If a corporation is criminally charged while handling privacy data wrongly (assume such a law exists if it does not) in India who is liable? Is it the chairman, deparment of privacy, employees involved, the majority shareholder who financed the company or someone else? Assume the company was not set up just to do illegal activity and the majority shareholder and chairman took reasonable steps to ensure privacy and left the rest to privacy experts and lawyers in the privacy department.
A corporation can be criminally charged, this is not infrequent. If there is a guilty verdict in such a case, the penalty is normally a fine. Not infrequently, there would be a civil case over the same or related conduct, which might result in an injunction or other court order to address future actions and attempt prevent further actions of the same sort.
In some cases, an officer, employee, ort agent of a company may also be criminally charged. This is not automatic by position in the company. For there to be a conviction on any such charge, it must be proved that the person charged had himself or herself actually committed a crime, with the usual element of intent for that crime. That would depend on the exact statute involved and its provisions.
A person who had knowingly or willfully misused data protected under a privacy law would probably be guilty of a crime. Exactly what crime would depend on the country and the specific conduct alleged. Different countries have different laws on such issues, and many countries have several different privacy laws which apply in different situations. Without a more specific hypothetical indicating just what such a person had done, one cannot say just what charges might be valid or what evidence would be needed to establish guilt.
A shareholder would not be guilty of anything just by being a shareholder. Such a person would need to have taken some action in violation of some law to be guilty of any crime.
With reference to Indian law, the case Standard Chartered Bank vs. Directorate of Enforcement decided by the Supreme Court is most relevant. The bank was tried for criminal offenses, violation of the Foreign Exchange Regulation Act, 1973 where violation of §56 is to include a mandatory prison sentence of 6 months to 7 years. The bank argued that they could not be prosecuted because the mandatory prison term cannot be imposed. The courts ruled that
there could be no objection to a company being prosecuted for penal offences under the FERA and the fact that a sentence of imprisonment and fine has to be imposed and no imprisonment can be imposed on a company or an incorporated body
It is impossible to determine who if anyone would be subject to imprisonment, because there is no law in India that authorizes imprisonment for what is generally thought of as a "privacy violation". The Personal Data Protection Bill is a proposal that was tabled. There were no imprisonment penalties imposed by that law, so if the law had been enacted, nobody would go to prison. If a different law had been enacted and the law imposed a prison term on the CEO, then it would be the CEO – it depends on what such a law actually says.