1. Introduction

Confidentiality breach liability refers to the legal responsibility of a person, employee, company, researcher, professional, institution, or other entity that improperly discloses, uses, accesses, or exploits confidential information in violation of a contractual obligation, a professional duty, a statutory requirement, or a legally recognised duty of confidence.

Confidentiality is essential in employment, commercial transactions, medical practice, legal services, banking, scientific research, intellectual property protection, government administration, and personal relationships.

Liability may arise when confidential information is disclosed to an unauthorised person, used for an unauthorised purpose, copied without permission, or negligently exposed through inadequate security measures.

Example: A biotechnology company shares unpublished research data with a business partner under a non-disclosure agreement (NDA). The partner subsequently provides that information to a competitor. Depending on the agreement and applicable law, the partner may be liable for breach of contract, misuse of confidential information, and resulting financial losses.

The precise legal consequences depend on the jurisdiction, the nature of the information, the parties' relationship, the circumstances of disclosure, and the remedies available under the applicable law.

2. Meaning and scope of confidentiality breach liability

Confidentiality breach liability encompasses several related but distinct legal concepts.

Contractual liability: Arises when a person violates an NDA, employment agreement, research collaboration agreement, or another contract containing confidentiality obligations.

Equitable or civil liability: May arise when confidential information is misused even without an express confidentiality contract, where the relevant legal requirements are satisfied.

Statutory liability: May arise under legislation protecting personal information, trade secrets, professional communications, or regulated records.

Professional liability: May apply when lawyers, doctors, accountants, researchers, or other professionals breach duties imposed by their professional relationship or applicable regulations.

Employer or institutional liability: An organisation may face liability for its own failures, or potentially for acts of employees and agents, depending on the governing legal rules.

Criminal liability: May arise where the conduct also constitutes a specific criminal offence, such as unauthorised access, theft of protected information, or certain unlawful disclosures. A confidentiality breach is not automatically a criminal offence.

The same incident can potentially trigger more than one category of liability.

3. Essential elements of liability

A claimant generally needs to establish the applicable legal basis for the claim and prove the relevant elements.

A. Existence of confidential information

The information must qualify for legal protection. Examples include:

Trade secrets, manufacturing processes, and technical know-how.

Unpublished research, experimental results, and proprietary datasets.

Customer lists, business strategies, and commercially sensitive pricing.

Personal, medical, genetic, and other protected information.

Unpublished inventions, source code, and confidential financial information.

Information that is already publicly available ordinarily cannot be protected as a secret merely by labelling it confidential. However, compilations of public information may sometimes retain confidential value.

B. Existence of a duty of confidence

The defendant must be subject to a relevant legal duty. This may arise from:

An express confidentiality clause or NDA.

An implied contractual term.

An employment or professional relationship.

The circumstances in which information was supplied.

A statutory duty or another recognised legal obligation.

The absence of a signed NDA does not necessarily eliminate liability.

C. Unauthorised disclosure, access, or use

The claimant must identify conduct that exceeded the permission granted. Examples include publishing internal reports, sending files to a competitor, using research data for a separate commercial project, or allowing unauthorised access to protected records.

An accidental disclosure may still create contractual, statutory, or other liability if the applicable rules impose responsibility for negligent handling. Intentional wrongdoing is not a universal requirement.

D. Causation and damage, where required

The claimant may need to establish that the breach caused a legally recognised loss. This may include lost profits, reasonable costs of responding to a breach, loss of commercial advantage, or other recoverable harm.

However, the precise requirements differ by cause of action. Some preventive remedies may be available before measurable financial damage occurs.

E. Absence of a valid justification or defence

A disclosure may be permitted or legally protected where, for example, it is required by law, authorised by the information owner, or protected by applicable whistleblower or public-interest rules. The scope of such protections depends on the jurisdiction and circumstances.

The claimant's rights must therefore be balanced against any applicable legal justification for disclosure.

4. Legal framework governing confidentiality breach liability in India

Indian law addresses confidentiality through contract law, equitable principles, privacy protections, intellectual property law, and legislation governing personal data and specific professional relationships.

A. Indian Contract Act, 1872

The following provisions may be relevant:

Section 37: Requires parties to perform their contractual promises, subject to the Act and other applicable law.

Section 73: Provides compensation for loss or damage caused by a breach of contract where the loss satisfies the statutory requirements.

Section 74: Addresses compensation where a contract specifies a sum payable upon breach or contains a penalty stipulation; the recoverable amount is subject to the statutory rule of reasonable compensation.

