A Database Cannot Record What The Organization Has Not Recognized
When information becomes unpublished price-sensitive information (UPSI), how fragmented knowledge should be identified and captured, why an SDD entry does not itself determine UPSI, and how the database should be designed around the organization.
Introduction
Insider trading cases are rarely proved by admission. More often, they are proved by chronology: who knew what, from when, how the information moved, and whether they traded while in possession of it.
The Structured Digital Database (SDD) required by Regulation 3(5) of the SEBI PIT Regulations1 is designed to preserve that chronology at the source. In substance, it is a ledger kept by the organization itself, recording each occasion when UPSI is shared: the nature of the information, who shared it, who received it, and when. Because each person is identified by PAN, or by another identifier authorized by law where PAN is not available, the ledger can be matched against trading records.2
The SDD requirement is practical.
Once the organization shares UPSI, even for a legitimate purpose, it necessarily gives up exclusive control over how the information is used and must instead rely on controls governing its subsequent use and dissemination.
The Committee on Fair Market Conduct therefore recommended a physical or digital trail of such information flows.3 The regulation now goes further than that recommendation. It does not merely contemplate an information trail; Regulation 3(5) prescribes the architecture of that trail – its contents, identifiers, internal maintenance, time stamping and audit trail/non-tampering requirements. The duty rests on the board of directors, or the head of the organization, or such other person required to handle UPSI.4
But a ledger records only what someone decides to put in it.
The SDD can capture only information that the organization has already recognized as UPSI and routed into the system. The effectiveness of that process therefore depends on whether the organisation has adequate mechanisms to identify, escalate and assess developing information that may constitute UPSI, and to capture the relevant sharing or access events within the applicable regulatory framework.
The real compliance risk therefore arises before the SDD screen opens: when commercial information is still developing across finance, sales, operations, legal, strategy and subsidiary-level teams; when no single employee sees the full picture; and when the Board of Directors or Head(s) of the Organization are expected to create a reliable information trail without being present at the operational points at which the underlying information originates.
This is why an SDD is not (and should not be) merely an electronic register maintained by the Organization. It is the evidentiary output of the organization’s information-governance architecture. If the internal control architecture is weak, the SDD merely produces an incomplete and incoherent record.
The practical questions are consequently sharper than “Does the organization have an SDD?” They are: What must be recorded? When did each person obtain access, and when was the entry actually made? When did the information become sufficiently concrete to be UPSI, and who was responsible for recognizing it and connecting the fragments? What legal significance follows once an item is entered? How should the system be built so these questions can be answered from records rather than recollection? The sections that follow address these questions.
What the SDD Records, and What It Does Not
Three features of Regulation 3(5) shape everything that follows.
First, it covers internal as well as external sharing. The provision refers to persons with whom information is shared “under this regulation”, and Regulation 3(1) permits UPSI to be communicated, even within the organization, only in furtherance of legitimate purposes, performance of duties or discharge of legal obligations. Every permitted internal communication is therefore ‘sharing’ under the regulation. The stock exchanges’ FAQs take the same view and treat sharing, internal or external, as the trigger for an entry.5
The second is that the SDD records the nature of UPSI, not its substance. An entry should show that draft quarterly results or a proposed acquisition was shared; it should not reproduce the numbers or the deal terms. A database that stores the information itself becomes a new source of leak risk.
The third is that the SDD records transmissions, not merely insiders. This is its distinctive feature of Indian SDD compared to global regimes. Insider lists under Article 18 of the EU Market Abuse Regulation record who had access to inside information and when that access began and ended. China’s Rules come closer: they record the time, place, basis, manner and content of each person’s knowledge at every stage from planning to disclosure and, for major transactions, require a signed memorandum of the key decision points.6 The SDD records each step from the person sharing to the person receiving. Where the recipient is an intermediary or fiduciary, the chain continues in that recipient’s own SDD.7
Timing: The Three-Clock Problem
Knowing what must be recorded still leaves the question of when. Every SDD event involves three distinct clocks.
The first is the information clock: the point at which a developing fact, transaction or set of circumstances becomes sufficiently concrete, credible, and price-sensitive to satisfy the UPSI definition. The second is the access clock: the point at which a particular person receives, derives, or is allowed access to that information. The third is the database clock: the point at which the entry is actually created in the SDD.
