Abstract
The growth of a software-driven solutions sector in India has heightened the level of exposure to defects that result in significant financial repercussions to clients. This academic article examines the liability of IT professionals, from coders to architects, for financial losses arising from software bugs. Drawing upon fundamental concepts of Indian legal systems such as contractual breach, negligence doctrine derived in tort law, protection afforded under the Information Technology Act, 2000, and corporate personality doctrine, one finds that personal liability is rare and exists in unusual situations such as demonstrated recklessness, breach of fiduciary-like obligations, or misuse of the corporate structure. In synthesizing statutory provisions, judicial trends, illustrative hypotheticals, and comparative insights, the article identifies doctrinal ambiguities, critiques current safeguards, and proposes reformative strategies to harmonize technological progress with stakeholder protection.
Introduction
Software is both enabler and Achilles’ heel in the middle of India’s tech revolution; startups in Mohali and Bengaluru fuel global innovations. A misplaced semicolon, an unhandled exception, or a flawed security protocol can mean millions in lost revenue, breached contracts, or eroded trust. As companies outsource or commission custom development, the questions of responsibility sharpen: Who pays when code fails — the company, the professional, or both?
There is an urgency to such an inquiry in the context of accelerating disagreements over digital tools in e-commerce, banking, and logistics. Although Indian law provides strong and generally applicable commercial principles, it offers nuanced and sometimes ambiguous guidance on personal exposure for IT professionals. Unlike regulated careers like medicine or law, there are no standards of care in software development. Following the prescribed structural framework for Law Vaani publications, this paper begins with basic legal definitions, explores case studies, critically analyzes shortcomings and reform possibilities, and ends with conclusive insights. It relies on the damage clauses in the Indian Contract Act, tortious negligence thresholds, IT Act claims, Companies Act veil-piercing precedents, and current data protection obligations. Through the lens of this discussion, it provides clarity on solutions and the policy need for clearer frameworks in the AI-augmented environment ahead, and highlights actions to mitigate it in the future.
Background and legal framework
Statutory provisions and legislative intent:
The foundation is laid down in the Indian Contract Act, 1872. Sections 73-75 of the Act provide for damages for breach: damages resulting from naturally occurring losses or which are contemplated by both parties when they entered into a contract. Software agreements are contracts to do “work and labour,” or to sell goods (based on the judgement of Tata Consultancy Services v. State of Andhra Pradesh where, it is held that software on medium was goods). Failures of software with defects lead to liability for loss of economic resources that could have possibly been foreseen, but usually against the party who is contracting (the company), and not the employee as a single entity.
Limitation of liability provisions are the norm and broadly enforceable if justifiable (not unconscionable under Section 23). Courts review exclusions for negligence but find that caps applied (frequently to contract value) exclude indirect/consequential damages.
It deals on digital part, IT Act, 2000 as amended. Section 43 makes the defendant civilly responsible for damage to computer systems, Section 43A (pre-DPDP) and DPDP Act 2023 deal with data breaches arising from poor security/bugs. Penalties are applied to body corporates or intermediaries with “due diligence” safe harbour (Section 79) for intermediaries. Liability of individual entails a failure to exercise reasonable security measures.
Companies Act, 2013: Directors/officers have limited liability under the act, but Sections 447 (fraud) or piercing the corporate veil in the event of fraud, undercapitalization, or alter ego (e.g., treating company as sham) can impose personal liability. Indian courts have a rather limited application, underwritten by English common law (Salomon v. Salomon principle).
Tort Law (Negligence): Based on common law (Donoghue v. Stevenson neighbour principle, Indian law for common law). A duty of care, breach (a standard professional should do), causation and damages can be established. Pure economic loss is not as easily recoverable, in the absence of contractual privity or special relationship, as with an analogy for the economic loss rule. Software is considered a “service,” rather than a product, limiting strict liability.
Constitutional Articles: Article 21 (right to life/liberty (including livelihood)) and Article 19(1)(g) (trade/business) may inform public interest or regulatory contexts, but private commercial disputes more depend on contract/tort. Legislative intent behind IT laws, while they are rooted more in enabling a digital economy, should weigh accountability—encouraging innovation versus crippling development because of over-liability.
