4. Further comparative case laws on cloud computing liability

The following foreign decisions provide additional guidance on data loss, online platforms, unauthorised data use and contractual risk allocation. They are persuasive comparisons, not binding Indian precedents.

9. OpenRisk, LLC v. MicroStrategy Services Corp. — United States Court of Appeals

Citation: 16-1852 (4th Cir. 2017).

Facts: OpenRisk contracted with MicroStrategy to create a cloud environment to host its data and software. OpenRisk alleged that former officers arranged for data to be copied to a new cloud environment, after which data was deleted from OpenRisk's original environment without the contractually required termination notice.

Legal significance: The litigation involved alleged unauthorised transfer and deletion of cloud-hosted data, as well as claims under state computer-crime law and other legal theories.

Principle: Cloud-hosted data remains subject to contractual rights and legal protections. A provider's access to a customer's environment does not by itself authorise the transfer, disclosure or deletion of data contrary to the contract.

Relevance: Cloud contracts should define authorised access, data ownership, transfer permissions, termination notice, retention and deletion. A provider should also maintain audit logs capable of establishing who accessed, copied or deleted information.

10. Clark Street Wine and Spirits, Inc. v. Emporos Systems Corp. — United States District Court

Citation: 754 F. Supp. 2d 474 (E.D.N.Y. 2010).

Facts: The dispute involved a computerised point-of-sale system and allegations concerning security failures and loss associated with the system. The court considered contractual risk allocation and the possible effect of liability limitations in the context of alleged serious misconduct.

Legal significance: The decision is often discussed in technology-contract analysis because it highlights that liability limitations may be scrutinised where alleged conduct goes beyond ordinary service failure.

Principle: A contractual limitation is not necessarily an absolute defence in every circumstance. Its enforceability depends on the contract, governing law and the nature of the alleged conduct.

Relevance: Cloud providers and customers should negotiate liability clauses carefully, especially for data destruction, serious security failures, confidentiality breaches and intentional misconduct. The case does not establish that every cloud liability cap is invalid or that every data loss results in damages.

11. MySpace Inc. v. Super Cassettes Industries Ltd. — Delhi High Court

Citation: 2016 SCC OnLine Del 6382; decided on 23 December 2016.

Facts: Super Cassettes Industries alleged copyright infringement involving material uploaded by users to MySpace. The dispute concerned intermediary liability, the role of an online platform and the circumstances in which a platform may be responsible for user-posted content.

Decision: The Delhi High Court considered the interaction between copyright law and the intermediary framework, including the significance of knowledge and the platform's role in dealing with infringing material.

Principle: The legal responsibility of a digital intermediary depends on its role, the relevant statutory framework and the facts of the case. The fact that a platform stores or transmits third-party content does not, by itself, resolve the question of liability.

Relevance to cloud computing: The decision is relevant by analogy to cloud-hosting providers whose infrastructure stores customer content. It does not create a general immunity for cloud providers, particularly where liability arises from their own contractual failures, unlawful data processing or other independent duties.

12. Christian Louboutin SAS v. Nakul Bajaj — Delhi High Court

Citation: 2018 SCC OnLine Del 12215; decided on 2 November 2018.

Facts: The case concerned alleged trademark infringement through an e-commerce platform and the extent to which an online intermediary could rely on statutory protection.

Legal significance: The court considered the platform's level of involvement in the transactions and whether its activities went beyond a purely passive intermediary role.

Principle: Intermediary status and statutory protection depend on the applicable law and the platform's actual role. A business cannot assume that every activity conducted through a digital platform is automatically protected by intermediary immunity.

Relevance: The case offers a comparative framework for assessing the distinction between passive infrastructure services and active participation in unlawful conduct. It must be applied cautiously: a cloud infrastructure provider, a marketplace and a content-hosting platform may have different functions and legal obligations.

5. Indian legal principles governing cloud computing liability

A. Contractual liability

The Indian Contract Act, 1872 is central to disputes over cloud service agreements.

Section 37: Parties must perform, or offer to perform, their contractual promises unless performance is excused under the Act or another applicable law.

Section 39: A party may have grounds to terminate where the other party refuses or disables itself from performing its promise in its entirety, subject to the statutory requirements.

Section 73: Compensation may be available for loss naturally arising in the usual course from a breach, or loss that the parties knew when contracting was likely to result from the breach. Remote and indirect loss is generally excluded.

