Regulatory compliance advisory
A compliance framework with named owners, evidence and regular reporting, ready for the regulator's question before it is asked.
Vigil mechanism under Companies Act s.177, SEBI LODR, and DPDP Act 2023 readiness.
New laws, listings and regulators' questions all ask the same thing: can you show that you comply? The answer depends less on policies than on owners, evidence and reporting.
We set up and review the vigil mechanism that listed and other prescribed companies must have under the Companies Act and SEBI's listing regulations. We prepare organisations for the Digital Personal Data Protection Act, 2023 and its 2025 Rules, from data inventories and notices to security safeguards and breach response. Compliance calendars map each obligation to an owner and a date.
Board and audit committee reporting closes the loop, so directors can see what is being done and where the gaps are. Where Whistle Sentinel is in use, the vigil mechanism and its reporting run on one platform.
A new law, a listing or a regulator's question requires you to demonstrate compliance.
Signs we see most often
- 01You are preparing to list, raise funds or enter a regulated sector.
- 02The DPDP compliance date is approaching and your data inventory is incomplete.
- 03Your vigil mechanism exists on paper but receives few reports or little oversight.
- 04Obligations are tracked in spreadsheets with no clear owners.
- 05A regulator or auditor has asked for evidence of compliance.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01MapList the laws and regulations that apply, and the obligations under each.
- 02AssignGive every obligation an owner, a frequency and the evidence it requires.
- 03AssessTest current practice against each obligation and record the gaps.
- 04BuildClose gaps with the policies, processes, vigil mechanism or DPDP controls required.
- 05TrackRun a compliance calendar with reminders and evidence.
- 06ReportGive the board and audit committee regular compliance reporting.
A compliance framework with named owners, evidence and regular reporting.
- A compliance obligations register with owners
- A vigil mechanism policy and operating procedure
- A DPDP readiness assessment and roadmap
- A compliance calendar
- A reporting pack for the board and audit committee
The law and frameworks this work is aligned to
- Companies Act, 2013 s.177 vigil mechanism
- SEBI LODR Regs. 18 and 22
- DPDP Act, 2023 and the DPDP Rules, 2025
- Aligned to ISO 37301 compliance management systems
- Aligned to ISO 37002 whistleblowing management systems
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerWhere this service meets BDI's technology.
The platforms below record, monitor or act on the work this service produces.
Questions clients ask before we start.
Who needs a vigil mechanism?
Listed companies, and companies that accept deposits from the public or have borrowed more than ₹50 crore from banks and public financial institutions, under the Companies Act and its rules. Listed entities must also meet SEBI LODR Reg. 22.
When do the DPDP obligations apply?
The DPDP Rules were notified on 13 November 2025. Most obligations on data fiduciaries, including notice, security safeguards and breach notification, apply eighteen months later, from May 2027.
Can you act as our compliance function?
We support your compliance team with design, testing and reporting. Accountability for compliance stays with the organisation and its board.