A Pune startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

As an employee of the Pune startup, your liability for the leaked customer data largely depends on your role in the incident and the measures taken by the company to protect such data.

Under Indian law, particularly the Information Technology Act, 2000 (IT Act) and the rules framed under it, organizations are required to implement reasonable security practices to protect sensitive personal data. If the company failed to comply with these regulations, it may bear the primary liability for the data leak.

Here are the key points regarding your potential liability and the company's responsibilities:

• Employee Liability:
  • If you were directly responsible for the data breach, such as through negligence or intentional misconduct, you could be held liable under Section 66 of the IT Act, which penalizes hacking and unauthorized access.
  • However, if you were merely an employee without control over security protocols, your liability may be limited.
• Company’s Responsibilities:
  • The company must adhere to the guidelines set forth in the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
  • They should conduct an internal investigation to determine the cause of the breach and whether it resulted from inadequate security measures.
  • Notify affected customers about the breach promptly, as required under Section 43A of the IT Act, which mandates compensation for failure to protect sensitive personal data.
• Regulatory Compliance:
  • Report the breach to the appropriate authorities, such as the Indian Computer Emergency Response Team (CERT-IN), if necessary.
  • Review and update data protection policies and employee training to prevent future incidents.
• Legal Consequences:
  • Depending on the severity of the leak, the company may face civil liability, fines, and reputational damage.
  • Criminal liability may also arise if the breach involved malicious intent or negligence.

In conclusion, while you may have some liability depending on your involvement, the primary responsibility for the data breach lies with the company, which must take immediate corrective actions to address the breach and prevent future occurrences.