A Jalandhar startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

As an employee of the Jalandhar startup, your liability in the case of a data leak largely depends on your role in the company and the specific circumstances surrounding the incident.

Under the Information Technology Act, 2000, particularly Section 43 and Section 66, there are provisions that address unauthorized access and damage to computer systems. If you were directly responsible for the breach, you may bear some liability. However, if your role was not directly involved in the handling of the data or the security measures, the company could be held primarily accountable.

• Consider your role: If you were involved in data management or IT security, you might have some liability. If you were unaware of the security protocols, your liability may be limited.
• Company's Responsibility: The startup has a legal obligation under Section 43A of the IT Act to implement reasonable security practices. A failure to do so can lead to penalties and damages if customer data is leaked.

The company should take the following steps in response to the data leak:

• Immediate Assessment: Conduct a thorough investigation to determine the nature and extent of the data leak.
• Notify Affected Customers: Under the General Data Protection Regulation (GDPR) principles, even though GDPR is not directly applicable in India, it is advisable to inform affected customers about the breach, as it builds trust and transparency.
• Report to Authorities: Under Section 70B of the IT Act, the startup may need to report the breach to the Indian Computer Emergency Response Team (CERT-In).
• Implement Security Measures: Review and strengthen cybersecurity measures to prevent future incidents, including employee training and updated software.
• Legal Consultation: Consult with a legal expert specializing in cyber law to understand potential liabilities and to manage any legal repercussions effectively.

In summary, while you may have some liability depending on your involvement, the primary responsibility lies with the company to ensure proper data protection measures are implemented and to take corrective actions following the breach.