Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Enterprise Resource Management

Sundaram Textiles runs an ERP whose HR module stores employee Aadhaar numbers, bank accounts and salary data. Under the Information Technology Act, 2000 as taught in this paper, which course of action best reflects the legal duty on the company regarding such data?

The company must maintain reasonable security practices and procedures for sensitive personal data held in its HR module. If negligence causes wrongful loss or gain, the Act makes it liable to pay compensation to the affected person.

  1. AStore the data without safeguards since employee data is not covered by the Act
  2. BImplement and maintain reasonable security practices and procedures to protect sensitive personal data, failing which it may be liable to pay compensation for wrongful lossCorrect
  3. CPublish the data on the intranet so that all employees can verify it
  4. DDelete the data after every payroll run regardless of statutory record requirements

Explanation

The IT Act makes a body corporate that possesses, deals with or handles sensitive personal data in a computer resource it owns or operates liable to compensate affected persons if it is negligent in maintaining reasonable security practices. Employee data is not excluded. Publishing it or deleting it blindly would breach security or record-keeping duties.

Did you get it right without looking?

One question tells you little. A timed set on Enterprise Resource Management shows your real accuracy, how long you take and where you lose marks.

Practise Enterprise Resource ManagementFree diagnostic mock

More Enterprise Resource Management questions