A Thiruvananthapuram startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?

Detailed Legal Analysis

You may be held liable for the leak of customer data from the Thiruvananthapuram startup, depending on your role and involvement, while the company has specific obligations under Indian law to mitigate the situation and prevent further breaches.

Under the Information Technology Act, 2000, particularly Section 43 and Section 66, individuals and companies can face penalties for unauthorized access and data breaches. Here's how liability can be assessed:

• Role and Responsibility: If you had direct access to customer data or were responsible for its protection, you could be held liable under Section 43 for negligence or a breach of duty.
• Employee Status: If you acted within your capacity as an employee, the company may bear primary responsibility, but you can still be implicated if your actions were grossly negligent or willful.

For the startup, it is crucial to take immediate action to address the data leak. Here are steps the company should consider:

• Assess the Breach: Conduct a thorough investigation to determine the extent of the data leak, including what data was compromised and how it occurred.
• Notify Affected Parties: Under the General Data Protection Regulation (GDPR)-inspired provisions in the IT Act, notify customers whose data may have been compromised.
• Report to Authorities: If sensitive personal data is involved, the company must report the breach to the relevant authorities as per the guidelines laid out in the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• Implement Security Measures: Strengthen data protection measures and security protocols to prevent future breaches, including employee training and better access controls.
• Legal Consultation: Seek legal advice to understand potential liabilities and compliance requirements under the IT Act and the Indian Penal Code (IPC), particularly Section 66E, which addresses violation of privacy.

In conclusion, while you could face liability depending on your role, the startup must act promptly and responsibly to address the data breach and comply with legal requirements to mitigate risks and protect customer data.