Analysis and Case Studies
The crux of liability analysis for software bugs is to be able to differentiate between contractual duty and tortious duty and the amount of personal exposure a single IT person should bear aside corporate responsibility. The Indian Contract Act, 1872 normally treats contracts for software development as contracts for work and labour or, where tangible media is involved, as sale of goods (Tata Consultancy Services Ltd. v. State of Andhra Pradesh, (2004) 271 ITR 401 (SC)). The bug causing financial loss is violation of express warranties if this breaches the implied conditions of fitness for the purposes (Section 16, Sale of Goods Act read with Contract Act), or specification agreed upon in the SOW. Section 73 makes all costs recoverable for losses that have naturally occurred or were contemplated at the time of formation. However, liability is primarily held for the contracting entity (the IT company), not the employee unless the technical worker signed in personal capacity or provided personal guarantees. Limitations on liability clauses—that is, if they limit exposure to the value of the contract and exclude consequential or indirect damages—are routine and are enforced wherever it is reasonable and not in breach of section 23 (public policy). In tort liability, negligence offers a parallel route. To succeed, a plaintiff must prove: (1) Duty of Care (2) Breach below the standard of an ordinary IT professional, (3) Causation, and (4) Actual Harm. Duty arises out of proximity and foreseeability (Donoghue v. Stevenson principles adopted in India). Software developers owe a duty to use reasonable skill and care, measured by what’s acceptable in the world of industry, not necessarily by how it’s done — bugs are part of complex code. Pure economic loss (financial loss without physical damage or property damage) is recoverable with some difficulty except in the presence of “special relationship” of reliance or assumption of responsibility. Indian courts tend to follow the spirit of the economic loss rule and favour contractual remedies to avoid establishing an indeterminate liability. There is greater risk of a personal suit for gross negligence (for example, skipping critical testing of high-stakes financial software) or of reckless negligence.
Limited liability by virtue of the Companies Act, 2013 protects the rights of all employees and directors. Vicarious liability holds an employer liable for actions committed in the course of business. Personal liability must be independent tortious conduct, fraud or that of piercing the corporate veil, the latter to be applied sparingly where the company was sham, undercapitalized or used for fraud (State of Rajasthan v Gotan Lime Stone Khan Udyog, … etc). For IT, this is uncommon, absent proof that the developer diverted funds, concealed defects aware of them, or treated the entity as its own alter ego.
Examples & case studies:
Consequently, direct Judgments by the Indian Supreme Court or High Court in relation to the personal liability surrounding software bugs are slim to none, mirroring out-of-court settlements characteristic to the IT-related cases involving arbitration. But similar authorities offer guidance. In Pine Labs Pvt. Ltd. v. Gemalto Terminals Pvt. Ltd. (Delhi HC), the court emphasized clear contractual terms regarding deliverables and ownership, suggesting that uncertainties of specification increase breach claims but bind them to the company.
The Supreme Court of India held in Engineering Analysis Centre of Excellence Pvt. Ltd. v. CIT (2021) between software licenses v. sales clarified the concepts and held that precise drafting of contracts enables an organisation to understand the rights and liabilities involved in such a contract—relevant for claims in a warranty, and also a defect warranty claim.
Insights from comparison are instructive. In US law — often prominent in Indian commercial arguments since the 1950s — the doctrine of economic loss often precludes the negligence claim for pure financial losses under contracts (Singh v. Illusory Systems). Courts decline to uphold developer suits in which risk is allocated in accordance with terms. The exceptions are “special relationships” or blatant shortcomings in due diligence.
In the case of a data breach in IT Act section 43/43A (and also in the DPDP Act), the compensation would relate to body corporates for an oversight of reasonable cyber security and individual liability would cover only demonstrated personal dereliction. Hypothetical examples of Indian fintech cases having buggy trading algorithms would probably bring the cases against the company first, with personal claims successful only on proven wilful misconduct.
