Blowing the whistle at work — the protection you actually have

An Indian employee who reports corruption, fraud, or wilful misuse of power at the workplace is protected by a regime that is, in practice, four overlapping fragments rather than one statute. The Whistleblowers Protection Act, 2014 was passed by Parliament but the substantive machinery — designation of competent authorities, procedure for disclosure, identity-protection rules — has never been fully brought into force; the Whistleblowers Protection (Amendment) Bill, 2015, which sought to narrow the Act, was introduced but lapsed. The working regime for central public servants is therefore still the 2004 Cabinet Resolution — the Public Interest Disclosure and Protection of Informers (PIDPI) — which designates the Central Vigilance Commission as the receiving authority. For private-sector employees, protection runs through corporate-governance law: Section 177(9) and (10) of the Companies Act, 2013 require a vigil mechanism in every listed company and in certain unlisted classes, and Regulation 22 of the SEBI (LODR) Regulations, 2015 carries the obligation forward for stock-exchange-listed entities. The SEBI (Prohibition of Fraudulent and Unfair Trade Practices) Regulations, 2003 — amended in 2019 — added a separate informant-reward scheme for insider-trading disclosures. The Supreme Court has scaffolded the regime with three decisions — People's Union for Civil Liberties v Union of India, (2004) 2 SCC 476 (the petition that followed the killing of engineer Satyendra Dubey and produced the PIDPI Resolution); Centre for Public Interest Litigation v Union of India, (2011) 4 SCC 1 (CVC appointment); and Indirect Tax Practitioners Association v R K Jain, (2010) 8 SCC 281 (whistleblowing recognised as a legitimate public-interest activity). This guide maps each layer and the joins between them.

Whistleblower protection in India is not a single statute. It is a layered question whose answer turns first on who the whistleblower is — a public servant, a listed-company employee, or a private-sector employee outside a listed entity — and second on what is being disclosed. The Whistleblowers Protection Act, 2014 was enacted on 12 May 2014 but its commencement notification under Section 1(3) has not been issued for the substantive Chapters; the central executive's working position is that the existing PIDPI machinery serves the purpose until the Act is brought into force. For a public servant in a central ministry or central public-sector undertaking, the operative regime is therefore the 2004 PIDPI Resolution administered by the Central Vigilance Commission. For employees in listed companies the operative regime is the corporate-governance vigil mechanism — Section 177(9) read with Section 177(10) of the Companies Act, 2013 and Regulation 22 of the SEBI (LODR) Regulations, 2015. For employees of unlisted private establishments outside these regimes, statutory protection is thin: the remedies are constitutional (Articles 14, 19(1)(a) and 21) and, where retaliation crosses the criminal-law threshold, the Bharatiya Nyaya Sanhita, 2023 and the Bharatiya Nagarik Suraksha Sanhita, 2023. The Supreme Court in R K Jain recognised whistleblowing as a constitutionally protected exercise of the right to free speech; the executive scaffolding under PUCL and Centre for Public Interest Litigation built the institutional architecture. The architecture is the answer; the rest of this guide unpacks the layers.

The law in plain English — four sources, one disclosure

The starting point is who counts as a whistleblower in Indian law. A whistleblower, in the working sense the courts have used, is a person who in the public interest makes a disclosure about corruption, wilful misuse of power or discretion, or the commission of a criminal offence by a public servant or, in the corporate-governance regime, by an officer or employee of a company. The 2014 Act calls the disclosure a "public interest disclosure" (Section 3); the PIDPI Resolution uses the term "complaint"; the Companies Act and SEBI LODR call it a "complaint" routed through the audit committee. The substantive protection in each regime has three parts — receipt of the complaint by a designated authority that is independent of the alleged wrongdoer, protection of the identity of the discloser, and protection of the discloser from retaliation.

