OPINION | Disclosure requirements under India’s commercial laws are tricky to navigate

-

Viral Mehta

Companies routinely manage sensitive information related to clients, employees, or their own operations, facing the challenging task of balancing conflicting legal obligations.

Some laws require transparency by mandating disclosures, while others demand privacy by protecting certain information from disclosure. For instance, corporate and securities laws generally impose duties to disclose material company information, aiming to keep stakeholders well-informed. At the same time, data privacy laws and evidentiary rules seek to safeguard personal data and privileged communications from compelled disclosure. Navigating this fine line between transparency and confidentiality presents a significant organisational challenge.

Disclosure needs are pervasive in corporate and securities law

The obligation to disclose specific information is pervasive in corporate and securities law. These requirements rest on the premise that making relevant information public enables stakeholders to make better decisions. In the realm of publicly traded securities, such disclosures help reduce information asymmetry, contributing to fairer asset prices when buyers and sellers trade with equal access to data. Furthermore, mandatory disclosures serve to detect and deter corporate misconduct, fostering trust in the markets. Consequently, these laws are crafted to ensure that material events or circumstances involving a company are disclosed promptly and regularly, maintaining transparency.

DPDP prioritises confidentiality

Conversely, certain laws cast a duty to withhold specific information to preserve its confidentiality. India’s data privacy law, the Digital Personal Data Protection Act, 2023, exemplifies this approach. It was operationalised with the notification of the Digital Personal Data Protection Rules, 2025, a few days ago. The law is designed to protect the digital personal data of Indian individuals by requiring organisations to implement safeguards against misuse.

Evidence law safeguards attorney-client privilege

Similarly, the attorney-client privilege, embedded in evidence law, shields confidential communications between clients and their attorneys from compelled disclosure.

This privilege encourages clients to seek legal advice freely and frankly, without fear of disclosure. It is based on the dual belief that, to provide proper advice, an attorney must have complete knowledge of the facts—both good and bad—and that only when fully informed can an attorney provide sound legal counsel, thereby serving the interests of justice.

India’s evidence law, the Bharatiya Sakshya Adhiniyam, codifies this privilege, prohibiting advocates from revealing any client communications made while seeking legal advice, as well as the legal advice provided, unless the client consents. The Supreme Court of India has recently affirmed that this provision not only shields clients but also protects attorneys from being compelled to disclose privileged information.

Disclosure is not a mechanical process

Determining whether a particular communication is subject to disclosure or confidentiality can be complex. For example, consider a company conducting an internal investigation into suspected fraud by its employees. Should the company uncover evidence of wrongdoing, it may be duty-bound to report it to regulators. Once regulatory authorities are involved, the company must cooperate by sharing relevant information to facilitate a fair investigation and appropriate remedial actions.

However, communications with attorneys during the investigation typically enjoys confidentiality. This means the company can obligate its attorneys to keep those communications confidential, but it cannot indiscriminately shield all investigation-related communications. Usually, only communications relating to legal advice sought from attorneys are protected; business or non-legal communications are not. Therefore, the context and nature of the information determine whether confidentiality applies, or disclosure is mandated.

Examples in India’s commercial laws highlight real-world complexities

The situation becomes even more complicated because laws often specify categories of information that must or must not be disclosed without offering a comprehensive definition. For instance, India’s insider trading law prohibits insiders possessing unpublished price sensitive information (UPSI) from disclosing it to others. UPSI is defined as events or circumstances related to a company or its publicly traded securities that, once made generally available, are likely to materially affect the price of those securities. The law offers a tentative list of UPSI, including events such as financial results, changes in capital structure, defaults, or fraud. However, this list is not exhaustive, leading to interpretative ambiguities regarding what qualifies as UPSI.

Notably, the Securities and Exchange Board of India (SEBI) recently considered an order passed by the Central Electricity Regulatory Commission, a governmental authority, as UPSI. Adopting such an expansive and unusual view, SEBI issued an interim order against eight individuals for illegal insider trading in the scrip of India’s leading power exchange, Indian Energy Exchange.

Last year, India’s competition law introduced the term “commercially sensitive information” (CSI), which raised similar interpretative challenges. Since CSI was not explicitly defined in the law, its scope remained uncertain. In May this year, the Competition Commission of India offered an indicative list of what qualifies and does not qualify as CSI. However, as this list is not exhaustive, uncertainties persist regarding its full scope. These ambiguities highlight the tension between transparency and confidentiality faced by organisations and the necessity for careful legal interpretation, since misjudging what information must be disclosed or kept confidential can result in serious consequences, including fines, liabilities, and reputational harm.

Viral Mehta is Private Equity & M&A Practice Head, Nishith Desai Associates. Views are personal and do not represent the stand of this publication.