If you are stuck in such a situation, here is what to do.

Mr. Verma was the director of “Innovate Forward Tech,” a successful software company based in the city of Aryavarta. He discovered that a former senior employee, Mr. Alok, who had recently resigned to start a competing firm, was systematically approaching Innovate Forward’s clients. It appeared Mr. Alok was using a confidential database containing client details, project histories, and pricing structures that he had access to during his employment. Mr. Verma suspected that Alok had copied this proprietary data before leaving the company, which constituted a severe breach of his employment agreement and trust. This act of corporate data theft threatened to undermine Innovate Forward’s market position and client relationships, prompting Mr. Verma to consider immediate legal action to stop the data misuse and seek damages for the breach.

Advice in such cases

When faced with a situation involving corporate data theft by a former employee, it is crucial to act swiftly and methodically to protect your business interests. The initial steps you take can significantly impact the outcome of any legal proceedings.

• Preserve Evidence: Immediately secure all digital and physical evidence related to the employee’s activities. This includes their work computer, email records, server access logs, and any communication showing they are using the stolen data. Do not delete or alter any files.
• Document Everything: Create a detailed timeline of events. Note when the employee resigned, when you first suspected the data theft, and collect specific instances of them contacting your clients or using proprietary information.
• Internal Review: Conduct an internal audit to understand the full scope of the data breach. Identify exactly what information was compromised and assess the potential damage to your business.
• Cease and Desist: A common first step is to have a lawyer send a “Cease and Desist” notice to the former employee, demanding they stop using the confidential information and return all company property.

Applicable Sections of Law

Cases of corporate data theft are governed by several laws in India, primarily the Bharatiya Nyaya Sanhita (BNS) and the Information Technology Act, 2000.

• Section 303 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This section deals with theft. If a former employee dishonestly takes movable property (which includes electronic data) out of the possession of the company without consent, it can be considered theft.
• Section 316 of the Bharatiya Nyaya Sanhita, 2023 (BNS): This pertains to criminal breach of trust. An employee entrusted with certain property (like a client database) who misappropriates it for their own use commits a criminal breach of trust.
• Information Technology Act, 2000:
  • Section 43: Imposes a penalty for damaging a computer or computer system, which includes illegally copying or downloading data.
  • Section 66: Defines computer-related offences. If someone dishonestly or fraudulently commits any act referred to in Section 43, it is a punishable offence.
  • Section 72: Specifically penalizes the breach of confidentiality and privacy. Any person who has secured access to electronic records or information in the course of their professional duties and discloses it without the consent of the person concerned is liable for punishment.

If you are the complainant

As the company or individual whose data has been stolen, you are the complainant. Your goal is to stop the misuse of your data and seek legal remedy.

• File a Police Complaint: You should file a First Information Report (FIR) at the local police station or with the Cyber Crime Cell, detailing the theft and providing preliminary evidence.
• Gather Your Proof: Collect all relevant documents, such as the former employee’s employment contract (especially confidentiality clauses), non-disclosure agreements (NDAs), and any digital evidence of the breach.
• Initiate Civil Proceedings: Alongside a criminal complaint, you can file a civil suit for an injunction to prevent the former employee from using the data and to claim damages for the losses incurred.
• Consult with a Lawyer: The very basic and important step to start is talk to a Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

Being the victim of data theft requires a proactive approach to mitigate the damage and strengthen your legal position.

• Assess the Damage: Understand the extent of the breach. Are your trade secrets, client lists, or financial data at risk? This will help you articulate the harm caused in your legal complaint.
• Inform Stakeholders: Depending on the severity, you may need to inform key clients or stakeholders about the breach, assuring them of the steps you are taking to secure your data and protect their interests.
• Strengthen Internal Security: Immediately review and upgrade your company’s data security protocols. Revoke all access for the former employee and conduct an audit to prevent future incidents.
• Work with Forensic Experts: A digital forensics expert can analyze computer systems and networks to find concrete proof of the data transfer, which will serve as powerful evidence in court.

How the police behave in such cases

The police response to corporate data theft cases, especially those handled by Cyber Crime Cells, has become more sophisticated. Initially, they will register an FIR based on your complaint. They will then likely seize the electronic devices of the accused (laptops, phones, hard drives) for forensic analysis. The investigating officer will record statements from you, the accused, and any relevant witnesses. Given the technical nature, the process can be slow, but the police will follow the evidence trail, including IP address logs, email communications, and forensic reports, to build their case. Cooperation and clear presentation of facts can expedite the process.

FAQs people normally have

What evidence is required?

Strong evidence is key to proving a data theft case. This includes:

• The employment agreement and any signed NDAs containing confidentiality clauses.
• Digital evidence such as server logs showing large data downloads or access to sensitive files just before the employee’s resignation.
• A forensic report from a certified expert confirming that data was copied or transferred.
• Evidence of the former employee using the stolen data, such as emails or messages to your clients, or a product that incorporates your trade secrets.
• Testimonies from current employees or clients who were approached by the accused.

How long will the investigation take?

The duration of a data theft investigation can vary significantly. A simple case with clear evidence might conclude within a few months. However, complex cases requiring extensive forensic analysis, tracking digital footprints across multiple platforms, and interviewing numerous witnesses can take a year or even longer. The filing of the chargesheet by the police depends on the completion of this investigation, after which the court trial begins, which is a separate and often lengthy process.

Advocate Sudhir Rao, Supreme Court of India