First — for a public-servant whistleblower in the central sphere, the operative regime has two parallel tracks. The Whistleblowers Protection Act, 2014 was passed by Parliament; Section 4 of the Act designates the Central Vigilance Commission as the competent authority to receive a public interest disclosure relating to any public servant employed under the Central Government, and Section 4(4) prohibits the disclosure of the identity of the complainant except to the head of the department of the organisation concerned where it is necessary for the inquiry. Section 11 penalises any victimisation of the complainant — Section 11(1) empowers the competent authority to issue appropriate directions to restore the complainant's position, and Section 11(2) prescribes imprisonment up to three years and fine for revealing the identity of the complainant in contravention of Section 4(4). Section 13 of the 2014 Act bars the institution of any prosecution against the complainant for any bona fide disclosure made under the Act, except for an offence under any other law. None of these sections, however, can presently be invoked as the operative source: the central government has not notified the substantive provisions, and the Act is therefore on the statute book without machinery. The High Court in Common Cause v Union of India, W.P.(C) 245 of 2017, and the Supreme Court's standing orders in the PUCL proceedings have left the question of commencement to the executive.

The working regime for central public servants is therefore the 2004 PIDPI Resolution, issued by the Department of Personnel and Training pursuant to the Supreme Court's direction in People's Union for Civil Liberties v Union of India, (2004) 2 SCC 476. The Resolution authorises the Central Vigilance Commission to receive written complaints from any person — not only public servants — alleging corruption or misuse of office by an employee of the Central Government, a corporation established under any Central Act, a government company, or a society or local authority owned or controlled by the Central Government. Paragraph 4 of the Resolution requires the complaint to be sent in a closed and secured envelope superscribed "Complaint under the Public Interest Disclosure" and contain the name and address of the complainant in a separate sheet; the CVC keeps the identity of the complainant confidential, and any administrative action against the complainant by way of victimisation can be referred to the CVC for restoration. Several states — Bihar, Karnataka, Maharashtra — have issued similar resolutions designating their State Vigilance Commissions as the receiving authority for state public servants.

Second — for an employee of a listed company, the operative regime is the corporate-governance vigil mechanism under the Companies Act, 2013 read with the SEBI Listing Obligations and Disclosure Requirements Regulations, 2015. Section 177(9) of the Companies Act requires every listed company, and every other class of companies prescribed by rules (companies that have accepted deposits from the public; companies that have borrowed money from banks and financial institutions in excess of fifty crore rupees), to establish a vigil mechanism for directors and employees to report genuine concerns. Section 177(10) requires the vigil mechanism to provide for adequate safeguards against victimisation of persons who use such mechanism and to make provision for direct access to the chairperson of the audit committee in appropriate or exceptional cases. Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014 fleshes out the mechanism — the audit committee is the receiving body, the chairperson of the audit committee is the alternate route, and the details of the mechanism must be disclosed on the company's website and in the Board's report. Regulation 22 of the SEBI (LODR) Regulations, 2015 carries the obligation forward for stock-exchange-listed entities and adds the further requirement that the policy be disclosed in the corporate governance section of the annual report.

Third — for a person disclosing securities-market wrongdoing, particularly insider trading, the regime is the SEBI (Prohibition of Insider Trading) Regulations, 2015 read with the SEBI (Prohibition of Fraudulent and Unfair Trade Practices) Regulations, 2003 as amended in 2019. The 2019 amendment introduced the Informant Mechanism — Chapter IIIA of the PIT Regulations — under which a person providing original information about insider trading to SEBI may be entitled to a reward of up to ten per cent of the monetary sanctions collected, capped at ten crore rupees. The mechanism preserves the informant's confidentiality through the Office of Informant Protection within SEBI; it is the only Indian regime that combines protection with a monetary incentive.

Fourth — sector-specific regimes overlay the above. The Reserve Bank of India's Master Direction on Cyber Security Framework in Banks (2016) and the related Directions on Internal Audit require banks to maintain whistleblower mechanisms for reporting cyber incidents and internal frauds. The Insurance Regulatory and Development Authority of India's Corporate Governance Guidelines for Insurers (2016) carry an analogous vigil-mechanism requirement for insurance companies. The Pension Fund Regulatory and Development Authority and the Telecom Regulatory Authority of India have issued similar circulars for the regulated entities in their respective sectors.

The 2014 Act — what was enacted and what is in force

The Whistleblowers Protection Act, 2014 received Presidential assent on 9 May 2014. Its Long Title states the object as establishing a mechanism to receive complaints relating to disclosure on any allegation of corruption or wilful misuse of power or wilful misuse of discretion against any public servant, and to inquire or cause an inquiry into such disclosure and to provide adequate safeguards against victimisation of the person making such complaint. Section 1(3) provides that the Act shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint. The central executive issued a partial notification commencing the Act for the limited purpose of constituting rules and machinery, but the substantive provisions — Sections 4 to 11 in particular, which are the operative core — have not been notified.

