Sharing Sensitive News and Keeping a Record
3. Sharing sensitive news—and keeping a record
UPSI must be handled on a need-to-know basis. Sharing it, providing access, obtaining it or persuading someone to disclose it is restricted unless this serves a legitimate purpose, performs a duty or meets a legal obligation. Sharing with another insider is also covered.
The listed company’s board must define legitimate purposes in its policy. Ordinary business sharing with lenders, suppliers, customers, partners, lawyers, auditors, merchant bankers, insolvency professionals or other advisers can qualify. It cannot be used to sidestep the rules. Recipients become insiders and must receive notice of their confidentiality obligations.
Certain transactions permit controlled sharing through two routes. Where a takeover open offer is required—an offer allowing shareholders to sell under the takeover framework—the board must form an informed view that sharing serves the company’s best interests. The offer process gives shareholders information and a common offer price.
Where no open offer is required, the board must again form that informed view. The relevant UPSI must become generally available at least two trading days before the proposed transaction, through disclosure adequately and fairly covering all relevant material facts.
Both routes require confidentiality agreements. Regulation 3(4) applies to the whole transaction-sharing provision, not just the no-open-offer route. The board must require the parties to agree to confidentiality and non-disclosure obligations. They must keep the information confidential except for the permitted transaction purpose and must not otherwise trade in the company’s securities while possessing UPSI.
Organisations handling UPSI must maintain an internal Structured Digital Database, without outsourcing it. It records the information’s nature, sharers, recipients, and their PAN tax identifiers or legally authorised alternatives where PAN is unavailable. Timestamps, audit trails and controls must prevent tampering.
For company UPSI originating outside the organisation, the June 2025 amendment allows entry within two calendar days of receipt. Records must remain for at least eight years after the relevant transactions finish. Records relevant to notified SEBI investigations or enforcement must remain until proceedings finish, even if longer.
Receiving information for a legitimate business purpose does not, by itself, give permission to trade.