A Hyderabad startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If customer data was leaked from a Hyderabad startup's open server, both the startup and potentially its employees, including you, may face liability depending on the circumstances surrounding the leak.

Under Indian law, particularly the Information Technology Act, 2000, and the rules framed thereunder, organizations have a responsibility to protect the personal data of their users. Key points regarding liability and actions that should be taken include:

• Liability of the Startup:
  • The startup may be held liable under Section 43A of the IT Act for failure to implement reasonable security practices, resulting in the data breach.
  • If the company is deemed negligent, it could be penalized, and affected customers may file complaints with the Cyber Crime Cell or approach the Consumer Forum.
• Your Liability as an Employee:
  • If the leak occurred due to your negligence or failure to follow company protocols, you might face disciplinary action from the company.
  • However, under Section 79 of the IT Act, intermediaries (including startups) may not be held liable for third-party data if they act as a neutral intermediary and comply with due diligence.
• Immediate Actions for the Company:
  • Conduct an internal audit to assess the extent of the data leak.
  • Notify affected customers about the breach as per the provisions of the IT Act and the Personal Data Protection Bill (if applicable).
  • Engage with cybersecurity professionals to secure the server and prevent further leaks.
  • Document every step taken to rectify the situation, as this will be crucial for legal compliance and potential defense against liability claims.
• Potential Legal Consequences:
  • Victims of the data breach may file a complaint under Section 66E of the IT Act for violation of privacy.
  • The startup could face civil suits for damages as well as criminal charges if malicious intent is proven.

In conclusion, while the startup primarily bears responsibility for the data leak, individual liability can arise depending on employee actions and compliance with data protection measures. It is advisable for both the startup and affected employees to seek legal counsel to navigate the complexities of this situation.