Skip to content

CS Professional · Environmental, Social and Governance (ESG) - Principles and Practice · Data Governance

Sahyadri Textiles Ltd stores employees' sensitive personal data on its own servers. It never updated its security controls, and a hacker exploited this, causing wrongful loss to several employees. Under the Information Technology Act, 2000, what is the company's exposure?

The company is liable to pay damages by way of compensation to the affected employees under Section 43A. The section applies when a body corporate handling sensitive personal data negligently fails to maintain reasonable security practices and causes wrongful loss; intent is not required.

  1. ALiable to pay damages by way of compensation to the affected persons under Section 43ACorrect
  2. BImmune from liability because the breach was caused by a third-party hacker
  3. CLiable only if the company intended to cause wrongful loss
  4. DLiable only to imprisonment under Section 66F

Explanation

Section 43A applies where a body corporate handling sensitive personal data in a computer resource it owns, controls or operates is negligent in implementing reasonable security practices and thereby causes wrongful loss or gain. Negligence, not intent, triggers liability to pay compensation. Section 66F concerns cyber terrorism and does not fit these facts.

Did you get it right without looking?

One question tells you little. A timed set on Data Governance shows your real accuracy, how long you take and where you lose marks.

Practise Data GovernanceFree diagnostic mock

More Data Governance questions