Citing Section 43A of Indian IT Act, Johri said the companies may have to shell out as much as Rs 5 crore in case of a data breach.