A Aurangabad startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If customer data was leaked on an open server by a startup in Aurangabad, both the company and potentially individuals involved may be held liable under Indian law, particularly under the Information Technology Act, 2000 and the Indian Penal Code, 1860.

As an employee, your liability may depend on various factors including your role in the data breach and whether there was negligence on your part. The primary legal framework governing data protection in India is the IT Act, 2000, which has specific provisions regarding the protection of sensitive personal data:

• Section 43A of the IT Act, 2000: This section mandates that a body corporate that possesses, deals with, or handles any sensitive personal data or information is liable to pay damages to the affected persons in case of a negligence breach of a duty of care.
• Section 66E: This section deals with violation of privacy and imposes penalties for unauthorized capturing, publishing, or transmitting the image of a private area of a person without their consent.
• Section 72: This section pertains to breach of confidentiality and privacy, making it punishable if a person discloses information received in a fiduciary relationship without consent.

To determine your liability, consider the following:

• Were you involved in the decision or action that led to the data breach?
• Did you follow company protocols for data handling and protection?
• Was there a failure in the company’s overall data protection strategy that contributed to the breach?

For the company, immediate steps should be taken to mitigate legal consequences and protect customer information:

• Notify Affected Customers: Inform customers about the breach and the potential risks associated with it.
• Report the Incident: Under the IT Act, report the breach to the relevant authorities such as the Computer Emergency Response Team (CERT-IN).
• Conduct an Investigation: Perform a thorough investigation to determine the cause of the leak and assess the scope of the data compromised.
• Implement Remedial Measures: Strengthen data security protocols to prevent future breaches, including employee training and updated security technologies.
• Consult Legal Counsel: Seek advice from legal experts specializing in cyber law to understand liabilities and compliance with the law.

Failure to act appropriately can result in significant legal and financial repercussions under the applicable laws.