[JumpCrisscross]

> If it doesn't need to be insured, you could just spin off a smaller entity responsible for holding the data for you, and shut the company down if the data leaks

If this is possible without insurance then it’s possible with, and every insurance company will mandate the structure to limit payouts. Mandating insurance simple entrenches the insurers. Why, for instance, would you want to require Apple purchase insurance against its users’ data?

Side note: beneficial ownership [1] and affiliate definitions [2] are useful for such cases.

[1] https://www.investopedia.com/terms/b/beneficialowner.asp

[2] http://rule144opinion.blogspot.com/2014/02/rule-144-are-you-...

[dragonwriter]

> If this is possible without insurance then it’s possible with, and every insurance company will mandate the structure to limit payouts.

You can't limit insurance payouts this way, because the entity has to carry the insurance. You only limit the exposure of the larger entity after the assets of the liable entity, including any insurance coverage, are exhausted. But the more the mandatory insurance level is, the less likely spinning off to protect the parent is to ever be valuable, and it never protects the insurer, so they won't mandate it.