A Secunderabad startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

You may have some liability depending on your role in the company and the circumstances surrounding the data leak, while the company has specific obligations to address the situation under Indian cyber laws.

Under the Information Technology Act, 2000, and the rules framed thereunder, organizations must take reasonable security practices to protect sensitive personal data. If a data leak occurs due to negligence or failure to implement adequate security measures, several parties can be held accountable.

Here are the key points regarding your potential liability and the company's responsibilities:

• Your Liability:
  • If you were directly responsible for managing the data or the server, you may face some level of liability under Section 43A of the IT Act, which deals with compensation for failure to protect sensitive personal data.
  • However, if you were not involved in the decision-making or implementation of security protocols, your liability may be minimal.
• Company's Responsibilities:
  • The company must report the data leak to the relevant authorities, such as the Cyber Crime Cell, under Section 70B of the IT Act, which emphasizes the importance of reporting breaches.
  • They should notify affected customers as per the guidelines in the Personal Data Protection Bill (currently under consideration), emphasizing transparency and accountability.
  • The company should conduct an internal investigation to determine the cause of the leak and implement corrective measures to prevent future incidents.
  • It may also consider consulting with legal experts to assess potential liabilities and the best course of action.
• Documentation and Compliance:
  • Maintain thorough documentation of the incident, including how it occurred, the data affected, and the steps taken in response.
  • Review and enhance data protection policies and procedures in compliance with the forthcoming Personal Data Protection Act to ensure better protection of customer data in the future.

In conclusion, while your liability may vary based on your role, the company has a clear obligation to address the data leak responsibly and ensure compliance with applicable laws to mitigate risks and protect customer interests.