Section 3 of the Act defines a public interest disclosure as a complaint relating to (a) an attempt to commit or commission of an offence under the Prevention of Corruption Act, 1988 by a public servant; (b) wilful misuse of power or wilful misuse of discretion by virtue of which a demonstrable wrongful gain has been caused or a demonstrable wrongful loss is likely to be caused; or (c) attempt to commit or commission of a criminal offence by a public servant. Section 4 designates the Central Vigilance Commission as the competent authority for disclosures relating to public servants under the Central Government and the State Vigilance Commission, where constituted, for state public servants. Section 4(4) prohibits the competent authority from disclosing the identity of the complainant — the protection is statutory and not contractual, and contravention attracts the criminal penalty in Section 11(2).

Section 5 sets out the procedure for inquiry — the competent authority is to make a discreet inquiry to ascertain whether there is any basis for proceeding further; if there is, it may seek a report from the head of the department concerned. Section 6 empowers the competent authority to recommend appropriate action, including disciplinary action, criminal proceedings, or corrective measures. Section 11 provides for penalty for victimisation — if any person is being victimised or is likely to be victimised on the ground of having made a public interest disclosure, the competent authority can issue directions to the public authority concerned to protect the person and to take steps to restore the complainant's position. Section 13 bars institution of proceedings for any bona fide disclosure made under the Act, providing the substantive immunity that is the essential core of any whistleblower regime.

The 2014 Act has several acknowledged limitations. It does not cover the private sector. It does not cover disclosures relating to the armed forces or to intelligence agencies (Section 4(1) carves these out). It does not provide for a monetary reward to the whistleblower. The Whistleblowers Protection (Amendment) Bill, 2015 — introduced by the Government in the Lok Sabha — sought to narrow the Act further by prohibiting disclosure of information that would prejudicially affect the sovereignty and integrity of India, the security of the State, commercial confidence, intellectual property, or that was received in a fiduciary relationship. The Bill lapsed on the dissolution of the 16th Lok Sabha. The current legal position therefore is that the 2014 Act sits on the statute book with most of its operative machinery dormant.

The PIDPI Resolution — the live executive scheme

The Public Interest Disclosure and Protection of Informers Resolution, 2004 (Resolution No. 89 of 21 April 2004) is the executive scheme that fills the vacuum left by the non-commencement of the 2014 Act. The Resolution was issued by the Department of Personnel and Training pursuant to the Supreme Court's direction in People's Union for Civil Liberties v Union of India, (2004) 2 SCC 476, the petition that followed the murder of Satyendra Dubey — a National Highways Authority of India project director who had written to the Prime Minister's Office about corruption in the Golden Quadrilateral highway project and was killed in Gaya in November 2003.

The PIDPI Resolution designates the Central Vigilance Commission as the receiving authority for written complaints alleging corruption or misuse of office by an employee of the Central Government, a corporation established by or under any Central Act, a government company, or a society or local authority owned or controlled by the Central Government. The procedure prescribed in the Resolution is precise: the complaint is to be in a closed and secured envelope; the envelope is to be addressed to the Secretary, Central Vigilance Commission, Satarkata Bhawan, New Delhi; the envelope is to be superscribed "Complaint under the Public Interest Disclosure"; the name and address of the complainant are to be contained in the beginning or the end of the complaint or in a separate enclosed envelope; the complainant is not to use the official designation or contact details of the person whose conduct is being inquired into.

The CVC, on receipt, conducts a discreet inquiry. If the inquiry discloses material warranting further action, the CVC may seek a report from the head of the organisation concerned. The Resolution explicitly preserves the confidentiality of the identity of the complainant — paragraph 6 directs that the identity be revealed only if the CVC considers it absolutely necessary or the complainant has himself disclosed his identity. Paragraph 7 confers on the CVC the power to recommend appropriate action against the public servant who has victimised or threatens to victimise the complainant. Several state governments — including Maharashtra (State Vigilance Commission Resolution 2006), Karnataka, Andhra Pradesh, Madhya Pradesh, and Bihar — have adopted parallel resolutions designating their State Vigilance Commissions as the receiving authority for state public servants.