If an NDA prohibits disclosure of technical information, unauthorised disclosure may constitute a contractual breach. A claimant must establish the relevant agreement, breach, and entitlement to the remedy sought.

B. Constitutional right to privacy

Article 21 of the Constitution of India protects life and personal liberty, and the Supreme Court has recognised privacy as a fundamental right. Informational privacy is particularly relevant when confidential personal, medical, genetic, or biometric information is disclosed or misused.

The constitutional position does not mean that every private dispute automatically becomes a constitutional claim against a private party. The applicable civil, contractual, statutory, or other remedy must be identified.

C. Digital personal data protection

India's Digital Personal Data Protection Act, 2023, provides a statutory framework for processing digital personal data, including obligations relating to data security and breaches, subject to the Act's scope, commencement, and applicable rules.

Where an incident involves personal data, liability must be assessed under the provisions actually in force at the relevant time. A breach of business secrecy and a breach involving personal data are related but distinct legal issues.

D. Intellectual property and trade secrets

India does not have a single comprehensive standalone statute specifically codifying all trade-secret protection. Confidential business information may instead be protected through contractual obligations, equitable principles, copyright or other applicable intellectual property rights, and relevant statutory provisions.

The protection of confidential know-how is especially important where information has commercial value because it is not generally known and reasonable measures have been taken to preserve its secrecy.

5. Important case laws on confidentiality breach liability

The following judgments illustrate how courts have developed the principles governing confidentiality, liability, injunctions, and privacy.

Case 1: John Richard Brady v. Chemical Process Equipments Pvt. Ltd.

Delhi High Court · AIR 1987 Delhi 372

Facts: The plaintiffs shared technical drawings, specifications, and know-how concerning a specialised fodder-production machine with the defendants in circumstances of confidence. The plaintiffs alleged that the defendants subsequently used the material to manufacture a competing machine.

Legal issue: Could confidential technical information be protected against unauthorised commercial use even where the parties' dealings did not result in the anticipated commercial arrangement?

Decision and principle: The Delhi High Court recognised a prima facie basis for relief concerning the alleged misuse of confidential technical material. It discussed the equitable principle that a recipient must not exploit information entrusted to them in confidence to obtain an unfair commercial advantage.

Indian Kanoon+1

Importance for liability:

A confidentiality obligation may arise from the circumstances of disclosure.

Technical know-how and drawings may receive protection even without a comprehensive statutory trade-secret code.

A court may restrain misuse where the evidence supports the required legal conditions.

Legal lesson: A recipient cannot automatically treat commercially valuable information as free for exploitation simply because negotiations or a proposed business arrangement fail.

Case 2: K.S. Puttaswamy (Retd.) v. Union of India

Supreme Court of India · (2017) 10 SCC 1 · Decided 24 August 2017

Facts: The proceedings concerned whether privacy is constitutionally protected in India, including in the context of state collection and use of personal information.

Legal issue: Is privacy a fundamental right, and what principles govern interference with it?

Decision: A nine-judge bench unanimously recognised the fundamental right to privacy as part of the constitutional protections associated with Part III, including Article 21. The judgments addressed informational privacy as an important aspect of the right.

National Digital Library of India+1

Importance for confidentiality liability:

Personal information is not merely an administrative resource; its use can affect individual autonomy and dignity.

Unlawful disclosure of personal information may raise privacy concerns in addition to contractual or statutory issues.

State interference with privacy must satisfy the applicable constitutional requirements.

Limitation: Puttaswamy is not a general damages judgment establishing automatic liability for every private confidentiality breach. The specific cause of action and remedy must still be established.

Case 3: CPIO, Supreme Court of India v. Subhash Chandra Agarwal

Supreme Court of India · (2019) 16 SCC 401

Facts: The dispute concerned disclosure under the Right to Information Act, 2005, of information relating to public authorities and the office of the Chief Justice of India.

Legal issue: How should transparency obligations be reconciled with privacy, confidentiality, and competing public interests?

Decision and principle: The Supreme Court examined the relationship between disclosure and confidentiality, including the statutory framework governing access to information and the protection of personal information.

VoxJuris

Importance for liability:

Confidentiality must be assessed in its legal and institutional context.

Information held by a public authority is not necessarily exempt from disclosure merely because it is described as confidential.

Statutory disclosure obligations and applicable exemptions must be considered before alleging wrongful disclosure.

Legal lesson: Confidentiality is not absolute; competing statutory rights and public interests may affect whether disclosure is lawful.

