What type of clients does the Applicant primarily target (People / Organizations)?
Consumers bring privacy class actions. Organizations bring contract claims. The two produce different losses from the same incident.
What the carrier is actually asking
The carrier is asking whether your customers are primarily individuals or organisations. It shapes the liability profile and the likely form a claim takes.
Why it is underwritten
Consumer data means large numbers of individuals, notification at scale, and exposure to class action and statutory damages. Business customers mean fewer, larger relationships governed by contracts with liability terms, where claims are commercial rather than statutory. Both are insurable and they behave differently.
Where the answer lives in Microsoft 365, Entra ID, and Azure
This is a description of your customer base, supported by data and contract records.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Customer records | Split between individual and organisational customers | Counts and revenue by customer type. Attested |
| Data | Volume of individual personal data held | Consistent with the record count answer |
| Contracts | Whether business customers contract on their paper or yours | Which liability terms govern, since that determines your exposure per relationship |
| Jurisdictions | Where individual customers reside | Which privacy regimes apply, which follows the individuals rather than your location |
| Mixed | Where you serve both | Both disclosed, since each carries a distinct exposure |
A business-to-business platform typically holds personal data about its clients employees and often about their customers. The consumer exposure exists even where no consumer is your customer, and it belongs in the record count.
What a defensible yes requires
- The customer mix is stated with proportions.
- Individual personal data volumes are consistent with the record count answer.
- The jurisdictions of individuals are known.
- Contract liability terms with business customers are understood.
- Where both types are served, both are described.
How this answer goes wrong
A business-to-business company answers organisations and reports a low record count, while its platform holds personal data on hundreds of thousands of its clients end users. The notification exposure is consumer-scale regardless of who signs the contract.
Frequently asked
Which is riskier?
Differently risky. Consumer exposure is notification and class action; business exposure is contractual and reputational. Neither is uniformly worse.
What if we serve both?
Say so with proportions. Mixed models are common and carriers price the components.
Does this affect the limit?
Through the record count more than directly. Consumer-facing businesses usually need higher limits for the notification exposure.
Do our clients end users count?
For exposure purposes yes. You hold their data, and an incident reaches them regardless of the contractual chain.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture