The concept of confidentiality occupies a central position in securities law and corporate governance. In the modern regulatory framework, protection of unpublished price sensitive information (“UPSI”) is not merely a procedural compliance requirement but a fundamental obligation imposed upon listed entities, insiders, and connected persons. The increasing regulatory scrutiny by the Securities and Exchange Board of India (“SEBI”) in matters relating to insider trading and information asymmetry has made the issue of leakage of UPSI one of the most sensitive governance concerns for listed companies in India.

Under the SEBI (Prohibition of Insider Trading) Regulations, 2015 (“PIT Regulations”), UPSI generally refers to information relating to a company or its securities which is not generally available and which, upon becoming publicly available, is likely to materially affect the price of securities. Such information may include unpublished financial results, proposed mergers or acquisitions, changes in capital structure, dividends, expansion plans, changes in key managerial personnel, or any other material event capable of influencing investor decisions and market behaviour.

The underlying principle behind the PIT Regulations is that no person should gain an unfair advantage in the securities market by virtue of access to confidential corporate information. Accordingly, the regulations impose strict obligations regarding communication, sharing, handling, and preservation of UPSI. However, despite elaborate compliance structures, instances involving leak or suspected leak of UPSI continue to surface, often exposing companies to serious reputational and regulatory consequences.

A leak of UPSI essentially occurs when confidential price sensitive information is disclosed, communicated, circulated, accessed, or disseminated to unauthorized persons before such information becomes generally available to the public through legitimate disclosure mechanisms. Such leakage may occur deliberately, negligently, informally, or even accidentally. Importantly, the existence of insider trading is not necessary for SEBI to initiate scrutiny. Mere unauthorized dissemination of UPSI may itself constitute a serious compliance breach under the PIT Regulations.

In practical scenarios, leakage of UPSI may arise in several forms. Financial results may be informally shared before disclosure to stock exchanges; details relating to proposed acquisitions or restructuring exercises may circulate among intermediaries or external advisors without adequate confidentiality controls; unpublished board decisions may be discussed with analysts, investors, or market participants; or confidential documents may be transmitted through unsecured communication platforms. In the digital era, where information travels instantly through emails, messaging applications, and virtual communication channels, the risk associated with uncontrolled dissemination of sensitive information has significantly increased.

Recognizing the seriousness of such situations, Regulation 3 of the PIT Regulations expressly prohibits communication or procurement of UPSI except for legitimate purposes, performance of duties, or discharge of legal obligations. The regulatory expectation is not confined merely to prevention of insider trading transactions but extends to maintenance of complete confidentiality architecture within the organization. SEBI has repeatedly emphasized that listed companies are expected to establish effective internal controls, structured digital databases, access restrictions, and monitoring systems to prevent unauthorized sharing of sensitive information.

One of the most significant developments in this regard is Regulation 3(5) of the PIT Regulations, which mandates every listed company to formulate a written policy and procedure for inquiry in case of leak or suspected leak of UPSI. This requirement reflects SEBI’s shift from reactive enforcement to proactive governance expectations. The policy is expected to provide a structured mechanism for reporting, investigating, documenting, and addressing instances involving leakage or suspected leakage of unpublished information.

The moment a company becomes aware of a leak or even a suspected leak of UPSI, immediate action becomes critical. Delay, indecisiveness, or inadequate response may not only aggravate regulatory exposure but may also damage investor confidence and market credibility. The first responsibility of the company is to immediately contain further dissemination of the information. Access to sensitive documents and communication channels must be restricted, relevant electronic trails must be preserved, and the Compliance Officer must be informed without delay.

Simultaneously, a preliminary assessment is generally required to evaluate the nature and extent of the leakage. The company must ascertain the source of information, identify the persons who had access to the UPSI, determine whether any trading activity has occurred, and assess the possible market impact. Depending upon the seriousness of the incident, the company may initiate an internal investigation or appoint external legal advisors, forensic experts, or technology specialists to conduct an independent inquiry.

The role of the Audit Committee and the Board of Directors also assumes significance in such situations. In several cases, oversight by independent directors becomes essential to ensure objectivity and credibility of the inquiry process. Companies are increasingly expected to demonstrate not only that they have initiated an investigation, but also that the investigation is fair, comprehensive, and properly documented.

Where the leakage is likely to materially impact the market or where rumours relating to the UPSI have already entered the public domain, companies may also need to consider appropriate disclosures to stock exchanges under the applicable provisions of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015. The objective in such situations is to restore information symmetry and prevent selective informational advantage in the market.

The Compliance Officer occupies a central position in the entire framework relating to UPSI protection. Beyond routine monitoring functions, the Compliance Officer is expected to ensure maintenance of structured digital databases, implementation of Chinese wall procedures, regulation of communication flows, employee sensitization, and coordination of inquiries relating to leak incidents. Increasingly, SEBI has demonstrated that it expects compliance functions to operate as active governance mechanisms rather than passive administrative departments.

Recent enforcement trends indicate that SEBI has adopted a highly technology-driven approach while examining cases involving suspected leak of UPSI. Trading patterns, call records, digital metadata, email trails, access logs, and electronic communications are routinely examined during investigations. Consequently, even informal sharing of sensitive information through casual conversations or digital platforms may expose insiders and companies to significant regulatory action.

In today’s corporate environment, prevention of leakage of UPSI cannot be treated as a mere legal formality. It requires establishment of a strong compliance culture supported by robust internal controls, disciplined communication practices, technological safeguards, and continuous employee awareness. Organizations must ensure that access to sensitive information is strictly governed on a need-to-know basis and that confidentiality obligations are reinforced not only through policies but also through consistent implementation.

The issue of leakage of UPSI ultimately strikes at the heart of market integrity and investor confidence. The securities market functions efficiently only when all investors operate on a level informational playing field. Any unauthorized leakage of price sensitive information undermines this principle and weakens public trust in the fairness of the market mechanism.

In view of SEBI’s increasingly stringent regulatory approach, listed entities can no longer afford complacency in this area. The existence of a written policy alone is insufficient unless accompanied by prompt action, effective governance response, and demonstrable commitment toward preservation of confidentiality. A leak of UPSI today is not merely an operational lapse; it is a governance event demanding immediate, structured, and legally sound action.