Published Paper Details:

In an era dominated by digitalization, corporate liability in data breach cases has become a pressing concern in India's legal and regulatory landscape. Indian corporations are increasingly custodians of vast quantities of sensitive personal data, making them attractive targets for cyberattacks. However, the existing legal framework, comprising primarily the Information Technology Act, 2000 and related rules, has not evolved in tandem with the complexity and scale of contemporary data breaches. This has led to significant ambiguity in assigning corporate accountability. While Section 43A of the IT Act imposes civil liability for failure to protect sensitive personal data, its enforcement remains weak, and it lacks specific criminal provisions for gross negligence or willful data misuse. Furthermore, the absence of a dedicated data protection statute has contributed to inconsistent jurisprudence and inadequate remedies for victims.