A Coimbatore startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

As an employee of a Coimbatore startup that leaked customer data on an open server, you may not be personally liable unless it can be proven that your actions directly contributed to the breach. However, the company itself holds significant liability under Indian law, particularly the Information Technology Act, 2000 (IT Act) and the provisions of the Personal Data Protection Bill, 2019 (PDP Bill) which is expected to come into force soon.

Here are the key points regarding potential liability and actions the company should take:

• Understanding Liability:
  • The IT Act, under Section 43, defines penalties for damage to computer systems and data. If you were not responsible for the breach, liability may rest with the company and the individuals who failed to maintain cybersecurity protocols.
  • The company can be held liable for negligence if it failed to implement adequate security measures to protect customer data as mandated by the IT Act.
  • The PDP Bill emphasizes the need for accountability in data protection, and if enacted, it will impose strict penalties for data breaches, including fines and possible imprisonment for responsible individuals.
• Immediate Actions for the Company:
  • Contain the Breach: Immediately secure the server to prevent further unauthorized access and assess the extent of the data leak.
  • Notify Affected Parties: Inform customers whose data may have been compromised, as per the guidelines under the PDP Bill and the IT Act.
  • Report to Authorities: Depending on the severity of the breach, the company may need to report the incident to the Computer Emergency Response Team (CERT-in) and other regulatory authorities.
  • Conduct a Forensic Audit: Engage cybersecurity experts to investigate the breach, identify vulnerabilities, and implement necessary fixes.
  • Implement Data Protection Policies: Establish and enforce comprehensive data protection and cybersecurity policies to prevent future breaches.
• Legal Consultation: It is advisable for the company to seek legal counsel to navigate the complexities of liability, compliance with the IT Act and the forthcoming PDP Bill, and potential litigation risks.

In conclusion, while your personal liability may be limited, the company must take prompt action to mitigate the breach's impact and ensure compliance with applicable laws.