Buying a speak-up channel? Test it against the law first

Section 177(9) of the Companies Act, read with rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014, requires every listed company, every company that accepts deposits from the public and every company that has borrowed more than ₹50 crore from banks and public financial institutions to establish a vigil mechanism for directors and employees. It must provide adequate safeguards against victimisation and direct access to the chair of the audit committee, or to the director nominated to play that role, in appropriate or exceptional cases, and it must be disclosed on the company's website, if any, and in the Board's report.

For listed entities not exempted under Regulation 15(2), SEBI's Listing Regulations go further. Regulation 22 extends the safeguards to "director(s) or employee(s) or any other person" who uses the mechanism. Regulation 4(2)(d)(iv) expects stakeholders, including employees and their representative bodies, to be able to raise concerns freely. The audit committee must review how the mechanism functions, and Regulation 46 requires it to be described on the website.

Complaints of sexual harassment follow a separate law. Under the POSH Act, 2013 they go to the employer's Internal Committee, or to the Local Committee where there are fewer than ten workers or the complaint is against the employer, which must complete its inquiry within 90 days; the employer must act on the Committee's recommendations within 60 days of receiving them; and the Act's confidentiality rule applies despite the Right to Information Act.

What the audit committee is expected to do

Rule 7 says more than who must have a vigil mechanism. Where a company must have an audit committee, the committee oversees the mechanism, and a member with a conflict of interest in a case must recuse, leaving the others to deal with it. Other companies must nominate a director to play that role. For listed entities, the audit committee's role under Part C of Schedule II to the Listing Regulations includes reviewing the functioning of the whistle blower mechanism, and reviewing the findings of internal investigations by the internal auditors into suspected fraud, irregularity or a material failure of internal control, and reporting the matter to the board. The corporate governance report must describe the mechanism and affirm that no personnel has been denied access to the audit committee. Entities that have only non-convertible debt listed, with ₹5,000 crore or more outstanding, the "high value debt listed entities", carry the same vigil mechanism duty under Regulation 62J.

Rule 7(5) lets the audit committee, or the nominated director, take suitable action, including a reprimand, against a director or employee who files repeated frivolous complaints. The POSH Act draws the line differently. Action for a malicious or knowingly false complaint is possible, but a mere inability to substantiate a complaint need not attract action, and malice must first be established through an inquiry. A platform that records only "closed" cannot help the committee tell these apart. It needs outcome categories that separate substantiated, unsubstantiated and malicious reports.

The POSH clock

The POSH Act's time limits each leave a date to record. A complaint is due within three months of the incident, or of the last incident in a series, and the committee may extend that by up to three months for reasons recorded in writing. Committee members must help a woman who cannot put her complaint in writing. The inquiry must be completed within 90 days, the report of findings must reach the employer within ten days of its completion, and the employer must act within 60 days of receiving the recommendations.

Reporting follows. The Internal Committee prepares an annual report each calendar year for the employer and the District Officer. The employer must include the number of cases filed and their disposal in its own annual report, or tell the District Officer where it does not prepare one. Listed entities not exempted under Regulation 15(2) also disclose complaints filed, disposed of and pending at the year end in the corporate governance report. An employer that fails to constitute an Internal Committee, or to act under sections 13, 14 and 22, faces a fine of up to ₹50,000; a repeat conviction can bring twice the punishment and the cancellation of a licence or registration.

Data protection has a date

The Digital Personal Data Protection Rules were notified on 13 November 2025 and come into force in stages. The provisions on the Data Protection Board applied at once, consent-manager registration follows a year later, and the main obligations on data fiduciaries, among them notice, consent, security safeguards, breach intimation and the rights of data principals, apply from May 2027. A speak-up platform holds some of the most sensitive personal data a company keeps: the reporter's identity, the allegations and the names of the people accused. The vendor will usually process that data on the company's behalf, so the contract, the hosting, access rights and retention periods need to be settled before May 2027, not after.

Questions to put to any platform

• Can a reporter stay anonymous and still answer the investigator's follow-up questions?
• Can a concern about senior management reach the audit committee chair directly?
• Do POSH complaints go only to the Internal Committee, with the reporter's identity restricted to its members and the Act's timelines tracked?
• Can vendors, dealers, contract staff and other outsiders use the channel, as Regulation 22's wider protection contemplates?
• Does it work in the languages your workforce speaks, including by toll-free voice for people who do not use a computer?
• Who at the vendor can see your data, where is it hosted, and is the design aligned with the DPDP Act, whose main obligations apply from May 2027?
• Does every action leave an audit trail that the audit committee can review?
• Who investigates when your own team is conflicted or stretched?
• Can it produce the numbers the law asks for without manual counting: POSH cases filed and disposed of, and complaints pending at the year end?
• Can it give the statutory auditor a list of the whistle-blower complaints received in the year? The Companies (Auditor's Report) Order, 2020 asks the auditor to state whether it has considered them.

A speak-up channel is judged on the day a report about someone senior arrives. Test it for that day.

Where platforms differ

In October 2026 BDI used AI to assess Whistle Sentinel and five leading global speak-up platforms against 13 capabilities, using each vendor's public information. Most of the platforms assessed handle intake, anonymous dialogue and case management well. The gaps clustered around the case: only one of the five offered co-sourced investigation support in full, one offered sensitisation workshops in full, and none was assessed as fully designed for India's DPDP Act alongside GDPR. Those are the rows to test hardest.