A Nagpur startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

If a Nagpur startup leaked customer data on an open server, both the company and potentially you, as an employee, might face liabilities depending on the circumstances surrounding the data breach.

Under Indian law, particularly the Information Technology Act, 2000, and the rules framed thereunder, several important points must be considered:

• Company Liability: The startup, as the data controller, is primarily responsible for protecting customer data. Under Section 43A of the IT Act, if the company fails to implement reasonable security practices, it may be liable to compensate affected individuals for any damage caused by the breach.
• Employee Liability: Your liability as an employee depends on your role and actions. If negligence or misconduct can be proven on your part (e.g., failing to follow data security protocols), you might face disciplinary actions or legal consequences under the Indian Penal Code (IPC) sections pertaining to criminal breach of trust (Section 405) or mischief (Section 425).
• Data Protection Framework: The startup must comply with applicable data protection laws and regulations. Following the proposed Personal Data Protection Bill (PDPB), organizations will have a legal obligation to protect personal data and ensure its privacy. Non-compliance could lead to substantial penalties.
• Notification Requirements: Under the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the company is required to notify affected customers and the relevant authorities if sensitive personal data is compromised.
• Internal Investigation: The company should conduct an internal investigation to determine how the data was leaked, identify vulnerabilities, and take corrective measures to prevent future breaches.
• Legal Consultation: It is advisable for the company to consult with legal counsel specializing in cyber law to navigate potential liabilities and compliance obligations effectively.

In summary, while the company bears the primary responsibility for the data breach, your liability will depend on your involvement and adherence to data protection protocols. Both you and the company should take immediate steps to address the breach and mitigate any potential damage.