---
title: "What type of clients does the Applicant primarily target (People / Organizations)?"
url: https://insuranceposture.com/questions/services-and-contracts/type-clients-applicant-primarily-target
category: "Services and contracts"
canonical_key: q_pro_002
evidence_state: attested
updated: 2026-08-24
---

# What type of clients does the Applicant primarily target (People / Organizations)?

URL: https://insuranceposture.com/questions/services-and-contracts/type-clients-applicant-primarily-target
Section: Services and contracts
Evidence state: Attested, not tenant-verifiable

Consumers bring privacy class actions. Organizations bring contract claims. The two produce different losses from the same incident.

## What the carrier is actually asking

The carrier is asking whether your customers are primarily individuals or organisations. It shapes the liability profile and the likely form a claim takes.

## Why it is underwritten

Consumer data means large numbers of individuals, notification at scale, and exposure to class action and statutory damages. Business customers mean fewer, larger relationships governed by contracts with liability terms, where claims are commercial rather than statutory. Both are insurable and they behave differently.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

This is a description of your customer base, supported by data and contract records.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Customer records | Split between individual and organisational customers | Counts and revenue by customer type. Attested |
| Data | Volume of individual personal data held | Consistent with the record count answer |
| Contracts | Whether business customers contract on their paper or yours | Which liability terms govern, since that determines your exposure per relationship |
| Jurisdictions | Where individual customers reside | Which privacy regimes apply, which follows the individuals rather than your location |
| Mixed | Where you serve both | Both disclosed, since each carries a distinct exposure |

**Serving businesses still means holding consumer data**

A business-to-business platform typically holds personal data about its clients employees and often about their customers. The consumer exposure exists even where no consumer is your customer, and it belongs in the record count.

## What a defensible yes requires

- The customer mix is stated with proportions.
- Individual personal data volumes are consistent with the record count answer.
- The jurisdictions of individuals are known.
- Contract liability terms with business customers are understood.
- Where both types are served, both are described.

## How this answer goes wrong

A business-to-business company answers organisations and reports a low record count, while its platform holds personal data on hundreds of thousands of its clients end users. The notification exposure is consumer-scale regardless of who signs the contract.

## If this answer turns out to be wrong

Technology E&O questions describe what you promised your own clients, and the policy language decides how strictly your description of that is held. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### Which is riskier?

Differently risky. Consumer exposure is notification and class action; business exposure is contractual and reputational. Neither is uniformly worse.

### What if we serve both?

Say so with proportions. Mixed models are common and carriers price the components.

### Does this affect the limit?

Through the record count more than directly. Consumer-facing businesses usually need higher limits for the notification exposure.

### Do our clients end users count?

For exposure purposes yes. You hold their data, and an incident reaches them regardless of the contractual chain.

## Related questions

- [Does the Applicant collect, store, process, transmit PII / PHI / PCI?](https://insuranceposture.com/questions/data-handling/applicant-collect-store-process-transmit-pii-phi-pci)
- [How many records of PII / PHI / PCI / biometric does Applicant process?](https://insuranceposture.com/questions/business-profile/records-pii-phi-pci-biometric-applicant-process)
- [Do the Applicant's client contracts contain limitation of liability clauses benefiting the Applicant?](https://insuranceposture.com/questions/services-and-contracts/applicant-s-client-contracts-contain-limitation-liability-clauses-benefiting)
- [Does the Applicant provide data processing, storage, or hosting services to third parties?](https://insuranceposture.com/questions/business-profile/applicant-provide-data-processing-storage-hosting-services-third-parties)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.