A Solapur startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

Yes, you may be liable for the leakage of customer data if you had a role in the incident, but the primary liability lies with the company as the data controller under Indian law.

In India, the protection of customer data is governed primarily by the Information Technology Act, 2000 and the rules framed thereunder, particularly the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Here are the key points regarding liability and actions to be taken:

• Company's Liability: Under Section 43A of the IT Act, the company is liable for failure to protect sensitive personal data and is required to implement reasonable security practices. If a data breach occurs due to negligence, the company can face penalties and compensation claims.
• Your Liability: If your actions directly contributed to the data breach, you could be held liable under:
  • Section 66 of the IT Act: This section penalizes any person who dishonestly or fraudulently does any act to the detriment of any person, which could include unauthorized access or handling of data.
  • Contractual Obligations: If you signed a non-disclosure agreement (NDA) or any contract stipulating confidentiality, breaching these terms could result in legal action against you.
• Immediate Actions for the Company: The startup should take immediate steps to mitigate the breach:
  • Notify Affected Customers: Inform customers about the breach as per the IT (Reasonable Security Practices) Rules.
  • Conduct an Investigation: Assess the extent of the breach, identify vulnerabilities, and document findings.
  • Enhance Security Measures: Implement stronger cybersecurity protocols to prevent future incidents, such as encryption and access controls.
  • Legal Compliance: Consider consulting legal counsel to comply with regulations and to understand the potential liabilities.
  • Report to Authorities: If sensitive personal data is involved, the breach may need to be reported to the Indian Computer Emergency Response Team (CERT-In).
• Possible Consequences: Depending on the severity of the breach, the company and potentially you could face:
  • Fines and penalties imposed by authorities.
  • Civil lawsuits from affected customers seeking compensation.
  • Reputational damage leading to loss of business.

In conclusion, while liability can be shared based on involvement, the company must act promptly and responsibly to address the breach and mitigate any damage.