The Supreme Court's role in scaffolding the regime is twofold. Vineet Narain v Union of India, (1998) 1 SCC 226 established the statutory status of the Central Vigilance Commission and the principle that the investigating agencies should be insulated from executive control. Centre for Public Interest Litigation v Union of India, (2011) 4 SCC 1 set aside the appointment of the Central Vigilance Commissioner P J Thomas, holding that the appointing committee's decision under Section 4 of the Central Vigilance Commission Act, 2003 must be made on the basis of the institutional integrity of the office; the case effectively elevated the standard for the appointment of the receiving authority for whistleblower complaints.

Companies Act vigil mechanism — listed-company employees

The corporate-governance regime is the operative protection for a private-sector employee in a listed company or in a large unlisted company that falls within the rule-prescribed classes. Section 177(9) of the Companies Act, 2013 mandates that every listed company and every other company belonging to such class or classes of companies as may be prescribed shall establish a vigil mechanism for directors and employees to report genuine concerns in such manner as may be prescribed. Section 177(10) requires the vigil mechanism to provide for adequate safeguards against victimisation of persons who use such mechanism and to make provision for direct access to the chairperson of the audit committee in appropriate or exceptional cases.

Rule 7 of the Companies (Meetings of Board and its Powers) Rules, 2014 specifies the categories of unlisted companies that must establish a vigil mechanism: companies that accept deposits from the public, and companies that have borrowed money from banks and public financial institutions in excess of fifty crore rupees. The Rule prescribes that the audit committee is the receiving body; the policy is to be reviewed by the Board; the policy is to be disclosed on the company's website and in the Board's report; and any person who uses the mechanism in bad faith or against any individual is liable to disciplinary action.

Regulation 22 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 carries the obligation forward for stock-exchange-listed entities. The Regulation requires the listed entity to formulate a vigil mechanism for directors and employees to report genuine concerns; the mechanism must provide for adequate safeguards against victimisation of director(s) or employee(s) or any other person who avail the mechanism; and the mechanism must also provide for direct access to the chairperson of the audit committee in appropriate or exceptional cases. The details of the vigil mechanism are to be disclosed by the listed entity on its website and in the Board's report. Regulation 4(2)(d)(iv) of the LODR carries forward the broader principle that the board of directors of a listed entity should ensure that the rights of stakeholders are protected, including their right to be free from retaliation in respect of legitimate disclosures.

The corporate-governance regime carries a substantive penalty for a director or officer who fails to comply — Section 178(8) of the Companies Act, 2013 attracts a fine, and persistent default attracts proceedings under Chapter XXIX of the Act including fraud-related action under Section 447. Where the alleged wrongdoing constitutes fraud on the company, the auditor's reporting obligation under Section 143(12) is independently triggered, and a vigil-mechanism disclosure that is suppressed may itself become evidence of a violation of the Companies Act.

SEBI informant mechanism — the only reward-based scheme

The SEBI (Prohibition of Insider Trading) Regulations, 2015 were amended in 2019 to introduce Chapter IIIA — Informant Mechanism — which provides a structured route for any person to disclose original information regarding insider trading. The mechanism carries three features that distinguish it from the other Indian whistleblower regimes. First, the disclosure is to be made through a Voluntary Information Disclosure Form filed with the Office of Informant Protection within SEBI; the OIP is the only India-side equivalent of the SEC Whistleblower Office under the Dodd-Frank framework. Second, the identity of the informant is protected through a system of anonymised case numbers and through the OIP's procedural firewall — the investigating wing of SEBI does not receive the informant's identity. Third, the informant is eligible for a reward of up to ten per cent of the monetary sanctions collected in the case, subject to a cap of ten crore rupees and to the discharge of the requirements in Regulation 7B (originality of information, voluntariness, material contribution to the case).

The SEBI (Prohibition of Fraudulent and Unfair Trade Practices) Regulations, 2003 — which along with the PIT Regulations form the substantive securities-fraud regime — operate in parallel; an informant whose information leads to a successful action under the PFUTP Regulations is similarly eligible for the protection and reward. The mechanism is operative — SEBI's annual reports for 2023-24 record several investigations sourced from informant disclosures, although the reward payouts have so far remained modest.

