If you are stuck in such a situation, here is what to do.

A gentleman, Mr. Rohan Mehra, finds himself in a precarious situation. Employed with a prominent tech firm, “Cybernetic Systems Ltd.,” in a major Indian city, he recently forwarded several work-related emails from his official account to his personal email address. His intention was simply to access these materials conveniently while working from home, as the emails contained internal project discussions and notes necessary for his tasks. He did not share this information with any external party and had no malicious intent. The data did not include sensitive client information or valuable intellectual property.

However, the company’s internal monitoring systems detected this activity, and Mr. Mehra has been summoned for a disciplinary hearing. He is now deeply concerned about the potential legal ramifications of his actions, which he believed were harmless and solely for work facilitation.

Advice in such cases

Navigating such a situation requires a calm and strategic approach. The employee’s actions, while seemingly innocent, can be viewed as a breach of company policy and data security protocols. Here is some general advice:

• Review your employment agreement and the company’s IT and data security policies immediately. These documents are the foundation of your obligations to the company.
• Do not delete the emails or attempt to cover your tracks, as this could be interpreted as an admission of guilt or obstruction.
• Prepare a clear and honest explanation for your actions, emphasizing the lack of malicious intent and the purpose of facilitating your work.
• Consult with a Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think. An expert in employment and cyber law is recommended.

Applicable Sections of Law

Several Indian laws can be invoked in such scenarios, depending on the specifics of the case:

• The Information Technology Act, 2000: This is the primary legislation governing such acts.
  • Section 43: Imposes penalties and requires compensation for damaging a computer system, which includes accessing, downloading, or copying data without the owner’s permission.
  • Section 66: Deals with computer-related offences. If the act is done dishonestly or fraudulently, it can lead to criminal charges.
  • Section 72: Specifies penalties for any person who, in pursuance of a contract, secures access to any material or information and discloses it without the consent of the person concerned.
• The Indian Contract Act, 1872: Your employment letter is a contract. If it contains a confidentiality clause, forwarding emails can be considered a breach of that contract, making you liable for damages.
• The Digital Personal Data Protection Act, 2023: If the emails contained any personal data of colleagues or clients, forwarding them could be seen as a data breach under this new act, attracting significant penalties for the company, which they might try to pass on to the employee.
• Bharatiya Nyaya Sanhita, 2023 (BNS): While less direct, if the data is considered “movable property” and there is evidence of dishonest intent to take it, provisions related to theft (Section 319 of BNS) could potentially be explored by an aggressive complainant, although this is a legal stretch.

If you are the complainant

If you are the company (the complainant) that has discovered an employee forwarding official data, you should proceed methodically:

• Secure Evidence: Preserve all digital evidence, including email server logs, the content of the forwarded emails, and access records.
• Internal Inquiry: Conduct a fair and transparent internal disciplinary inquiry as per the company’s established procedures and principles of natural justice. Give the employee a chance to explain their actions.
• Review Policies: Check the employee’s contract and the company’s IT policies to establish a clear breach of rules.
• Assess Damage: Determine the sensitivity of the information and assess any potential or actual damage caused by the data transfer.
• Consult with a Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

If you are the victim

If you are the employee (the “victim” of the situation or accusation), your immediate steps are crucial:

• Stay Calm: Do not panic. Avoid any rash decisions like resigning immediately, which might be interpreted as an admission of guilt.
• Gather Your Documents: Collect your appointment letter, company policy handbooks, and any communication related to your work-from-home arrangement.
• Cooperate but Be Cautious: Participate in the disciplinary hearing. Be honest about your actions but do not sign any documents or make written admissions without legal advice.
• Highlight Mitigating Factors: Clearly state that there was no malicious intent, the information was not shared with any third party, and the sole purpose was to complete your official duties efficiently.
• Consult with a Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

How the police behave in such cases

Police involvement in such matters is not automatic. Companies typically prefer to handle these issues internally to avoid negative publicity and lengthy legal battles. The police will only get involved if the company files a formal First Information Report (FIR). An FIR is more likely if the forwarded data is extremely sensitive, such as a client database, a trade secret, or financial information, or if there is evidence that the employee intended to sell or misuse the data for financial gain. In most cases involving internal notes or discussions, the police would likely view it as a civil or internal disciplinary matter unless a clear criminal offence under the IT Act is established with evidence of dishonest intent.

FAQs people normally have

Is forwarding work emails to a personal ID a criminal offense?

It can be, but it is not automatic. It becomes a potential criminal offense under the IT Act, 2000, if it can be proven that the act was done dishonestly, fraudulently, or with the intent to cause wrongful gain or wrongful loss. Without these elements, it is more likely to be treated as a breach of company policy and contract.

What is the worst-case disciplinary action the company can take?

The company can take a range of actions, from a formal warning to suspension without pay, or even termination of employment for gross misconduct, depending on the severity of the policy breach and the sensitivity of the data involved.

Can my company file a police complaint or sue me?

Yes. The company has the right to file an FIR if they believe a criminal offense has occurred. They can also file a civil suit against you to claim damages for any losses suffered due to your breach of contract and confidentiality.

What evidence is required?

For the company, key evidence includes email server logs showing the forwarding activity, the content of the emails to establish their nature, the employment contract with the confidentiality clause, and the company’s IT policy documents. For the employee, evidence would include the emails themselves (to prove they were not highly sensitive), any written permissions for flexible work, and a record of good past conduct.

How long will the investigation take?

An internal company investigation is usually completed within a few weeks. However, if a police complaint is filed, the investigation under the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) can be a prolonged process, potentially taking several months. A civil lawsuit for damages can extend for several years in the Indian judicial system.

Advocate Sudhir Rao, Supreme Court of India