A Ajmer startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If a startup in Ajmer leaked customer data on an open server, both the company and its employees, including you, may face liabilities under various Indian laws, primarily the Information Technology Act, 2000, and the Personal Data Protection Bill, which is poised to become law.

As an employee, your liability depends on your role in the incident. If you were directly responsible for the data handling or security measures, you may face some level of liability. However, if you were not involved in the decision-making or implementation of data security policies, the company may bear the primary responsibility.

Here are the key points regarding liability and actions the company should take:

• Legal Framework:
  • The Information Technology Act, 2000 governs cyber laws in India and includes provisions for data protection under Section 43 (penalty for damage to computer, computer system, etc.) and Section 66E (violation of privacy).
  • The upcoming Personal Data Protection Bill (PDP Bill) will introduce stringent guidelines for data processing, consent, and breach notification.
• Company's Responsibilities:
  • Conduct an immediate internal investigation to assess the breach, including determining how the data was leaked.
  • Notify affected customers as soon as possible, as required under the PDP Bill, to maintain transparency and trust.
  • Report the breach to the relevant authorities, such as the Computer Emergency Response Team (CERT-In), if it meets the threshold for a significant breach.
  • Review and enhance data security measures to prevent future incidents, including implementing encryption and access controls.
  • Consult legal counsel to understand potential liabilities and prepare for any legal claims.
• Employee Considerations:
  • Document your role and actions taken concerning data handling to clarify your position in any potential inquiries.
  • Stay informed about your rights and responsibilities under employment contracts and company policies regarding data handling.

Ultimately, while the company may bear most of the liability, individual circumstances can affect your exposure. It’s advisable to seek legal counsel for personal guidance on the situation.