Weak systems collapse these three clocks into one. The Compliance Officer (or any other analogous person authorized for the purpose) enters a transaction into SDD only after learning of it and records the date of entry as though it were the date on which UPSI arose, or access was obtained. This creates a time-stamped record, but it does not create an accurate chronology.
The defensible operating standard is therefore contemporaneous capture: the SDD workflow should be triggered as part of the same process through which information is shared. Where real-time entry is operationally impossible, the organization’s policy should prescribe a narrowly defined entry period, identify the approving authority for delay, and require the system to retain both the actual access time and the later entry time. How such triggers can be built into the organization is discussed in the final section.
When Does Information “Mature” into UPSI?
The information clock is the hardest of the three to read. The difficult question is not when to type the entry, but when the information has matured enough to require one.
Waiting for board approval, execution of definitive agreements, or audit finality is often too late. By then, information has already originated and circulated without requisite PIT controls, posing grave risks and undermining the very prophylactic objectives the regulations seek to achieve. Conversely, not every exploratory thought, internal target or preliminary conversation can sensibly be treated as UPSI.
The statutory test remains whether the information relates directly or indirectly to the Company or its securities, is not generally available, and is likely to materially affect the price when it becomes generally available.
For financial results, the PIT Regulations supply their own benchmark: the trading window must close from the end of every quarter until 48 hours after the results are declared, which signals that results information is treated as sensitive from quarter-end.8
An organization that closes the trading window at quarter-end but records no sharing of draft results within SDD until the board meeting should be able to explain the apparent divergence between these two control mechanisms, particularly where the draft results had already acquired the characteristics of UPSI before formal Board approval.
For contingent events, such as a transaction under negotiation, a useful analytical discipline is to assess probability and magnitude together: a highly transformative event may become price-sensitive at a relatively earlier probability threshold, while a routine event may require much greater certainty before it becomes material.
The correct trigger is not legal finality.
It is the point at which the information has acquired sufficient specificity and credibility to support a reasonable inference about likely price impact. However, Indian law has not formally adopted this test, and comparative authority is divided.
The statutory SDD requirement operates in the context of the sharing of UPSI under Regulation 3(5). The making of an SDD entry should not, however, be treated as determining when the information first acquired the legal character of UPSI. Basic Inc. v. Levinson9 articulates a ‘reasonable investor’ materiality standard in the context of U.S. securities-fraud law, whereas the Indian PIT framework employs a distinct test: whether the information is likely to materially affect the price of securities if published.
The exchanges’ SDD FAQs suggest recording in SDD once the event is more likely than not to go ahead.10 That threshold suits routine matters, but applied rigidly it could leave a transformative transaction unrecorded while its odds are still below even, which is often when a leak is most valuable (or at least vulnerable!).
A workable starting point can be illustrated: For transactions, one may tie the opening of an SDD event to identified milestones, such as a signed mandate or non-disclosure agreement, a term sheet, a grant of exclusivity or the first presentation to the board, while allowing earlier opening where the matter is transformative. A reasoned, consistently applied working approach (with room for exception) is easier to defend than judgment exercised after the event.
This milestone approach is proposed as a matter of good practice and is not prescribed by the PIT Regulations.
Identification Problem: Board of Directors Cannot See What the Organization Does Not Escalate
Reading the information clock presupposes that someone with the right vantage point sees all the information. The proposition under Regulation 3(5) that the Board of Directors or Head(s) of the Organization “ensure that a structured digital database is maintained” is sometimes converted into an assumption that they must personally identify every UPSI event and enter every recipient. That is structurally unrealistic and not what the Regulations require.
Regulation 9A places the obligation to establish adequate and effective internal controls on the Chief Executive Officer, Managing Director or analogous person. Those controls must ensure identification of UPSI, preservation of confidentiality, restrictions on communication, maintenance of lists of recipients and periodic review. The Board must oversee compliance, while the Audit Committee must test at least annually whether the controls are adequate and operate effectively.11 Enforcement practice reflects this allocation: in the Kaynes matter discussed below, the Regulation 3(5) proceeding was brought against the Managing Director.
Departmental leaders and transaction owners should be required to enter into SDD (or at least escalate for entry) the defined signals, as illustrated here: unexpected earnings variance, loss or concentration of a major customer, supply disruption, material litigation movement, regulatory contact, cyber incident, strategic transaction milestones, changes in key personnel, developments at material subsidiaries, and so forth. A smaller authorized group can then assess whether the escalated information is UPSI and determine the connected controls.
The Fragmentation Problem: When No One Holds UPSI, but the Organization Does
The most difficult identification cases involve information that is innocuous in silos but sensitive in combination.
Finance may know that revenue forecasts have been revised downward. Sales may know that a major customer is reconsidering its relationship. Legal may know that the same customer has issued a contractual notice. No department may possess the consolidated conclusion. Taken together, however, the information may reveal a material deterioration in earnings and business prospects.
UPSI analysis should therefore not be confined to a document-by-document test.
The statutory expression “any information” is broad enough to include a composite state of affairs. The relevant question is whether the information available within the organization, when reasonably aggregated, is likely to materially affect price.
Aggregation, however, operates on the organization’s obligations: classification, closure of the trading window, disclosure and SDD entries. It does not make every employee who holds one innocuous fragment a person in possession of UPSI. Whether an individual possesses UPSI still depends on what that individual knows. That distinction matters because the proviso to Regulation 4(1) permits a non-individual insider to demonstrate, among other circumstances, that the individuals who possessed the UPSI were different from those taking the trading decision, and that appropriate and adequate arrangements were in place to prevent a contravention.
The SDD, together with the information-barrier and aggregation controls described here, may provide important contemporaneous evidence of whether those arrangements existed and operated as intended.
This requires an aggregation control. The organization should identify recurring consolidation points where cross-functional information is deliberately joined, such as the monthly management review, the quarterly results close, a risk or credit committee, or a transaction steering group. The person chairing or receiving the consolidated output should have a specific obligation to trigger a UPSI assessment.
Does an SDD Entry Automatically Make the Information UPSI?
Once information has been recognized and recorded, a different question arises: what does the entry itself establish?
UPSI status is determined by Regulation 2(1)(n), not by the act of entering data into a software platform. An item that is generally available or incapable of materially affecting price does not become UPSI merely because an employee selected a category in the SDD. Equally, information that satisfies the statutory test does not cease to be UPSI because the organization failed to record it.
However, an SDD entry can be seen as a contemporaneous representation that the organization treated the information as UPSI. In an investigation, it can be compared with trading-window decisions, confidentiality notices, board papers and trades.
Under the note to Regulation 4(1), a person who trades while in possession of UPSI is presumed to have been motivated by it, and the Supreme Court has recently held that profit and purpose are irrelevant once possession and trading are shown.12
The presumption is rebuttable; the proviso to Regulation 4(1) identifies, by way of illustration, circumstances that an insider may demonstrate to prove innocence. An SDD entry naming a person may therefore become important contemporaneous evidence that the person was given access to the information, and may support an inference of possession; but the entry records the fact of sharing, not what the recipient actually read, understood or knew.
A later assertion that the entry was “only precautionary” may be legally possible but will be credible only if the organization has a documented classification framework and a consistent practice of recording reassessments.
The correct response, as emphasized earlier, should be a consistently applied, well-reasoned working approach for SDD that can address exceptions, reassessments, and withstand scrutiny, since the UPSI field is both elusive and dynamic.
The SDD must be non-tamperable; one should preserve the original entry and add a supplementary record stating when and why the information was reassessed, whether it was already generally available, whether the expected price impact did not materialize as originally understood, or whether the underlying event was abandoned.13 This preserves the audit trail without treating the original classification as eternally conclusive.
SDD as Evidence
SEBI’s March 2026 settlement order concerning the Managing Director of Kaynes Technology India Limited illustrates how the database is tested in practice. SEBI alleged that the SDD contained only two entries between January and October 2023, that it did not capture the UPSI relating to two financial-results announcements made in that period, and that access-log details supplied at different times were inconsistent. The proceeding was settled without admission or denial of the findings, on payment of Rs. 23,42,600.14
What matters is the regulator’s scrutiny method.