Step by step — making the disclosure

For a public servant in the central sphere with a complaint of corruption or wilful misuse of power, the operating procedure is the PIDPI route. The complainant prepares the complaint in writing, addressed to the Secretary, Central Vigilance Commission; the complaint is placed in a closed envelope; the complainant's name and address are placed in a separate sheet at the beginning or end of the complaint or in a separate inner envelope; the outer envelope is superscribed "Complaint under the Public Interest Disclosure"; the complaint is sent by post or by hand to the CVC. The CVC's standing instructions on the PIDPI route — available on the CVC website — emphasise that the complaint must contain verifiable facts and not vague allegations; that the complaint must relate to a specific public servant and a specific instance of alleged corruption; and that the complaint must not be a vehicle for a personal grievance or a service-conditions dispute. The CVC's discreet inquiry under the Resolution is the first stage; the inquiry may, on prima facie material, be referred to the CBI under Section 8 of the Central Vigilance Commission Act, 2003 or to the head of the department concerned for departmental inquiry.

For an employee of a listed company with a concern about an officer or employee of the company, the operating procedure is the vigil-mechanism route. The first step is to consult the company's vigil-mechanism policy — which the company is required by Regulation 22 of the LODR to publish on its website. The policy specifies the receiving authority (typically the chief audit executive or the ethics officer), the form of the complaint, the procedure for direct access to the audit-committee chairperson in exceptional cases, and the timeline for inquiry. The complainant submits the complaint in the prescribed form; the audit committee considers the complaint and, where prima facie made out, refers it for inquiry; the audit committee reports the outcome to the board. Where the vigil-mechanism inquiry is suppressed or the complainant is victimised, the remedy is a complaint to SEBI under the LODR enforcement regime, or to the Ministry of Corporate Affairs under Section 178 of the Companies Act, or, in cases involving fraud, to the Serious Fraud Investigation Office.

For an informant disclosing insider trading or PFUTP violations, the SEBI Voluntary Information Disclosure Form is filed with the Office of Informant Protection; the form requires the informant to set out the original information, the basis for the informant's knowledge, the persons involved, and the analytical or documentary support for the disclosure. The OIP processes the form and, on the basis of preliminary scrutiny, refers the matter to the investigating wing through an anonymised case number.

Where things go wrong — three recurring failures

The first failure is procedural — the complainant fails to follow the PIDPI form requirements (separate envelope, superscription, identity in a separate sheet) and the complaint is treated by the CVC as an ordinary complaint without confidentiality protection. Once the complaint is in the ordinary stream, the identity may be disclosed to the department of the alleged wrongdoer in the course of the inquiry, and the substantive protection of the PIDPI route is lost. The CVC's standing position is that strict compliance with the procedural form is a precondition to the protection.

The second failure is institutional — the listed-company vigil mechanism is on paper but is captured by the management. The audit committee that receives the complaint is constituted of directors who are themselves close to the management; the inquiry is conducted by an internal officer who reports to the management; the outcome is closed without action. The Supreme Court has not yet adjudicated a vigil-mechanism capture case directly, but SEBI's enforcement actions under the LODR for non-disclosure of the vigil-mechanism policy and for victimisation in the vigil-mechanism context have begun to develop a doctrinal floor. The remedy in a capture case is a complaint to SEBI under the LODR regime or to the Ministry of Corporate Affairs under Section 178 of the Companies Act; in cases of fraud, the alternative route is a complaint to the Serious Fraud Investigation Office under Section 212 of the Companies Act.

The third failure is retaliation that crosses the criminal-law threshold. The whistleblower who is dismissed, transferred to a remote posting, or threatened — the trajectory that the Satyendra Dubey case illustrates in its most extreme form — has remedies under the Bharatiya Nyaya Sanhita, 2023. Section 314 of the BNS [Section 405 IPC] on criminal breach of trust may apply where the retaliating officer has used official position to cause loss. Section 197 of the BNS [Section 153A IPC] on promotion of enmity may, in narrow circumstances, apply. The first information report under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 [Section 154 CrPC] is the entry point. The constitutional overlay — Article 21 read with Article 14 — supports a writ petition under Article 226 against the public-authority retaliator; the Supreme Court in Indirect Tax Practitioners Association v R K Jain, (2010) 8 SCC 281 recognised whistleblowing as a constitutionally protected exercise of the right to free speech and expression, and the line of cases on right to livelihood under Article 21 — from Olga Tellis v Bombay Municipal Corporation, (1985) 3 SCC 545 onwards — supports the proposition that retaliatory dismissal of a whistleblower violates Article 21.

