Most small businesses only discover a gap in their cover after something has already gone wrong, which is the most expensive way to learn what a policy should have included. Business insurance is not one product but several, and the ones that matter most to a small operation are cover for the premises and stock, public liability for third-party claims, cover for any business vehicles, and increasingly, cover for a cyber incident.
Business insurance can look overwhelming from the outside because it is really several separate risks bundled under one heading. Understanding what each piece actually covers makes it far easier to buy only what the business needs.
Cover for the premises and its contents
Fire, flood, storm damage and theft are the obvious risks to the physical space a business operates from, and this is usually the first cover a business takes out. It typically extends to stock, equipment and fittings, not just the building itself, so check the sum insured reflects current replacement cost rather than what it cost to buy years ago.
Public liability
However careful a business is, there is always a chance of a situation that leads to a third-party claim: a customer injured on the premises, or damage caused by an employee doing their job. Public liability cover is what stands between a single incident and a claim large enough to threaten the business.
Business vehicles
A vehicle used for business, whether it is a single delivery bakkie or a small fleet, needs commercial cover rather than a personal policy, because personal vehicle insurance is designed to exclude claims arising from business use. Confirm this explicitly with the insurer rather than assuming a personal policy extends automatically, since an uncovered claim discovered after an accident is the worst possible time to find out.
Professional indemnity, for advice-based businesses
Any business that gives advice, a consultant, an accountant, a designer, carries a different risk: a client claiming the advice given caused them a loss. Professional indemnity cover is built for that specific claim and is not the same as public liability, which does not typically respond to a dispute over the quality of advice given.
Cyber cover, increasingly not optional
A ransomware incident, a data breach, or a compromised email account used to redirect a payment are all now common enough that cyber cover has moved from a nice-to-have to a standard line item for any business holding customer data or handling payments online. Under section 22 of POPIA, a business that suffers a breach involving personal information has a legal obligation to notify the Information Regulator and the affected people, regardless of size, so the cost of an incident is not only the loss itself but the compliance process that follows it.
Business interruption cover
Property cover pays to repair or replace what was damaged. Business interruption cover pays for the income lost while the business cannot trade because of that damage, which is often the larger financial hit of the two. A business that has never modelled how long it would take to reopen after a serious incident is likely underinsured on this specific cover, even if the property cover itself is adequate.
Reading the policy before signing, not after a claim
Most disputes between a business owner and an insurer happen at claim time, over a definition or an exclusion the owner did not read closely when the policy was taken out. Two clauses are worth checking specifically before signing: the excess payable per claim, which affects whether a small claim is even worth submitting, and any exclusion for a specific cause of loss common in the business’s industry, such as flooding for a ground-floor retailer or theft of stock in transit for a business that delivers.
Ask the broker or insurer directly what is excluded, rather than only what is covered. A policy summary tends to lead with what it covers; the exclusions are usually in a schedule further down and are what actually determine whether a specific incident is paid out.
What actually determines the premium
Insurers price these covers against the specific risk profile of the business: industry, claims history, security measures in place, and the sums insured chosen. Getting quotes from more than one provider and being precise about what the business actually does, rather than a generic description, tends to produce a materially different premium for the same underlying risk.
Frequently asked questions
What is the difference between public liability and professional indemnity cover?
Public liability covers third-party injury or property damage claims. Professional indemnity covers a claim that advice or professional services caused a client a financial loss. A business that both operates premises and gives advice may need both.
Does personal vehicle insurance cover business use?
Usually not. Personal motor policies are typically written to exclude business use, so a vehicle used for deliveries, client visits or any commercial purpose needs a commercial policy, confirmed explicitly with the insurer.
Is cyber insurance necessary for a small business?
Any business holding customer data or taking online payments carries this risk, and POPIA’s breach notification obligations apply regardless of business size. Cyber cover has become standard rather than optional for that reason.
What is business interruption cover, and is it different from property cover?
Property cover pays to repair or replace damaged assets. Business interruption cover pays for lost income while the business cannot trade because of that damage. They are separate covers and both matter.
How can a small business keep insurance costs down?
Get quotes from more than one provider, describe the business precisely rather than generically, and review sums insured annually so cover reflects current replacement values rather than what was accurate several years ago.
Further reading
Originally published in January 2017. Updated September 2026 to add cyber and business interruption cover, both now standard considerations that the original did not cover, and to reflect current POPIA breach notification obligations.