SEBI examines SDD holistically rather than in isolation. By comparing the database against the organization’s known UPSI-generating events and testing the consistency of access trails across different versions, the regulator identifies structural gaps in PIT compliance.15 It is the same reconciliation the organization certifies every quarter: the SDD compliance certificate that listed companies file with the stock exchanges asks whether all UPSI shared during the quarter has been captured.16
The Kaynes case also explains why delayed entries should be made transparent rather than omitted, disguised, or confusing. A late entry is better than a manipulated entry; the former invites an explanation, while the latter invites consequences – it can create a credibility problem that is materially worse than delay.
Designing the SDD Around the Organization
The preceding sections point to one conclusion: no single SDD design suits every organization, because UPSI germinates in different places in different businesses.
In a manufacturer it may surface first in plant operations, order books or supply contracts; in a lender, in asset-quality reviews and regulatory correspondence; in a holding company, in its subsidiaries and promoter group.
A system built only around the board calendar and the secretarial desk will capture the end of processes and/or information trail, and miss their beginnings. The access and responsibility matrix should therefore start with a map of the organization’s structure and how information originates and flows within it, not merely from a general template.
Map where information germinates and how it travels. For each category of UPSI listed in Regulation 2(1)(n), and for matters specific to the business, the organization should identify where the information typically originates, the reporting line along which it moves to decision-makers, and the external parties and/or fiduciaries who see it on the way, such as management consultants, advisors, auditors, bankers, lawyers, valuers, rating agencies, etc.
The map should show where capture points sit, then decide who owns the capture decision at those checkpoints. Revisit the arrangement whenever the organization changes, for example when a subsidiary is acquired, a function is outsourced or the finance team is reorganized. SDD does not run on (and one should not run it on) the “fit it and forget it” principle, which is both futile and fatal.
In a centralized organization, a few consolidation points, such as the results close, the board-paper process and the deal team, can carry most of the load. In a decentralized or multi-business organization, business-unit heads should own, capture and feed a central database. In a group, each listed company must maintain its own SDD,17 and information moving from a subsidiary or the promoter group into the listed company should be recorded when it crosses that boundary, not when it reaches the board.
Make capture a by-product of sharing UPSI.
The most reliable entries are generated when information moves: when a user is admitted to a virtual data room, when board papers are circulated, when draft results are released to auditors, or when access to a restricted folder is granted. Manual entry should be reserved for oral and informal sharing and should be made without delay and with necessary details.
Manage each event through its lifecycle. Open an event when the information matures, reassess it when the facts change, and close it after the information is published or the matter is abandoned. Each reassessment should preserve the original entry and the chronology of subsequent changes, rather than overwrite the earlier classification or timing. Regulation 3(5) does not expressly require closure, but the closing date marks the end of the period in which each recipient held UPSI, and it is the date against which later trades will be tested.
UPSI does not become stale merely because time has passed. It ceases after becoming generally available, when the matter is abandoned, or when a documented reassessment concludes that it is no longer price-sensitive, and each of those moments should be recorded. The same record should drive any trading-window closure for the persons connected with it, and it should be the starting point of any inquiry into a suspected leak under Regulation 9A(5).18
Listed companies and Organizations that generate or deal with UPSI recurrently need a disciplined process more than an elaborate platform.
Conclusion: Some Real Questions and Tasks concerning SDD
An SDD is indispensable, but it is not self-executing.
It cannot identify the moment when preliminary information matures. It cannot connect facts that remain trapped in separate departments or silos. It cannot decide whether an entry is legally UPSI. And it cannot repair a governance system that learns of material developments only when the stock-exchange disclosure is being drafted.
For boards, directors and senior management, the question is whether their organization has a defensible method to recognize, aggregate, classify, and control sensitive information before a trade, leak, or regulatory query tests the chronology.
For CEOs, CFOs, Compliance Officers, and Legal Heads, the challenge is to create consolidation points where dispersed operational, financial, commercial, and legal facts can be assessed together.
For all of them collectively, the task is to build an escalation and reconciliation system shaped around how information actually germinates and travels within the organization, from its internal origin through key operational triggers to its eventual external dissemination.
The strongest SDD is the one whose entries, omissions, reassessments, timings and classifications can all be explained from contemporaneous records. That is the difference between a database that exists and an internal control system that will withstand investigation.