Case 4: Coco v. A.N. Clark (Engineers) Ltd.

English High Court · [1969] RPC 41

Facts: The claimant developed technical information concerning a moped engine and sought to prevent its unauthorised commercial exploitation.

Legal issue: What elements must be established to succeed in a claim for breach of confidence independently of contract?

Decision and principle: Megarry J identified three central requirements:

The information must possess the necessary quality of confidence.

It must have been communicated in circumstances importing an obligation of confidence.

There must be unauthorised use to the detriment of the person communicating it.

These requirements became a leading framework for analysing breach-of-confidence claims.

Bailii+1

Importance for liability: The judgment helps determine whether the information is legally confidential, whether the defendant owed a duty, and whether the alleged conduct justifies relief.

Application in India: Indian courts have relied on comparable equitable principles in disputes involving confidential technical information and commercial know-how.

Case 5: Saltman Engineering Co. Ltd. v. Campbell Engineering Co. Ltd.

English Court of Appeal · (1948) 65 RPC 203

Facts: The dispute concerned engineering drawings and their use in a commercial setting.

Legal principle: Information that is genuinely confidential cannot ordinarily be used without authorisation merely because the recipient obtained access to it. Information that is already public knowledge generally does not qualify for protection as a secret on that basis alone.

Bailii+1

Importance for liability: The case illustrates why the claimant must identify the confidential information precisely and establish the circumstances in which the defendant obtained it.

Practical example: A company may protect an unpublished manufacturing formula, but it cannot ordinarily claim exclusive confidentiality over a formula already publicly disclosed.

Case 6: Attorney General v. Guardian Newspapers Ltd. (No. 2)

House of Lords · [1990] 1 AC 109

Facts: The litigation concerned publication of material from Spycatcher, a book associated with former intelligence officer Peter Wright.

Legal issue: When can publication of confidential material be restrained, and how should confidentiality be balanced against freedom of expression and information already in the public domain?

Legal principle: The House of Lords considered the equitable duty of confidence and the circumstances in which confidentiality obligations may extend beyond the original recipient. The case also illustrates the importance of the information's status and the practical consequences of publication.

Bailii+1

Importance for liability: A third party who knowingly receives or exploits information disclosed in breach of confidence may face liability in appropriate circumstances. However, knowledge, the information's status, public-interest considerations, and the relevant legal rules remain important.

Case 7: Campbell v. MGN Ltd.

House of Lords · [2004] UKHL 22 · [2004] 2 AC 457

Facts: Newspaper publication concerned the private life of a public figure, including information about treatment for drug addiction.

Legal issue: When does publication of private information give rise to liability, even where the publisher argues that the information is newsworthy?

Decision and principle: The House of Lords examined misuse of private information, balancing the claimant's privacy interests against the publisher's freedom of expression.

Importance for confidentiality liability: The case demonstrates that the legal assessment of disclosure may involve the nature of the information, the claimant's reasonable expectation of privacy, the justification for publication, and proportionality.

Bailii+1

Limitation: The case concerns English privacy law and should not be treated as establishing an identical cause of action in every Indian dispute.

6. Forms of liability arising from a confidentiality breach

These categories are not mutually exclusive. Whether multiple remedies can be pursued depends on the applicable legislation and the facts.

7. Remedies available to the injured party

A. Injunction

An injunction may restrain threatened or continuing disclosure, prohibit unauthorised commercial use, or prevent dissemination of confidential records.

In India, temporary injunctions may be sought under Order XXXIX Rules 1 and 2 of the Code of Civil Procedure, 1908, where the applicable requirements are met. Courts commonly consider whether there is a prima facie case, whether irreparable injury is likely, and where the balance of convenience lies.

B. Monetary compensation

Under Sections 73 and 74 of the Indian Contract Act, where applicable, a claimant may seek compensation for legally recoverable loss caused by breach of contract.

Potential losses may include:

Lost profits caused by unauthorised use.

Reasonable costs of investigating and containing the breach.

Loss of commercial advantage or demonstrable business opportunities.

Other losses satisfying the applicable rules of causation, remoteness, and proof.

Compensation is not automatically equal to the value of the confidential information. The basis and amount of recovery depend on the cause of action and the evidence.

C. Account of profits

In an appropriate case, a claimant may seek an account of profits or another gain-based remedy where recognised by the applicable law. Such relief is not automatic and may depend on the nature of the claim and the court's remedial powers.

