Introduction
When a company suffers a data breach, boardrooms instinctively fear the worst: that directors will be personally held responsible. This concern significantly overstates what the law actually provides. A careful reading of the relevant legislation reveals a framework that is considerably more protective of directors than the alarm around data breaches would suggest. Both Indian and European law draw a clear distinction between the company as the institution bearing primary liability, and the individuals who govern it, and that distinction is not easily collapsed. The suggestion now being made that every contravention of the Digital Personal Data Protection Act, 2023 or the rules framed under it will expose the board personally finds no support in the text of either instrument. Directors are not immune from every consequence, but any personal exposure arises under other statutes, and only on proof of the individual director's own role, knowledge or neglect, never merely because the company has defaulted.
The GDPR Position
Under the General Data Protection Regulation ("GDPR") (the European Union's data protection law, enforceable since May 2018), responsibility for processing rests on the "controller", being the person or body which, alone or jointly with others, determines the purposes and means of processing (Article 4(7)); Article 26 then allocates responsibility where two or more controllers act jointly. Crucially, the GDPR operates at the level of the institutional controller, not the natural person running it. An individual director of a company does not, by virtue of their position alone, become personally liable under the GDPR. The regulation is directed at the organisation. Even at the organisational level, Article 82(3) GDPR exempts a controller from liability for damage where it proves that it is not in any way responsible for the event giving rise to the damage. The CJEU has clarified that an unauthorised disclosure by a third party does not by itself establish that the controller's security measures were inadequate, although the burden of proving their adequacy rests on the controller (VB v Natsionalna agentsia za prihodite, Case C-340/21, 14 December 2023). The CJEU (Court of Justice of the European Union) in Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW eV (Case C-40/17, 29 July 2019) held that a website operator which embedded a third party social plugin was a joint controller only for the operations whose purposes and means it jointly determined, namely the collection and onward transmission of visitors' data, and not for the processing subsequently carried out by the third party.
The fines under Article 83 GDPR (the penalties provision, which permits fines of up to EUR 20 million or, in the case of an undertaking, 4% of total worldwide annual turnover of the preceding financial year, whichever is higher) are assessed against the controller as an institution (the company), calibrated against the company's global revenue. There is no provision in the GDPR for individual directors to be personally fined. Any other penalty, including any personal or criminal liability, is left to Member State law under Article 84 and does not form part of the GDPR's own enforcement architecture. The regulatory design of GDPR, in short, holds companies accountable while leaving the corporate veil (the legal principle that a company is a distinct legal person, separate from the individuals who run it) largely intact.
The Indian Position
In India, the Companies Act, 2013 ("CA 2013"), the Information Technology Act, 2000 ("IT Act"), and the Digital Personal Data Protection Act, 2023 ("DPDPA") all proceed from the same premise: the company is the primary liable entity for a data breach. Monetary penalties under Section 33 read with the Schedule to the DPDPA (the highest of which, for failure to take reasonable security safeguards, may extend to INR 250 crore) are imposed by the Data Protection Board of India on the "person" found to be in breach, which, where the Data Fiduciary (the entity that determines the purpose and means of processing personal data) is a company, is the company itself as an institution, and not its directors from their personal assets. Civil compensation claims under Section 43A of the IT Act (the provision allowing affected persons to claim compensation where a body corporate is negligent in maintaining reasonable security practices for sensitive personal data) are likewise maintainable against the body corporate and not against directors in their individual capacity. Section 43A itself will stand omitted when Section 44(2) of the DPDPA is brought into force which, under the phased commencement notified on 13 November 2025, is eighteen months from that date.
The absence of director liability under the DPDPA is a matter of legislative design, not oversight. Where Parliament intends to make those in charge of a company personally answerable for its defaults, it says so expressly, as in Section 141 of the Negotiable Instruments Act, 1881 and Section 85 of the IT Act. The DPDPA contains no equivalent provision. It creates no offence and prescribes no imprisonment; it empowers the Board, after an inquiry and a hearing, to impose a monetary penalty on the person in breach (Sections 27, 28 and 33). Nothing in the Act or in the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") deems a director, officer or key managerial personnel liable for a Data Fiduciary's breach, and the DPDP Rules, being subordinate legislation, could not create a head of personal liability that the parent Act does not. Although "person" under Section 2(s) includes an individual, an individual is exposed only where he or she is personally the Data Fiduciary; a director who acts for the company does not determine the purpose and means of processing in a personal capacity. Section 10(2)(a) requires the Data Protection Officer of a Significant Data Fiduciary to be responsible to its Board of Directors, but that is a governance and reporting line, not a transfer of penalty to the directors.
The DPDPA does, however, operate "in addition to and not in derogation of" other laws (Section 38(1)). Any personal exposure of a director must therefore be located in some other statute, and each such statute sets its own conditions, as the discussion below shows.
The Supreme Court settled the governing principle in Sunil Bharti Mittal v CBI (2015) 4 SCC 609: a director may be proceeded against for an offence committed by the company only where there is sufficient material of his or her active role coupled with criminal intent, or where the statute expressly provides for vicarious liability. The title of director is not sufficient, and a DPDPA default satisfies neither condition, since the DPDPA contains no such deeming provision. Personal liability requires a specific and demonstrable link between that individual and the conduct of the business in relation to the particular violation. The Supreme Court reinforced this in National Small Industries Corp Ltd v Harmeet Singh Paintal (2010) 3 SCC 330, holding that even where a statute does impose vicarious liability, the complaint must specifically aver how and in what manner each director was in charge of and responsible for the conduct of the company's business; a bare reproduction of the statutory language will not do.
