A whistleblower policy tells employees, directors and often vendors how to report suspected fraud, bribery, data leaks or other serious wrongdoing, who will investigate, and how the person reporting is protected from retaliation. For listed companies and some others it is a legal requirement called a vigil mechanism; for everyone else it is the reporting channel that makes a code of conduct credible.

Who must have one

Section 177(9) of the Companies Act, 2013, read with Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014, requires a vigil mechanism in three kinds of company:

• Every listed company
• Companies that accept deposits from the public
• Companies that have borrowed more than Rs 50 crore from banks and public financial institutions

Where the company must have an audit committee, that committee oversees the mechanism. Otherwise the board nominates a director to play that role. Section 177(10) requires safeguards against victimisation, direct access to the audit committee chairperson (or the nominated director) in exceptional cases, and disclosure of the mechanism on the company’s website, if any, and in the board’s report. Listed entities have a parallel duty under Regulation 22 of SEBI’s LODR Regulations, and the insider trading regulations add a duty to let employees report leaks of unpublished price-sensitive information.

India’s Whistle Blowers Protection Act, 2014 covers complaints against public servants and has not been brought into force, so it does nothing for private-sector staff. For them, the protection is only what the company’s own policy promises.

What a private company’s policy should cover

1. Scope: fraud, bribery, false accounts, data misuse, safety violations. Sexual harassment complaints go to the Internal Committee under POSH, and routine pay or shift complaints to grievance redressal.
2. Channels: at least one route that bypasses line management, such as a dedicated email, an ethics hotline run by a third party, or direct access to the audit committee chair.
3. Anonymity and confidentiality: accept anonymous reports, and restrict the reporter’s identity to the investigator on a need-to-know basis.
4. Non-retaliation: state that demotion, transfer, poor ratings or termination linked to a good-faith report is itself misconduct.
5. Investigation: who investigates, recusal where someone is conflicted, target timelines and how the reporter is told the outcome.
6. Bad-faith reports: Rule 7 lets the committee act, including by reprimand, against a person who repeatedly makes frivolous complaints.

Frequently asked questions

Does a small private limited company need a whistleblower policy?

Not by law unless it takes public deposits or crosses the Rs 50 crore borrowing line. Investors and large customers often ask for one in due diligence, so many startups adopt a short version alongside the employee handbook.

Can an anonymous complaint be investigated properly?

Yes, if it gives checkable facts such as dates, invoices or approvers. A third-party hotline that allows follow-up questions without revealing the reporter helps.

How do we prove we did not retaliate?

Keep the reporter’s appraisal, transfer and exit decisions under a second review for a period after the report, and document the business reasons. The HR case management record is your evidence if the decision is challenged.

Audit how concerns are currently raised and logged with an HR audit before drafting the policy.