Protected, Not Liable: The DPDP Act Does Not Make Directors Personally Liable For A Data Breach

Introduction

When a company suffers a data breach, boardrooms instinctively fear the worst: that directors will be personally held responsible. This concern significantly overstates what the law actually provides. A careful reading of the relevant legislation reveals a framework that is considerably more protective of directors than the alarm around data breaches would suggest. Both Indian and European law draw a clear distinction between the company as the institution bearing primary liability, and the individuals who govern it, and that distinction is not easily collapsed. The suggestion now being made that every contravention of the Digital Personal Data Protection Act, 2023 or the rules framed under it will expose the board personally finds no support in the text of either instrument. Directors are not immune from every consequence, but any personal exposure arises under other statutes, and only on proof of the individual director's own role, knowledge or neglect, never merely