A Vellore startup I worked for leaked customer data on an open server. Am I liable, and what should the company do?
SA Asked by Sanjay Mishra from India
Quick Answer
The primary liability is on the company under Section 43A IT Act, 2000 (read with SPDI Rules, 2011) for failing to implement reasonable security practices, and under the DPDP Act, 2023 once notified.
Detailed Legal Analysis
The primary liability is on the company under Section 43A IT Act, 2000 (read with SPDI Rules, 2011) for failing to implement reasonable security practices, and under the DPDP Act, 2023 once notified. File a complaint with the cyber crime police station in Vellore if the leak was due to negligence amounting to unauthorised access under Section 66 IT Act.
Report the breach to CERT-In within six hours under the CERT-In Directions, 2022. Notify affected individuals and the Data Protection Board once the DPDP Act is operational.
Preserve server logs and access records as electronic evidence under Section 63B BSA, 2023. If the company fails to act, approach Madras High Court under Article 226 for a direction.
Refer to Tamil Nadu Rent Control Act 1960 for any state data protection or IT rules supplementing the central framework.
Disclaimer: AI-generated for educational purposes only. Does not constitute legal advice. Consult a qualified practitioner.