Synthesis: There are strong shields in contractual privity and corporate form. Personal liability crystallises in narrow windows: independent contractors without corporate cover, directors directly involved in fraud, or gross negligence creating a separate tort. On a perils-based scale, clients succeed faster against well-resourced firms. This framework promotes innovation while required by heavy testing, documentation and insurance. IT professionals can maintain audit trails of code reviews and comply with industry standards (ISO 27001) provides their defence to ensure their code is auditable.
Critical Analysis and Evaluation
Although the legal system governing the personal liability of IT professionals in India for software bugs is working, there are significant tensions, doctrinal gaps and policy inefficiencies that warrant attention. The core issue is the long-standing tension between encouraging technological innovation in a fast-digitalizing economy and doing enough to provide redress for victims of faulty code.
Key Conflicts and Loopholes:
One major drawback, however, is the reliance upon contract laws which allow highly sophisticated parties (largely IT firms) to construct one-sided limitation clauses which limit liability and remove consequential damages. Indian courts usually enforce it unless it is unconscionable or against public policy (Section 23, Indian Contract Act). But smaller customers – MSMEs or start ups – are left with no choice after bugs result in extreme losses. The economic loss doctrine analogue reduces the scope of tort for pure economic injury, and by consequence it appears that defendants may have an option to breach by claiming for damages only in connection with their lack of the technical work and lack of the liability of their own culpability or their culpability of their conduct unless, for instance, there is any fraud or conspiracy committed that exceeds reasonable limits set out in the tort.
Another gap is in the quality of care. While a licensed profession (medicine according to Consumer Protection Act or law) requires certification, software development has no such requirement and there is not a standardized professional code of practice. Courts evaluate “reasonable care” against industry norms that are changing but mostly in self-interest. This low bar makes establishing breach difficult, particularly for latent bugs discovered post-deployment. The IT Act’s “due diligence” safe harbour (Section 79) protects intermediaries but lacks clarity for custom development, where the developer is much more of a service provider. Further obligations under the Digital Personal Data Protection Act, 2023, add to the challenge but there is relatively limited enforcement of individual rights, primarily targeting Significant Data Fiduciaries.
Piercing the corporate veil is a theoretical boundary but is applied with a cautious approach by the courts of India to safeguard the freedom of the entrepreneurs. Cases that must establish fraud, gross undercapitalization, or a sham incorporation establish a high hurdle, and this may leave little room for reasonable behaviour in thinly capitalized IT startups. This opposes constitutional norms based on Article 21 (protection of livelihood and business interests) and Article 19(1)(g), which require proportional regulation.
Critique of the judicial approaches:
Indian court is cautious of end-user contractual autonomy (as seen in tax and IP software like Engineering Analysis Centre) which is realistic for commercial certainty but under-safeguards end-users in asymmetric relation. Comparative regimes can teach us a great dealLesson: The EU’s unfolding Product Liability Directive treats software as a “product” in some circumstances, allowing for strict liability for defects. US courts struggle with the economic loss rule, but provide exceptions through professional services or special reliance. Indian law lags behind the special intangibility and scalability of software where one bug could impact thousands. Legal reluctance to further responsibilities impose on developers risks moral hazard, i.e., the lack of demand for rigorous quality assurance, security audits, or iterative testing.
In safety-critical areas (fintech, healthtech, critical infrastructure), the model today, based on fault and contract, seems insufficient. But a bug in a payment gateway or hospital management system can lead to not just financial loss but systemic harm, implicating wider public interest. But without clear rules, the results are unpredictable, dissuading litigation and allowing settlements that undervalue people’s pain.
Suggestions for Reforms:
1. There will also be legislative interventions to adopt sector-specific legislations (i.e., the IT Act/Consumer Protection Act amendment) that would require that certain software (especially SaaS for critical services) be treated as a product susceptible to stronger liability. Instate compulsory professional indemnity insurance for IT companies and personnel on key jobs in need of such coverage. A “safe harbour” for those developers who model compliance with industry standards (e.g. OWASP, ISO 27001, secure SDLC).
