A Surat startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

As an employee of the Surat startup, you may have some liability depending on your role and actions, but the primary responsibility lies with the company itself for the data leak. The company should take immediate steps to mitigate the situation and comply with Indian laws governing data protection and cybersecurity.

Under the Information Technology Act, 2000, specifically Section 43A, companies are required to implement reasonable security practices to protect sensitive personal data. If they fail to do so, they can be held liable for compensation to affected individuals. Additionally, under the Personal Data Protection Bill (PDPB), which is expected to be enacted soon, more stringent obligations will be imposed on organizations regarding data handling and breach notification.

Here are the key points for your consideration:

• Employee Liability:
  • If you had a role in the negligence leading to the data leak, you could potentially face some liability, particularly if you violated company policies or acted in a manner that was reckless.
  • However, under normal circumstances, liability primarily resides with the employer, especially in cases of organizational negligence.
• Company's Immediate Actions:
  • Conduct an internal investigation to determine the cause of the data leak and identify affected data.
  • Notify affected customers about the breach in a timely manner as per the requirements of Section 70B of the IT Act.
  • Implement remedial measures to secure the data and prevent future breaches, such as improving cybersecurity protocols.
  • Consult with a legal expert specializing in cybersecurity laws to understand the potential liabilities and compliance obligations.
• Legal Compliance:
  • Review compliance with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
  • Prepare for potential legal actions from affected customers or regulatory authorities.
  • Consider reporting the breach to the Indian Computer Emergency Response Team (CERT-IN) if necessary.

Ultimately, while individual liability can arise, the company must prioritize addressing the breach and ensuring that it complies with relevant legal frameworks to safeguard customer data in the future.