A former employee took confidential company data before leaving, what legal action can we take?

Question

An ex-employee downloaded client lists and trade secrets before resigning and is now using them for a competing business. Specifically, I want to know how Information Technology Act, 2000 – Section 72A applies to a situation like mine and what the cyber law position in India actually is. If there is a deadline I should be aware of, I need to know that now.

MyVakeel Legal Desk · Accepted Answer

A former employee took confidential company data before leaving, what legal action can we take? is governed in India primarily by Information Technology Act, 2000 – Section 72A, Information Technology Act, 2000 – Section 43 and Indian Contract Act, 1872 – Section 27 (restraint of trade, note limits). Outcomes in employee data theft disputes depend heavily on documentation, so check what you can actually evidence as you read.

Section 72A punishes disclosure of personal/confidential information obtained under a lawful contract without consent, with a breach causing wrongful loss punishable by up to 3 years imprisonment or fine up to Rs 5 lakh, or both.

Section 43 read with Section 66 covers unauthorised copying/extraction of data from a computer system, entitling the company to compensation and enabling a criminal complaint for hacking/data theft.

While non-compete clauses post-employment are largely unenforceable in India under Section 27 of the Contract Act, confidentiality/non-disclosure obligations survive termination and can be enforced through injunction.

File a civil suit seeking an injunction restraining use of the stolen data/trade secrets and damages, alongside a criminal complaint for a quicker deterrent and evidence-gathering via police investigation.

Preserve access logs, device audit trails, and the employment contract's confidentiality clause as key evidence before initiating action.

In practice, in this order: 1) Audit system logs to identify what data was accessed/downloaded and when; 2) Send a cease-and-desist legal notice invoking the confidentiality clause; 3) File a civil suit for injunction and damages, and a criminal complaint under Section 72A; 4) Preserve all digital forensic evidence with a certified forensic examiner.

Timing matters here: Information Technology Act, 2000 – Section 72A works on limitation periods, so a employee data theft claim that is right on the merits can still fail if it is brought late. You can post the details on the MyVakeel forum for a practising advocate to review, or book a paid consultation with a Bar Council verified lawyer in cyber law.