Corporate liability:

It is certainly true that the increasing risk of a data breach or other data protection failure
affects practically every business. A legal person shall be held liable if he has committed any
offence on his part either intentionally or with gross negligence.
The relationship between employees and employer is of mutual trust, breaches of data
protection law by employees could result in the employer bearing the financial, operational
and publicity cost of employee behaviour. Under certain circumstances, the employee’s
misconduct could hold the employer vicariously liable for their wrongdoing even if they did
not breach the law directly.
Punishment for violating law:
The legal person shall be punished with fine not exceeding 1% of its annual gross revenue in
Pakistan or thirty million rupees, whichever is higher. Provided that such punishment shall
not declare the individual, responsible for committing the offence, free from guilt.
Risk-mitigation measures for employers
This decision also highlights the importance of implementing appropriate preventive and
reactive measures to mitigate the risk of employee wrongdoing. These measures enable
employers to monitor, assess and improve the level of compliance with data protection law
internally and in relation to external parties, e.g., customers and contractors. Appropriate
training for handling of personal data and the introduction of control measures are essential.