NAVIGATING THE LEGAL LABYRINTH: CLOUD SERVICE PROVIDER ACCOUNTABILITY FOR THIRD-PARTY TRADE SECRET MISAPPROPRIATION IN THE ERA OF CONTRACTUAL SHIELDS AND REGULATORY FRAGMENTATION

AUTHOR – RUDRA GUPTA, STUDENT AT CHRIST (DEEMED TO BE UNIVERSITY), BENGALURU

BEST CITATION – RUDRA GUPTA, NAVIGATING THE LEGAL LABYRINTH: CLOUD SERVICE PROVIDER ACCOUNTABILITY FOR THIRD-PARTY TRADE SECRET MISAPPROPRIATION IN THE ERA OF CONTRACTUAL SHIELDS AND REGULATORY FRAGMENTATION, INDIAN JOURNAL OF LEGAL REVIEW (IJLR), 6 (2) OF 2026, PG. 331-344, APIS – 3920 – 0001 & ISSN – 2583-2344. DOI – https://doi.org/10.65393/FJCM8823

ABSTRACT

Cloud computing has fundamentally transformed information storage and enterprise operations, yet this technological shift has exposed critical vulnerabilities in trade secret protection. Corporate data once confined to internal networks now spans global cloud infrastructures, making Cloud Service Providers (CSPs) essential intermediaries in safeguarding proprietary knowledge. The central research problem examined in this study is whether, and to what extent, CSPs can be held legally accountable when third-party actors misappropriate trade secrets by exploiting security gaps, contractual disclaimers, and fragmented regulatory standards.

The primary objective of this research is to critically analyze the liability regime applicable to CSPs in cases of third-party trade secret misappropriation, identifying doctrinal and practical gaps within statutory frameworks, judicial reasoning, and contractual protections. The study employs a comparative doctrinal legal research methodology, examining statutory provisions, case law, and authoritative secondary literature across three key jurisdictions: India, the United States, and the European Union.

The research reveals that India’s reliance on contractual shields and fragmented statutory mechanisms fails to delineate clear CSP responsibilities, particularly where breaches stem from multi-tenant misconfigurations or supply-chain vulnerabilities. In contrast, the United States provides consolidated remedies through the Defend Trade Secrets Act, while the European Union operates a layered framework integrating trade secret law with mandatory cybersecurity duties under GDPR Article 32 and the NIS2 Directive. Across all jurisdictions, evidentiary challenges in establishing “reasonable security,” causation, and attribution significantly complicate accountability determinations.

The study concludes that targeted reforms are essential to address these deficiencies. Key recommendations include enacting a model Indian trade secrets statute incorporating explicit cloud-security benchmarks, implementing legally mandated contractual clauses ensuring audit rights and incident reporting, establishing calibrated safe harbors for CSPs tied to demonstrable security controls, and developing international frameworks to facilitate cross-border evidence recovery. These measures aim to balance innovation with robust trade secret protection in an era where cloud architecture has become indispensable to economic life.

Keywords: Cloud computing, Cloud Service Providers, Contractual liability, Cybersecurity, Intermediary liability, Regulatory fragmentation, Trade secrets