Mondaq has recognised Anuradha Gandhi, Managing Associate, and Isha Sharma of S.S. Rana & Co. in its Thought Leadership Awards, Autumn 2024. Their article Corporate Data Theft: A Major Concern placed first (#1) for India in Data Protection, after placing second in Technology in Spring 2024, making it one of the firm’s most widely read articles of the year.
About the Mondaq Thought Leadership Awards
Mondaq is an online publisher of legal, regulatory and financial commentary written by law firms and advisers around the world, and its awards site is co-branded with The Legal 500. Its Thought Leadership Awards recognise the authors whose articles readers turn to most.
Who qualifies: The awards draw on articles published on Mondaq by contributing firms and their authors, with separate results for each country and for a range of topics, including Data Protection.
How winners are chosen: Mondaq decides the awards on total readership during the award period.
The format: For each country and topic, Mondaq names the top three placings. A first place means the article drew more readers than any other Indian article in that topic.
What the award recognises
The article, published on 18 October 2023, examines one of the most common data risks businesses face: insiders who take data with them.
An everyday problem: It starts from a case in which a former employee of a technology institute allegedly took client information, training materials and invoices and used them to set up a competing business at lower prices.
Remedies under the IT Act: It explains compensation for copying data without permission under Section 43 of the Information Technology Act, 2000, and the offences of breach of confidentiality and privacy and disclosure in breach of a lawful contract under Sections 72 and 72A.
The general criminal law: It notes the Supreme Court’s view that the IT Act does not exclude the general criminal law in cases of hacking and data theft, so offences such as criminal breach of trust can also apply.
IP and corporate liability: It points out that using a former employer’s training materials and client names can infringe IP rights as well as breach the employment contract, and that companies can themselves be liable under Section 43A if their security practices are inadequate.
What the DPDP Act will ask of businesses
The article closes with the Digital Personal Data Protection Act, 2023, which will place data security squarely on businesses once it is brought into force.
Core duties: Data fiduciaries must give notice and obtain valid consent, or rely on a permitted legitimate use; use personal data only for the stated purpose; keep it accurate; and erase it once the purpose is served.
Security safeguards: They must take reasonable security safeguards to prevent personal data breaches, including by their processors. Failure can attract a penalty of up to Rs 250 crore.
Breach notification: If a personal data breach occurs, they must inform the Data Protection Board of India and each affected individual. Failure to do so can attract a penalty of up to Rs 200 crore.
Until then: Businesses handling sensitive personal data remain subject to Section 43A of the IT Act and the Sensitive Personal Data or Information Rules, 2011, which require reasonable security practices.
Access controls, confidentiality clauses in employment and vendor contracts and a tested breach response plan address both insider theft and DPDP compliance. The firm has also written on large-scale customer data leaks.
About the authors
Anuradha Gandhi, Managing Associate: Anuradha writes and advises on data protection, technology law, employment and workplace compliance. In 2024 she was recognised in three Mondaq topics: Data Protection, Technology and Environmental Law.
Isha Sharma: Isha Sharma of S.S. Rana & Co. co-authored the article and writes regularly with Anuradha on technology, data and workplace issues.
Recognition in 2024
| Award | Recognition | Edition |
| Mondaq Thought Leadership Awards, India | Anuradha Gandhi and Isha Sharma: #1, Data Protection | Autumn 2024 |
| Mondaq Thought Leadership Awards, India | Anuradha Gandhi and Isha Sharma: #2, Technology (same article) | Spring 2024 |
| Mondaq Thought Leadership Awards, India | Vikrant Rana and Anuradha Gandhi: #2, Environmental Law | Spring 2024 |
| Mondaq Thought Leadership Awards, India | S.S. Rana & Co.: Top Firms | Spring and Autumn 2024 |
See the Data Protection results and our pages on the firm’s Autumn 2024 Top Firms recognition, Nihit Nagpal’s Immigration award, and Anuradha’s Spring 2024 awards in Technology and Environmental Law. Each recognition is recorded on our Awards page.
We congratulate Anuradha and Isha on this recognition, and thank everyone in India and abroad who read and shared their work.
Frequently Asked Questions
mondaq-autumn-2024-data-protection-ag-is
Yes. Their article “Corporate Data Theft: A Major Concern” placed first (#1) for India in Data Protection in the Mondaq Thought Leadership Awards, Autumn 2024.
Yes. The article also placed second for India in Technology in the Mondaq Thought Leadership Awards, Spring 2024, making it recognised in two consecutive editions.
Businesses that decide how personal data is processed, called data fiduciaries, must give notice and obtain valid consent (or rely on a permitted legitimate use), use data only for the stated purpose, keep it accurate, protect it with reasonable security safeguards, report personal data breaches, and erase it when the purpose is served.
The data fiduciary must inform the Data Protection Board of India and each affected individual. Failing to take reasonable security safeguards can attract a penalty of up to Rs 250 crore, and failing to notify a breach up to Rs 200 crore.
Until the DPDP Act is brought into force, businesses handling sensitive personal data remain subject to Section 43A of the Information Technology Act, 2000 and the Sensitive Personal Data or Information Rules, 2011, which require reasonable security practices.
Write to info@ssrana.com with a short description of your matter, and the firm will connect you with the right team.
The article is available on Mondaq at https://www.mondaq.com/article/1378424.
For more information on Technology Law, Data Protection, Digital Personal Data Protection Act Compliance, Privacy Policies, Information Technology Act Compliance, Intermediary Guidelines, Deepfakes and AI Regulation, Personality Rights, Cyber Security Compliance, E-commerce Compliance, Software Licensing, SaaS Agreements, Online Content Takedowns and Regulatory Compliance in India write to us at info@ssrana.com.