MediCare Plus Pvt. Ltd., a private healthcare company, maintains an online portal where patients upload their medical records, Aadhaar details, bank account information and diagnostic reports. The company stores this inf

Section 43A of the Information Technology Act, 2000 provides that when a body corporate possesses, deals with, or handles sensitive personal data or information in a computer resource and fails to implement reasonable security practices and procedures, causing wrongful loss or wrongful gain, the body corporate is liable to pay compensation to the affected persons. A body corporate includes companies, firms, and other associations engaged in commercial or professional activities. In the present situation, MediCare Plus Pvt. Ltd. is a private healthcare company, therefore it qualifies as a body corporate. The company collected and stored sensitive personal data such as, medical records, Aadhaar details, Bank account information, Diagnostic reports etc. These types of information are considered sensitive personal data. However, the company failed to implement reasonable security practices. Due to this negligence, hackers gained unauthorized access and leaked patient data, which resulted in financial fraud and reputational harm to the patients. In view of the facts, MediCare Plus Pvt. Ltd. can be held liable under section 43A of Information Technology Act, 2000.