2. Contractual Best Practices: Implement standardized templates with mandatory risk allocation disclosures, escrow for source code, phased acceptance testing, and bug bounty mechanisms. The courts could also be more interventionist in cases of unfair exclusion clauses, according to reports from the Law Commission.
3. Judicial and Regulatory Improvements: Create a “reasonable developer standard” via expert committees. Promote specialised commercial benches for tech disputes. Regulators (MeitY, RBI) need to have recommendations for due diligence when dealing with high-risk software.
4. Industry Self-Regulation: We can adopt worldwide practices but establish IT professional bodies (with ethics codes, a continuing education on liability and certification).
Such reforms would not crush innovation, only steer it in the right direction. Personal liability cannot become far-fetched — only for egregious wrongdoing — so that individuals do not end up under the sway or feeling the cold pressure of their own talent. India needs a balance of deterrence, compensation, and growth to ensure it can be at the forefront of AI and digital services. Analysis shows that if the existing scaffold represents stability, the need to selectively reinforce that is essential to meet the newer realities of code-induced harm.
Conclusion
The issue of personal liability of IT professionals for software bugs leading to client financial loss is however an intricate one under Indian law: it is possible but exceptional. The liability is primarily with the company’s corporate entity through contractual obligation and personal liability is limited to gross negligence, wilful misconduct, fraud and piercing of corporate veil.
Principal conclusions indicate the dominance of Indian Contract Act, 1872. Well-written agreements which include clear SOWs, warranties, acceptance criteria, and limitation clauses effectively give the company the risk that it needs to bear. Tort for negligence is difficult to establish duty and breach for pure economic loss and courts prefer contractual cures. Statutory provisions under the IT Act, 2000 (due diligence safe harbours) and the Companies Act further protect limited liability, but applied only with caution, in order to preserve the spirit of entrepreneurship. Such case law as TCS v. State of AP and Engineering Analysis Centre (SC) suggests that the need to be precise in drafting is important, yet very few direct cases of software bugs exist because of regular arbitration settlements.
Forward-Looking Perspective: As India’s digital economy prospers, this means India’s current model (strong on certainty, but weak on full coverage of pure economic harm) needs to change over time. Regulatory changes could bring in graduated liability for critical software, compulsory insurance, and increased standards of responsibility. Judicial development might welcome nuances of “special relationship” tests and more rigorously scrutinise unfair exclusions. Industry self-regulation through certifications and best practices (ISO, OWASP) would support this.
The final thought: Structure in both code and law prevents disorganisation. That should be the duty of IT professionals: diligence, documentation, and insurance. Clients must also negotiate strong contracts. The policymakers are being asked to strike a balance between innovation and accountability. Implementing a calibrated approach will ensure the bugs.
References
1. Indian Contract Act, 1872 (Sections 73–75) – Core provisions on breach, damages, and limitation of liability in software agreements.
2. Information Technology Act, 2000 (Sections 43, 43A, 79) – Governs damage to systems, data security failures, and intermediary safe harbours.
3. Tata Consultancy Services Ltd. v. State of Andhra Pradesh, (2004) 271 ITR 401 (SC) – Treats software as goods, shaping contractual warranties and classification.
4. Engineering Analysis Centre of Excellence Pvt. Ltd. v. CIT, (2021) 432 ITR 471 (SC) – Clarifies software licensing vs. sale and its impact on rights/liability.
5. AMLEGALS, “Overview of Software Agreements – I” (2021) – Analyses contract essentials, tort/contract liability, and drafting best practices. https://amlegals.com/overview-of-software-agreements-i/
6. SolvLegal, “Software Development Agreement in India: Legal Risks and How to Avoid Them” (2025) – Covers scope creep, IP, liability caps, and practical mitigation strategies.
Author: Ishika Goyal
Ishika Goyal is student at Amity University Punjab. She has a strong academic and professional interest in Criminal Law, Family Law, and Constitutional Law. With a passion for legal research and scholarship, Ishika has authored and co-authored multiple research papers published in reputed national and international journals. She has also contributed chapters to books on specialized topics such as Intellectual Property Rights, and her work has been featured on prominent platforms like Lawvaani.