A Jodhpur startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

You may be liable for the breach depending on your role and actions in the startup, while the company has specific obligations under Indian law to address the leak and mitigate damages.

Under the Information Technology Act, 2000 and the rules framed thereunder, the company is responsible for ensuring the security of data. If customer data is leaked, both the company and potentially individuals involved may face legal repercussions.

Here are the key points regarding liability and necessary actions:

• Liability of Employees:
  • If you were directly involved in handling the customer data and failed to follow security protocols, you may be held liable under Section 43 of the IT Act for damage caused to the computer system.
  • Section 66E of the IT Act deals with violation of privacy, which could also ensue if the breach involved personal data.
• Company's Responsibilities:
  • The company must immediately assess the breach to ascertain the extent of the data leak.
  • Under the IT Act and the Personal Data Protection Bill (PDPB) 2019 (once enacted), companies are required to implement reasonable security practices and procedures to safeguard personal data.
  • Notification of affected customers should be done promptly, as per the due diligence expected under the law.
  • The company should report the incident to the data protection authority (once established under the PDPB) and possibly to law enforcement if necessary.
• Mitigating Actions:
  • Conduct a forensic investigation to understand how the breach occurred.
  • Implement stronger data protection measures, such as encryption and access controls, to prevent future incidents.
  • Provide training to employees on data protection and cybersecurity best practices.
  • Consider legal counsel to navigate any potential lawsuits or regulatory penalties.

In conclusion, both you and the company have legal obligations under Indian cyber laws in the event of a data breach. It is essential to act swiftly and responsibly to mitigate any damage and comply with legal requirements.