A Dhanbad startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If a Dhanbad startup has leaked customer data on an open server, both the company and potentially individuals involved, including you, may face liability under Indian law.

Under the Information Technology Act, 2000, and the rules framed therein, particularly the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, organizations are required to implement reasonable security practices to protect sensitive data. The key points regarding liability and actions to be taken are as follows:

• Company's Liability: The startup can be held liable for negligence if it fails to implement adequate security measures to protect customer data, as stipulated under Section 43 and Section 66 of the IT Act.
• Individual Liability: If you were responsible for handling or managing the data security and failed to adhere to established protocols, you could be personally liable under Section 66 of the IT Act for any unauthorized access or data breach.
• Data Protection Obligations: Under the IT Act, companies must notify affected individuals about a data breach, as well as report the incident to the appropriate authorities, including the Indian Computer Emergency Response Team (CERT-In).
• Potential Penalties: The penalties for data breaches can include fines up to ₹5 crores or more, as well as imprisonment for individuals responsible for the breach under various sections of the IT Act.

To address the data leak effectively, the startup should take the following steps:

• Immediate Assessment: Conduct a thorough investigation to determine the cause and extent of the data breach.
• Notify Affected Customers: Inform customers whose data has been compromised, detailing the nature of the breach and the potential risks involved.
• Report to Authorities: Report the incident to CERT-In and any applicable regulatory bodies under the IT Act.
• Implement Remedial Measures: Review and improve data security measures to prevent future breaches, including regular audits and staff training.
• Legal Consultation: Seek legal advice to understand potential liabilities and ensure compliance with data protection laws.

In conclusion, both the startup and individuals involved may face liability for the data leak, and immediate remedial action is essential to mitigate risks and comply with legal obligations.