Skip to content

CS Professional · Environmental, Social and Governance (ESG) - Principles and Practice · Data Governance

Veda Textiles Ltd, a Surat-based company, stores customers' financial information on its own servers. A breach occurs because the company never put in place reasonable security practices, and a customer suffers wrongful loss. Under the Information Technology Act, 2000, what is the company's exposure?

The company is liable to pay damages by way of compensation to the affected customer. Section 43A of the IT Act, 2000 imposes this where a body corporate negligently fails to maintain reasonable security practices for sensitive personal data and causes wrongful loss or gain to a person.

  1. AIt is liable to pay damages by way of compensation to the affected personCorrect
  2. BIt is liable only to imprisonment of its directors for one year
  3. CIt faces no liability unless the Central Government first notifies an agency to monitor traffic data
  4. DIt is liable only if the customer had signed a secure electronic signature

Explanation

Section 43A makes a body corporate that handles sensitive personal data or information in a computer resource it owns, controls or operates liable to pay compensation if it is negligent in maintaining reasonable security practices and thereby causes wrongful loss or gain. Imprisonment is not the remedy under this section, and the traffic-data and signature provisions are unrelated.

Did you get it right without looking?

One question tells you little. A timed set on Data Governance shows your real accuracy, how long you take and where you lose marks.

Practise Data GovernanceFree diagnostic mock

More Data Governance questions