Data Breach Insurance Act

“45S. Data breach insurance

“(a) In general—For purposes of section 38, the data breach insurance credit determined under this section for the taxable year is an amount equal to 15 percent of the aggregate premiums paid or incurred by the taxpayer during such taxable year for qualified data breach insurance.

“(b) Qualified data breach insurance

“(1) In general—For purposes of this section, the term “qualified data breach insurance” means coverage provided by an insurance company for expenses or losses in connection with the theft, loss, disclosure, inaccessibility, or manipulation, of data.

“(2) Cybersecurity framework requirement—Such term shall not include coverage for any period unless the taxpayer has adopted, and is in compliance with, one of the following with respect to such period:

“(A) Version 1.0 of the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology as in effect on February 12, 2014, or subsequent versions or iterations.

“(B) Any similar standard specified by the Secretary (after consultation with the Secretary of Homeland Security and the Secretary of Commerce) for purposes of this paragraph.

“(3) Insurance company—The term “insurance company” means any corporation subject to tax under subchapter L (or which would be so subject if such corporation were a domestic corporation).

“(4) Treatment of insurance covering more than data—In the case of coverage under which amounts are payable for other than expenses or losses described in paragraph (1)—

“(A) no amount shall be treated as premiums for qualified data breach insurance unless the charge for such insurance is either separately stated in the contract, or furnished to the policyholder by the insurance company in a separate statement,

“(B) the amount taken into account as the premium paid or incurred for such insurance shall not exceed such charge, and

“(C) no amount shall be treated as paid or incurred for such insurance if the amount specified in the contract (or furnished to the policyholder by the insurance company in a separate statement) as the charge for such insurance is unreasonably large in relation to the total charges under the contract.

“(c) Premiums must be trade or business expense—Premiums shall be taken into account under subsection (a) only if such premiums are paid or incurred in the ordinary course of the taxpayer’s trade or business.

“(d) Termination—No credit shall be determined under this section for any taxable year beginning after the date which is 5 years after the date of the enactment of this section.”