Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Enterprise Resource Management

Kaveri Textiles Ltd. adopts an ERP, and its CS notes that employees' personal data and payroll now sit in one central database. Under the Information Technology Act, 2000, which obligation is most directly relevant to the company as a body corporate handling sensitive personal data in this system?

The company must implement and maintain reasonable security practices for sensitive personal data held in its ERP. If it is negligent and this causes wrongful loss to a person, the IT Act can make it liable to pay compensation. Internal use of the data does not exempt it.

  1. AImplement and maintain reasonable security practices, failing which it may be liable to compensate the person who suffers wrongful lossCorrect
  2. BNo obligation arises because the data is used only internally
  3. CObligation only to inform the police when any employee logs in after office hours
  4. DObligation to store all data outside India

Explanation

The IT Act makes a body corporate that possesses, deals with or handles sensitive personal data in a computer resource it owns or controls liable to pay compensation if negligent in maintaining reasonable security practices, causing wrongful loss or gain. Internal use does not remove this duty, and there is no blanket data-localisation or police-reporting rule of the kind in the other options.

Did you get it right without looking?

One question tells you little. A timed set on Enterprise Resource Management shows your real accuracy, how long you take and where you lose marks.

Practise Enterprise Resource ManagementFree diagnostic mock

More Enterprise Resource Management questions