Section 149(12) of CA 2013 (the provision expressly protecting non-executive and independent directors) codifies a meaningful statutory safe harbour. An independent director (as defined in Section 149(6)) or a non-executive director who is neither a promoter nor key managerial personnel is liable only in respect of acts of omission or commission by the company which occurred with his or her knowledge, attributable through Board processes, and with his or her consent or connivance, or where he or she had not acted diligently. In a typical data breach scenario, where a security failure in the company's IT systems is exploited by a third party, none of these conditions will ordinarily be satisfied for a non-executive or independent director who was not operationally involved in data management. Two cautions apply. First, Section 149(12) opens with the words "Notwithstanding anything contained in this Act" and is a safe harbour within CA 2013; it does not, of its own force, displace a deeming provision in another statute such as Section 85 of the IT Act. Second, the diligence limb is not a formality, and a board that received and ignored reports of serious security weaknesses may struggle to invoke it.
Section 149(12) of CA 2013 is a deliberate legislative choice to protect directors who govern at arm's length from day-to-day operations. A data breach caused by a failure of the company's technical infrastructure does not, without more, translate into personal liability for a non-executive director. Therefore, the law requires specific knowledge and specific failure to act, not mere board membership. The Ministry of Corporate Affairs has reinforced this approach in General Circular No. 01/2020 dated 2 March 2020, which cautions against arraigning independent directors and non-executive directors who are neither promoters nor key managerial personnel in proceedings under CA 2013 unless the record establishes the conditions of Section 149(12).
Section 85 of the IT Act is often cited as the basis for director exposure, but its conditions are more demanding than a surface reading suggests. It requires proof that the director was in charge of and responsible for the conduct of the business at the time of the specific offence, a standard that goes well beyond merely being a director. More significantly, the proviso to Section 85(1) contains an express due diligence defence: a director who proves that the contravention took place without his or her knowledge, or that he or she exercised all due diligence to prevent it, is not liable. A director who ensured that data protection policies were in place, that security audits were conducted, and that risks were escalated appropriately to the board will, in most cases, be able to rely on this defence successfully. Three qualifications must, however, be stated. First, Section 85 applies only to contraventions of the IT Act and the rules, directions and orders made under it; it cannot be imported into the DPDPA, and a penalty imposed by the Data Protection Board is not a contravention of the IT Act. Second, Section 85(2) operates independently of the defence and reaches any director or officer where the contravention is proved to have been committed with his or her consent or connivance, or to be attributable to his or her neglect. In a data breach, the provisions most likely to engage Section 85 are Section 70B(7), which penalises non compliance with directions issued by CERT-In (including its incident reporting directions), and Section 72A, which penalises disclosure of personal information in breach of a lawful contract. Third, the Supreme Court in Aneeta Hada v Godfather Travels and Tours (P) Ltd (2012) 5 SCC 661, which also considered Section 85 of the IT Act, held that such vicarious liability can be pursued only where the company itself is arraigned as an accused.
For a court to reach through the company and impose personal liability on a director, the standard is exacting. The Supreme Court in Balwant Rai Saluja v Air India Ltd (2014) 9 SCC 407 reaffirmed that the corporate veil is to be lifted restrictively, only where the company is a mere camouflage or sham deliberately used to avoid liability. Section 447 of CA 2013 (the fraud provision, which carries imprisonment of not less than six months extending to ten years) requires intent to deceive, to gain undue advantage, or to injure the interests of the company, its shareholders, its creditors or any other person. A data breach resulting from a technical failure, an external cyberattack, or employee negligence (absent deliberate concealment by a director) falls well short of this threshold.
None of this means that directors may treat data protection as someone else's concern. Their real exposure is indirect and runs through their duties to the company. Section 166(3) of CA 2013 requires every director to act with due and reasonable care, skill and diligence, and Section 134(5)(f) requires the directors' responsibility statement to confirm that proper systems have been devised to ensure compliance with all applicable laws and that such systems are adequate and operating effectively. A director who disregards data protection risk may therefore face a claim by the company, or by members through a class action under Section 245, to recover loss caused by his or her breach of duty, and a knowingly false statement in the Board's report may attract Section 448. These are consequences of the director's own conduct under company law, not a personal penalty for the company's DPDPA default, and Section 463 permits a court to relieve an officer who has acted honestly and reasonably.
Conclusion
The proposition that directors are personally liable for every contravention of the DPDPA or the DPDP Rules is not the law. It is an assumption, and it does not survive a reading of the statute. The DPDPA fixes liability on the Data Fiduciary, confines the Board to monetary penalties against the person in breach, creates no offence, and contains no provision deeming any director, officer or key managerial personnel liable for the company's default. Parliament knows how to impose vicarious liability on those who run a company, and has done so in Section 85 of the IT Act and Section 141 of the Negotiable Instruments Act, 1881. Its silence in the DPDPA is deliberate, and after Sunil Bharti Mittal that silence cannot be filled by inference.
That is not to say directors are beyond the reach of the law. A director may still answer under Section 85 of the IT Act where an offence under that Act is committed with his or her consent or connivance, or is attributable to his or her neglect, or under CA 2013 for breach of his or her own duties to the company. In every such case, liability rests on the director's own conduct, proved on evidence, and not on the office he or she holds. Non-executive and independent directors have the further protection of Section 149(12) of CA 2013.
The correct advice to a board is therefore neither alarm nor complacency. Directors who document their oversight, ensure that appropriate security safeguards and breach response procedures are in place, and act on the risks reported to them will find that the law does not reach them personally. Anyone who asserts that a board is answerable for a company's DPDPA default merely because its members sit on that board must point to the statutory provision that makes it so. There is none.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
