Data Breach Insurance Act

To amend the Internal Revenue Code of 1986 to provide a tax credit for purchase of data breach insurance. 1. Short title This Act may be cited as the Data Breach Insurance Act 2. Credits for purchase of data breach insurance (a) In general Subpart D of part IV of subchapter A of chapter 1 45S. Data breach insurance (a) In general For purposes of section 38, the data breach insurance credit determined under this section for the taxable year is an amount equal to 15 percent of the aggregate premiums paid or incurred by the taxpayer during such taxable year for qualified data breach insurance. (b) Qualified data breach insurance (1) In general For purposes of this section, the term qualified data breach insurance (2) Cybersecurity framework requirement Such term shall not include coverage for any period unless the taxpayer has adopted, and is in compliance with, one of the following with respect to such period: (A) Version 1.0 of the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology as in effect on February 12, 2014, or subsequent versions or iterations. (B) Any similar standard specified by the Secretary (after consultation with the Secretary of Homeland Security and the Secretary of Commerce) for purposes of this paragraph. (3) Insurance company The term insurance company (4) Treatment of insurance covering more than data In the case of coverage under which amounts are payable for other than expenses or losses described in paragraph (1)— (A) no amount shall be treated as premiums for qualified data breach insurance unless the charge for such insurance is either separately stated in the contract, or furnished to the policyholder by the insurance company in a separate statement, (B) the amount taken into account as the premium paid or incurred for such insurance shall not exceed such charge, and (C) no amount shall be treated as paid or incurred for such insurance if the amount specified in the contract (or furnished to the policyholder by the insurance company in a separate statement) as the charge for such insurance is unreasonably large in relation to the total charges under the contract. (c) Premiums must be trade or business expense Premiums shall be taken into account under subsection (a) only if such premiums are paid or incurred in the ordinary course of the taxpayer’s trade or business. (d) Termination No credit shall be determined under this section for any taxable year beginning after the date which is 5 years after the date of the enactment of this section. . (b) Conforming amendments (1) Section 38(b) of such Code is amended by striking plus , plus (37) the data breach insurance credit determined under section 45S. . (2) The table of sections for subpart D of part IV of subchapter A of chapter 1 of such Code is amended by adding at the end the following new item: Sec. 45S. Data breach insurance. . (c) Effective date The amendments made by this section shall apply to taxable years beginning after the date of the enactment of this Act.

Summary: Data Breach Insurance Act This bill amends the Internal Revenue Code to allow a business tax credit for the purchase of qualified data breach insurance. The credit applies for five years and is equal to 15% of the annual premiums paid or incurred for the insurance in the ordinary course of the taxpayer's trade or business. Qualified data breach insurance is coverage provided by an insurance company for expenses or losses in connection with the theft, loss, disclosure, inaccessibility, or manipulation of data. Insurance does not qualify for the credit unless the taxpayer has adopted and is in compliance with: (1) the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology, or (2) any similar standard specified by the Internal Revenue Service.