Whistleblowing protections in India
Reviewed by Mellow Editorial Team, HR & payroll content team
Employees who raise concerns about workplace wrongdoing in India have some legal protections, but the framework is fragmented — spread across several statutes rather than consolidated in a single whistleblower law. Employers need to understand what applies to their organisation, and what good practice looks like beyond the legal minimum.
What the law actually covers
India does not have one comprehensive private-sector whistleblower protection law. Protection comes from multiple overlapping sources.
The Whistle Blowers Protection Act, 2014 is the closest thing to a dedicated statute, but its scope is limited. It covers disclosures against central government employees and public servants. Private companies and their employees largely fall outside its reach.
For listed companies and certain other entities, SEBI's framework under the LODR Regulations and the Companies Act, 2013 fills part of the gap. Section 177 of the Companies Act requires eligible companies to establish a vigil mechanism — effectively a whistleblower channel — for directors and employees to report genuine concerns. The audit committee is responsible for overseeing it, and the policy must protect complainants from victimisation.
Employees working in regulated sectors — banking, insurance, capital markets — may also have protections under the rules of their respective regulators.
The four consolidated Labour Codes, operative from 2025, do not create standalone whistleblower protections, but certain provisions around unfair labour practices are relevant if an employee faces retaliation for a protected disclosure.
Who must have a vigil mechanism
Under the Companies Act, a vigil mechanism is mandatory for:
- Listed companies
- Companies that accept deposits from the public
- Companies that have borrowed more than a specified threshold from banks and financial institutions
If your company falls into any of these categories, the policy must be documented, communicated to staff, and the audit committee must be accessible for direct reporting in exceptional cases. Many founders and HR leads treat this as a box-ticking exercise; in practice, the mechanism needs to be credible and used.
Unlisted private companies below the threshold have no statutory obligation, but establishing a clear internal process is still sensible risk management.
What a practical whistleblower policy should include
Whether or not you are legally required to have a policy, the elements that make it work are the same.
A clear reporting channel. Employees need to know where to go — a dedicated email address, an anonymous hotline, or a named officer. The channel should sit outside normal management reporting lines so that a complaint about a line manager does not land back with that manager.
Defined scope. Spell out what kinds of concerns qualify: fraud, corruption, financial misreporting, serious safety violations, legal non-compliance. Avoid making the scope so broad that routine grievances clog the process, or so narrow that genuine concerns fall outside it.
Confidentiality, not anonymity. Most Indian frameworks do not guarantee full anonymity, but they do require confidentiality of the complainant's identity. Your policy should state clearly how identity is protected, who has access to the complaint, and what happens if confidentiality is breached.
No retaliation — with teeth. A policy that says "we will not retaliate" without describing consequences for those who do is not credible. State specifically that victimisation, demotion, harassment or termination linked to a protected disclosure will be treated as a disciplinary matter.
A defined investigation process. Who investigates, within what timeline, and how the complainant is informed of the outcome. Open-ended processes with no feedback discourage future reporting.
Protections and their limits
Even where protections exist, employees face real risks. India has no strong equivalent of the financial rewards available to whistleblowers in the US under statutes like Dodd-Frank. There is no government body dedicated to private-sector whistleblower complaints in the way that SEBI handles securities-related disclosures.
Defamation suits against whistleblowers are a practical concern. A complainant who makes a disclosure that turns out to be incorrect, or that an employer characterises as malicious, can face civil or even criminal liability. The Whistle Blowers Protection Act does provide some protection against this for public-sector disclosures, but private-sector employees have less certainty.
This is part of why good-faith clauses matter in your policy. A well-drafted policy should distinguish between complaints made honestly but incorrectly, and complaints made with intent to harm — and only treat the latter as a disciplinable offence.
What this means for employers
Your obligations depend on your company type and sector. If you are a listed company, a documented vigil mechanism is not optional. If you are a smaller private company, the law may not require one, but the absence of a clear channel creates its own risks — regulatory, reputational and cultural.
The most important thing a policy does is set expectations before an incident occurs. Employees who trust the process are more likely to raise concerns internally rather than going external or staying silent while a problem compounds.
This article is general information only and does not constitute legal advice. If you are setting up or reviewing a whistleblower framework, consult a qualified employment lawyer familiar with your company's sector and structure.
---
Run HR and payroll in India with Mellow
Mellow brings HR, payroll and 12 AI agents into one platform — built to handle India properly, with payroll included, from £4 per employee per month. The AI agents don't just answer questions; they generate contracts, run cost estimates and draft letters for you.
[Start a free trial →](/register)