Section 74: Where a contract stipulates a sum payable upon breach, the court awards reasonable compensation subject to the statutory limits; the stipulated amount is not automatically recoverable in every case.

These provisions may apply to service outages, lost data, failure to implement contracted infrastructure, wrongful termination and non-payment disputes.

B. Information technology and intermediary liability

The Information Technology Act, 2000 may be relevant to unauthorised access, damage to computer resources, confidentiality and the legal status of intermediaries.

Section 43 addresses specified unauthorised acts involving computer systems and data. Section 66 may apply where conduct covered by Section 43 is carried out dishonestly or fraudulently. Section 72 addresses certain disclosures of information in breach of statutory authority or consent.

Section 79 provides conditional intermediary protection for qualifying intermediaries, subject to statutory requirements. It should not be treated as blanket immunity for a cloud provider's own breach of contract, negligence or independent unlawful conduct.

C. Data protection and confidentiality

Cloud providers may process personal data for customers and may also process information for their own purposes. Their legal obligations depend on their actual role, the data involved and the applicable statutory regime.

India's Digital Personal Data Protection Act, 2023 and the rules and commencement notifications applicable at the relevant time should be considered alongside contractual confidentiality clauses and other applicable laws. A customer and provider should clearly allocate responsibility for access controls, incident reporting, retention, deletion and cooperation with affected individuals or authorities.

D. Intellectual property liability

Cloud platforms may store or process copyrighted works, software, trademarks and other protected material. Liability can arise from unauthorised use, distribution, copying or infringement of licence restrictions.

The applicable intellectual property statute, the provider's actual role and any relevant intermediary protections must be considered. A cloud provider should have a clear process for handling infringement complaints without assuming that a customer's use of the platform automatically makes the provider liable—or that hosting automatically eliminates all risk.

6. Main categories of cloud computing liability

7. Defences and limitation of liability

Cloud providers frequently rely on contractual clauses limiting damages, excluding consequential loss or making service credits the principal remedy for service-level failures. Customers may challenge the application or enforceability of those clauses.

The court or tribunal may need to consider:

Whether the clause was properly incorporated into the contract.

Whether the clause clearly covers the breach in question.

Whether mandatory statutory requirements restrict the clause.

Whether the provider's conduct falls within an exception for fraud, wilful misconduct or another specified category.

Whether the claimant can establish causation and recoverable loss.

Whether the claimant contributed to the loss, for example by failing to maintain backups it had agreed to manage.

The United Nations Commission on International Trade Law's 2019 notes on cloud computing contracts identify risk allocation, data-protection roles, liability caps and exclusions as important drafting issues. The governing law of the actual contract, however, determines enforceability.

8. Evidence and remedies in cloud disputes

A claimant should preserve:

The master services agreement and all amendments.

The service-level agreement and applicable service descriptions.

Provisioning, access and audit logs.

Backup and recovery records.

Incident reports and security notifications.

Invoices, service-credit calculations and payment correspondence.

Data export and deletion records.

Expert evidence on the technical cause of failure.

Documents establishing the amount and cause of the claimed loss.

Potential remedies include damages, contractual service credits, repayment where legally justified, termination, injunctions in appropriate cases, statutory compensation where available and arbitration or court proceedings.

The claimant must establish the legal basis for the remedy sought. A cloud outage, data breach or deletion incident does not automatically establish liability for every loss claimed.

9. Conclusion

Civil liability in cloud computing arises from the interaction of contract law, data protection, cybersecurity, intellectual property and intermediary regulation. The most important issues are the allocation of responsibility, the provider's actual conduct, the terms of the agreement and the evidence linking the alleged breach to the loss.

The Indian cases concerning cloud services and technology contracts—including Union of India v. Tata Communications Ltd. and World Phone Internet Service Pvt. Ltd. v. Impetus Technology Services Pvt. Ltd.—illustrate the importance of contractual performance, billing evidence and service obligations. Comparative decisions such as OpenRisk v. MicroStrategy and Clark Street Wine and Spirits v. Emporos Systems illustrate the additional risks arising from data transfer, deletion and technology-related liability clauses.

The governing principle is that cloud computing does not remove ordinary legal responsibilities. Providers must perform their contractual and statutory duties, while customers must comply with their own obligations, including any responsibilities for account security and backups. Liability ultimately depends on the applicable law, the contract, the parties' conduct and proof of legally recoverable loss.