A Chandigarh startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If a Chandigarh startup leaked customer data on an open server, both the company and individuals who had access to that data may face legal liabilities under Indian law, particularly under the Information Technology Act, 2000 and the Personal Data Protection Bill (when enacted).

As an employee, your liability depends on your role in the incident. If you were involved in the decision-making process or had a direct role in the data management, you could be liable. However, if you were merely an employee without any influence over data management practices, the primary liability would typically rest with the company.

Here are key points regarding the potential liabilities and actions the company should take:

• Legal Framework: The primary laws governing data protection in India are:
• Information Technology Act, 2000, including Section 43A (compensation for failure to protect data).
• Personal Data Protection Bill, which emphasizes the protection of personal data and outlines strict penalties for data breaches (pending enactment).
• Company's Responsibilities:
• Conduct an immediate internal investigation to ascertain the cause of the data leak.
• Notify affected customers about the breach as per the guidelines set forth in the IT Act and the upcoming Personal Data Protection Bill.
• Implement security measures to prevent future breaches, including encryption and access controls.
• Document all findings and actions taken during the investigation for compliance and potential legal defense.
• Consider consulting with legal experts to understand liabilities and potential penalties.
• Employee's Position:
• If you were unaware of the data management practices, maintain documentation of your role and responsibilities.
• Seek legal advice if contacted by authorities or if you feel that you may be implicated in the breach.
• Report any knowledge of the incident to your employer to ensure transparency.

In summary, while the company bears the primary legal responsibility for the data leak, individual employees can also face consequences depending on their level of involvement. It is essential for both the company and employees to take appropriate steps to mitigate risks and comply with legal obligations.