D. Return or destruction of information

A court may, where legally justified, require the return, deletion, or destruction of confidential documents and copies, or impose restrictions on their use.

E. Corrective and protective measures

Depending on the legal framework, appropriate relief may also include directions to secure affected records, limit further dissemination, or comply with applicable notification obligations.

The objective is to prevent further harm and provide legally appropriate relief, rather than to impose an arbitrary penalty for every breach.

8. Defences against confidentiality breach liability

A person or organisation accused of breaching confidentiality may rely on a defence where the facts and governing law support it.

Publicly available information: The information was already public and did not retain the relevant confidential character.

Authorised disclosure: The information owner expressly or impliedly permitted the particular use or disclosure.

Independent development: The defendant developed the information independently without misusing protected material.

Legal obligation: Disclosure was required by a valid legal order or statutory duty.

Protected whistleblowing: The disclosure falls within an applicable statutory protection or other recognised legal justification.

No applicable duty: The defendant did not owe the particular contractual, statutory, professional, or equitable duty alleged.

Failure to establish causation or loss: The claimant cannot prove a required element of the particular claim, although preventive relief may remain possible in some circumstances.

A defendant's mere assertion that information was shared informally or that no NDA was signed does not, by itself, establish a defence.

9. Evidence required to establish liability

Strong evidence is often decisive in confidentiality litigation. The following materials can be particularly important.

Contracts and confidentiality agreements

NDAs, employment contracts, research agreements, licence terms, and relevant confidentiality policies.

Records identifying the confidential information

Technical documents, unpublished research, access classifications, source files, and evidence of secrecy measures.

Disclosure and access evidence

Emails, access logs, download records, authorised-recipient lists, communications, and relevant electronic audit trails.

Evidence of harm

Financial records, lost business opportunities, investigation costs, evidence of commercial exploitation, and expert analysis where appropriate.

Electronic evidence should be preserved in a manner that maintains its integrity and supports its admissibility under the applicable evidentiary rules.

10. Application to scientific research and joint ventures

Confidentiality breach liability is particularly important when researchers, universities, hospitals, biotechnology companies, and commercial sponsors collaborate.

Consider a joint research project in which one party shares unpublished genetic research data with another under a written agreement. The receiving party later shares the dataset with an outside company without authorisation.

The legal analysis should examine:

Whether the dataset was confidential and whether it contains personal data.

Whether the receiving party was authorised to use it for the disclosed purpose only.

Whether the agreement restricts onward disclosure and commercial exploitation.

Whether privacy, research ethics, intellectual property, and data protection requirements apply.

Whether the claimant can establish actual or threatened harm and the appropriate remedy.

The disclosure could potentially support more than one claim, but the outcome depends on the applicable contractual terms, statutory obligations, evidence, and jurisdiction.

11. Practical steps for preventing and responding to breaches

Organisations can reduce their exposure by adopting clear confidentiality agreements, limiting access to sensitive information, maintaining audit logs, training personnel, and establishing procedures for reporting suspected disclosures.

When a breach is suspected, the response should generally include:

Preserve relevant documents, messages, and access logs.

Identify the information exposed and the recipients involved.

Restrict ongoing unauthorised access where lawful and technically feasible.

Review contractual and statutory notification requirements.

Assess whether urgent injunctive relief or another legal remedy is appropriate.

Document the losses, corrective measures, and steps taken to prevent recurrence.

An organisation should avoid destroying evidence or making unsupported allegations before the incident has been investigated.

12. Conclusion

Confidentiality breach liability protects legitimate interests in private information, commercial secrets, professional communications, and legally restricted data. Liability can arise through contract, equitable principles, legislation, or other recognised legal duties.

The central questions are whether the information was legally protected, whether the defendant owed a duty, whether the challenged conduct violated that duty, and which additional elements are required for the particular remedy sought.

In India, John Richard Brady v. Chemical Process Equipments Pvt. Ltd. illustrates the protection of confidential technical know-how, while K.S. Puttaswamy v. Union of India establishes the constitutional significance of privacy. The English decisions in Coco v. A.N. Clark, Saltman Engineering, and Campbell v. MGN Ltd. provide influential comparative principles on confidentiality and private information.

Legal qualification: This is a general research overview, not a case-specific legal opinion. The applicable law and remedies should be verified against the current legislation and binding decisions in the relevant jurisdiction.

For a more targeted legal analysis, the next useful step would be to examine Confidentiality Breach Liability under Indian law, including statutory provisions, additional Indian judgments, and the distinction between civil and criminal consequences.