A Erode startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

In the case of customer data leakage in Erode, both the individual and the startup may face legal liabilities under various Indian laws, including the Information Technology Act, 2000, and the Personal Data Protection Bill (if enacted).

As an employee, your liability will largely depend on your role in the incident and whether there was negligence or willful misconduct involved. Here are the key points to consider:

• Role and Responsibility: If your actions directly contributed to the data leak, you may be held liable under Section 66 of the Information Technology Act, which addresses hacking and data breaches.
• Negligence: If the data exposure resulted from negligent handling of data, you could be implicated. Section 43A of the IT Act lays down compensatory liability towards affected parties if a body corporate fails to implement reasonable security practices.
• Whistleblower Protections: If you reported the breach and were ignored, whistleblower protections under the Companies Act, 2013 may apply, potentially shielding you from liability.

For the company, immediate action is critical to mitigate damages and comply with legal obligations:

• Assess the Breach: Investigate the nature and scope of the data leak. Identify what data was compromised and the number of affected customers.
• Notify Affected Parties: Under the IT Act, the company should inform affected individuals about the breach and the potential risks associated with it.
• Report to Authorities: Depending on the circumstances, the company may need to report the incident to the Indian Computer Emergency Response Team (CERT-In) as mandated by the IT Act.
• Implement Security Measures: Strengthen cybersecurity practices and data protection measures to prevent future incidents. Compliance with the forthcoming Personal Data Protection Bill is essential once enacted.
• Legal Consultation: Seek legal advice to navigate potential liabilities, regulatory compliance, and responses to affected customers.

In summary, both you and the startup may face liabilities due to the data leak, but the specifics will depend on your involvement and the company's response to the incident.