than assume.
When the app also tells people what to do with their bodies
A fitness, nutrition or wellness app launching worldwide stacks two gaps. The territory gap above applies to every claim. The injury gap applies when a user follows the app and gets hurt, which most tech E&O forms exclude unless contingent bodily injury is added. Fix both on the same policy, and check that the contingent bodily injury grant follows the same worldwide territory as the rest of the E&O.
What to check before a worldwide launch
Typical questions for a software company with users outside the US. Your policy wording decides the real answer.
Tech E&O
- Clause to read
- Territory, or where claims may be brought
- What you want to see
- Claims brought anywhere in the world
Tech E&O
- Clause to read
- Defense
- What you want to see
- A duty to defend that applies wherever the claim is brought
Tech E&O
- Clause to read
- Bodily injury exclusion
- What you want to see
- Contingent bodily injury added, if the app gives advice people act on
Cyber
- Clause to read
- Breach response
- What you want to see
- Notification and response costs under foreign breach laws
Cyber
- Clause to read
- Regulatory coverage
- What you want to see
- Defense of a GDPR or other foreign privacy proceeding
Both
- Clause to read
- Sanctions
- What you want to see
- Know which countries no insurer can cover, and keep the app out of them
Some insurers write worldwide territory by endorsement. Ask for it before launch rather than after a claim.
The detail
A professional liability specimen form in our library covers errors committed anywhere in the world, provided the claim is brought in the United States, its territories or possessions, Puerto Rico or Canada.
Professional liability specimen policy form and worldwide territory endorsement, Boring Insurance specimen library
The worldwide endorsement to that specimen extends coverage to claims brought anywhere, but for a claim brought outside the United States, Puerto Rico or Canada the insurer pays defense costs and damages as reimbursement, has no duty to defend, and may take part in the defense at its discretion.
Professional liability specimen policy form and worldwide territory endorsement, Boring Insurance specimen library
The same specimen gives no coverage where trade or economic sanctions prohibit the insurer from providing it or paying a claim.
Professional liability specimen policy form and worldwide territory endorsement, Boring Insurance specimen library
The GDPR applies to a business outside the EU when it offers goods or services to people in the EU, whether or not they pay, or monitors their behavior in the EU.
Regulation (EU) 2016/679, General Data Protection Regulation, Article 3(2)
The GDPR defines data concerning health as personal data related to the physical or mental health of a person, including information that reveals their health status.
Regulation (EU) 2016/679, General Data Protection Regulation, Article 4(15)
The GDPR prohibits processing data concerning health, along with genetic and biometric data and other special categories, unless one of the exceptions in Article 9(2) applies, such as the person’s explicit consent.
Regulation (EU) 2016/679, General Data Protection Regulation, Article 9
Under the GDPR a business must report a personal data breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk.
Regulation (EU) 2016/679, General Data Protection Regulation, Article 33(1)
A business outside the EU that falls under the GDPR through Article 3(2) must name a representative in the EU in writing, with a narrow exception for occasional processing that does not include special categories on a large scale.
Regulation (EU) 2016/679, General Data Protection Regulation, Article 27
Breaking the GDPR’s rules on special categories of data can bring a fine of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher.
Regulation (EU) 2016/679, General Data Protection Regulation, Article 83(5)
A cyber specimen form in our library defines a GDPR proceeding as a formal investigation or administrative proceeding against the insured under the GDPR by a regulatory agency, started by a subpoena, demand or complaint.
Cyber liability specimen policy form, Boring Insurance specimen library
In 2026 a technology E&O form quoted to this agency for apps launching in app stores worldwide gave a duty to defend only in the US, its territories and Canada, and only a right to defend everywhere else.
Kevin Kelsey, agency placement experience
What this means for you
- Read the territory clause before you press publish. Find where a claim must be brought and where the duty to defend applies. If either stops at the US or Canada, ask for a worldwide endorsement and read what it changes.
- List where your users are. The store dashboard shows it. Give the insurer that list, and limit the launch to fewer countries if the coverage cannot follow.
- Ask the cyber insurer about the GDPR by name. Breach response under foreign law and defense of a regulator’s proceeding are the two parts that matter. A health or fitness app should say so, because that data is a special category in the EU.
- Keep the paperwork that goes with it. A privacy policy that matches what the app does, consent for health data and an EU representative where one is required all help. They are compliance, and the insurance stands behind them rather than in place of them.
Want this handled? Get a quote.
One licensed human replies the same business day. We do not sell your details or pass them to lead networks. Privacy policy.
Related questions
- Does tech E&O cover lawsuits filed outside the US?
Sometimes, and you have to read for it. Many forms cover errors made anywhere but require the claim to be brought in the US, its territories or Canada. A worldwide endorsement can extend that, though some only reimburse you for a foreign claim instead of defending it. Ask where claims can be brought and where the duty to defend applies.
- What is the difference between a duty to defend and a right to defend?
With a duty to defend, the insurer must take on your defense and pay for it as it goes. With only a right to defend, the insurer may join in if it chooses, and otherwise you hire a lawyer, pay the bills and ask to be paid back. Outside the US that can mean finding counsel in a foreign country on your own money first.
- Does the GDPR apply to a US app?
Yes, if you offer the app to people in the EU, paid or free, or track how they behave there. Article 3(2) of the GDPR says so. It brings breach reporting to the regulator within 72 hours where feasible and usually a duty to name a representative in the EU. The UK has its own law that works much the same way.
- Is fitness or weight data health data under the GDPR?
It can be. The GDPR defines data concerning health as personal data about a person’s physical or mental health that reveals their health status. A blood pressure reading clearly qualifies, and weight or workout logs tied to a named user can too. Health data is a special category under Article 9, so it needs a specific legal basis, usually explicit consent.
- Does cyber insurance cover GDPR fines?
Some cyber policies cover defense of a GDPR proceeding and some cover fines where the law allows it. Whether a fine can be insured at all depends on the country, so no policy can promise it everywhere. Ask what the policy pays for a foreign privacy investigation and a foreign breach notice, and read the regulatory section.
- What cyber insurance pays after a breach
- My fitness app is launching worldwide. What do I need?
Tech E&O with worldwide territory and a duty to defend, contingent bodily injury added for a user hurt following the app and cyber that answers foreign privacy laws. Place the general liability beside them so a user injury cannot fall between policies. Health readings are special category data in the EU, so say so on the cyber application.
- Insurance for health and fitness apps
- Can I just block some countries instead?
Yes, and it is a sensible choice when the coverage cannot follow. The App Store and Google Play both let you pick the countries an app is offered in. Some places are off limits to every US insurer because of sanctions, so keep the app out of those whatever the policy says.
Need this handled?
Reading about it and having it handled are different jobs, and the second one is ours. We place the accounts other brokers decline — claims history, a cancellation, an unusual operation, a business nobody wants to underwrite twice — and we will tell you when the policy you already have is the right one. Tell us the situation and a licensed human replies the same business day.
Want this handled? Get a quote.
One licensed human replies the same business day. We do not sell your details or pass them to lead networks. Privacy policy.
Written by Kevin Kelsey, founder and principal agent, CA License #6011822, at Boring Insurance. Last updated 2026-10-29. See all guides.