Watch for — the unresolved questions

Four unresolved questions presently sit in the case-pending list at the High Courts and the Supreme Court.

The first is the commencement of the 2014 Act. Public-interest litigation has been pending for several years seeking a direction to the Central Government to notify the substantive provisions of the Act. The government's standing position is that the PIDPI Resolution adequately serves the purpose and that the Act needs to be amended (per the lapsed 2015 Amendment Bill) before commencement. The court has so far declined to issue a writ of mandamus, treating the question of commencement as one of executive discretion under Section 1(3).

The second is the protection of private-sector whistleblowers outside the listed-company regime. An employee of an unlisted private company who reports fraud or wrongdoing has no statutory whistleblower protection in India; the remedy is at best a wrongful-termination suit on the contract of employment, or a writ petition where the retaliating employer is amenable to writ jurisdiction (a question that itself turns on the public-function test). The Law Commission's 179th Report (2001) and the Parliamentary Standing Committee's 47th Report (2008) had recommended that the protection be extended to the private sector; the recommendation remains unimplemented.

The third is the relationship between the PIDPI route and the Right to Information Act, 2005. A whistleblower who has used the RTI route to gather information that grounds the disclosure may find that the RTI application has revealed the identity to the public authority, undercutting the PIDPI confidentiality. The standing CIC guidance is that RTI requests for information relating to corruption inquiries can be processed under Section 8(1)(j) of the RTI Act; the relationship has not been adjudicated by the Supreme Court.

The fourth is the scope of the SEBI informant mechanism. The mechanism is presently confined to insider trading and PFUTP violations; SEBI has indicated, through its consultation papers, an intention to extend the mechanism to disclosure of accounting fraud and to violations of the SEBI (Substantial Acquisition of Shares and Takeovers) Regulations, 2011. The extension has not yet been formalised.

Outcome — what the architecture produces

The four-layer architecture produces a hierarchy of practical outcomes. A central public servant who follows the PIDPI route, gets the form right, and produces verifiable facts is afforded confidentiality and, where victimisation occurs, the prospect of CVC-led restoration; this is the strongest route presently available in India. A listed-company employee who uses the vigil mechanism is afforded the corporate-governance protection — direct audit-committee access, board-level oversight, and SEBI-side enforcement — but is exposed to the risk of mechanism capture. An informant who provides original information about insider trading to SEBI is afforded confidentiality through the Office of Informant Protection and a monetary reward; the mechanism is the only reward-based whistleblower scheme in India. An employee of an unlisted private establishment with a non-securities-fraud complaint is, as a matter of practical reality, outside the protective regime; the remedies are constitutional and contractual rather than statutory-whistleblower.

The practical lesson for the discloser is that the choice of route is the choice of protection, and the choice of route is dictated by the discloser's institutional location and the nature of the disclosure. A public servant complaining about a colleague's corruption uses PIDPI; a listed-company employee complaining about her chief financial officer uses the vigil mechanism; an informant with original insider-trading information uses the SEBI Voluntary Information Disclosure Form. Routing the disclosure through the wrong channel — sending a Companies Act complaint to the CVC, or an insider-trading complaint to the audit committee of the wrongdoer's employer — loses the protection.

The institutional architecture is therefore partial — strongest for central public servants under PIDPI, structured but capturable for listed-company employees under Section 177 and Regulation 22, reward-based but narrow for SEBI informants, and effectively absent for private-sector employees outside the listed perimeter. The 2014 Act, if and when its substantive provisions are notified and the regime is extended to the private sector, will fill the largest gap. Until then, the operating manual is the layered patchwork mapped above — PIDPI for public servants, Section 177 and Regulation 22 for listed-company employees, the SEBI informant mechanism for securities-fraud disclosures, and the constitutional and criminal-law remedies for the residual cases.