Footnotes
1 SEBI (Prohibition of Insider Trading) Regulations, 2015
2 The recording of names, PANs and other identifiers of natural persons in the SDD also brings data-protection considerations into play. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), such information would constitute personal data where it relates to an identifiable individual. The substantive provisions governing the processing of personal data are, however, scheduled to come into force only in May 2027. Once effective, organizations maintaining an SDD will need to apply the DPDP framework to the collection, access, use and security of such personal data. Further, Section 8(7) of the DPDP Act recognizes that personal data may be retained where retention is necessary for compliance with law; Digital Personal Data Protection Act, 2023; Ministry of Electronics and Information Technology, Notification G.S.R. 843(E), dated 13 November 2025.
3 Securities and Exchange Board of India, Report of the Committee on Fair Market Conduct 42-43 (Aug. 8, 2018).
4 Securities and Exchange Board of India (Prohibition of Insider Trading) (Amendment) Regulations, 2020, Gazette of India, Extraordinary (July 17, 2020) (India); PIT Regulations, reg. 3(6).
5 BSE Ltd., Frequently Asked Questions: Structured Digital Database Under the Provisions of the SEBI (Prohibition of Insider Trading) Regulations, 2015, FAQ Nos. 3, 6.
6 Regulation (EU) No 596/2014 of the European Parliament and of the Council of 16 April 2014 on Market Abuse, art. 18, 2014 O.J. (L 173) 1; Commission Implementing Regulation (EU) 2022/1210, annex I (insider-list templates); China Securities Regulatory Commission, Listed Company Regulatory Guideline No. 5: Insider Registration Management System of Listed Companies, arts. 6, 10, 13 (CSRC Announcement [2025] No. 5, as amended) (Mar 27, 2025).
7 BSE Ltd., Frequently Asked Questions: Structured Digital Database Under the Provisions of the SEBI (Prohibition of Insider Trading) Regulations, 2015, FAQ No. 2, Notice No. 20221028-15 (Oct. 28, 2022).
8 PIT Regulations, sch. B, cl. 4(2).
9 Basic Inc. v. Levinson, 485 U.S. 224, 238 (1988). See also Hidden Hatchery: The Birth of Unpublished Price Sensitive Information, LiveLaw (Sept. 12, 2024, 10:48 AM IST), https://www.livelaw.in/law-firms/law-firm-articles-/sebi-upsi-united-spirits-limited-securities-appellate-tribunal-apex-frozen-foods-godfrey-philips-india-limited-corporate-professionals-advisers-advocates-269354.
10 Case C-19/11, Geltl v. Daimler AG, ECLI:EU:C:2012:397 (June 28, 2012); BSE Ltd., Frequently Asked Questions: Structured Digital Database, FAQ No. 5, Notice No. 20221028-15 (Oct. 28, 2022).
11 Securities and Exchange Board of India (Prohibition of Insider Trading) Regulations, 2015, reg. 9A(1)-(4) (India) (as amended Mar. 12, 2025).
12 Securities and Exchange Board of India v. Rajeev Vasant Sheth, (Supreme Court of India, Aug. 11, 2026) (distinguishing SEBI v. Abhijit Rajan (2022), decided under the 1992 Regulations).
13 BSE Ltd., Frequently Asked Questions: Structured Digital Database, FAQ No. 7, Notice No. 20221028-15 (Oct. 28, 2022).
14 Settlement Order No. SO/JS/RJ/2025-26/8480, In re Insider Trading in the Scrip of Kaynes Technology India Ltd., paras. 4.1-4.5, 7-10 (Securities & Exchange Board of India Mar. 27, 2026).
15 Settlement Order No. SO/JS/RJ/2025-26/8480, paras. 4.2-4.4.
16 BSE Ltd., Standard Operating Process under SEBI (PIT) Regulations, 2015 for Ensuring Compliance with Structured Digital Database, Notice No. 20221028-15 (Oct. 28, 2022); National Stock Exchange of India Ltd., Circular on Structured Digital Database (Oct. 28, 2022).
17 BSE Ltd., Frequently Asked Questions: Structured Digital Database Under the Provisions of the SEBI (Prohibition of Insider Trading) Regulations, 2015, FAQ No. 9, Notice No. 20221028-15 (Oct. 28, 2022).
18 PIT Regulations, reg. 9A(4)-(5).
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
The views expressed in this article are solely those of the author in her personal capacity and are based on her understanding of the applicable legal and regulatory framework. They do not necessarily represent the views, policies or practices of organisation with which the authors is associated.
