The Structured Digital Database (SDD): Why stock exchanges and auditors are scrutinizing timestamps

Under Regulation 3(5) and 3(6) of the SEBI (Prohibition of Insider Trading) Regulations, 2015, maintaining a tamper-proof Structured Digital Database is not optional. It is a non-negotiable statutory mandate.

Yet, during secretarial reviews and statutory audit checks, we consistently encounter three key compliance gaps:

🔹𝗧𝗵𝗲 “𝗣𝗼𝘀𝘁-𝗙𝗮𝗰𝘁𝗼” 𝗟𝗼𝗴𝗴𝗶𝗻𝗴 𝗣𝗿𝗮𝗰𝘁𝗶𝗰𝗲: Entering Unpublished Price Sensitive Information (UPSI) days after the board meeting or deal discussion. An SDD must capture entries contemporaneously, with an internally generated, unalterable timestamp.

🔹𝗢𝗺𝗶𝘀𝘀𝗶𝗼𝗻 𝗼𝗳 𝗘𝘅𝘁𝗲𝗿𝗻𝗮𝗹 𝗥𝗲𝗰𝗶𝗽𝗶𝗲𝗻𝘁𝘀: Logging internal employees but missing external advisors (merchant bankers, legal counsel, statutory auditors, credit rating agencies), along with their PAN/identifier and documented confidentiality undertaking.

🔹𝗘𝘅𝗰𝗲𝗹 / 𝗦𝗽𝗿𝗲𝗮𝗱𝘀𝗵𝗲𝗲𝘁 𝗗𝗲𝗽𝗲𝗻𝗱𝗲𝗻𝗰𝘆: Relying on spreadsheets or editable internal databases that lack audit trails, timestamp integrity, and SEBI-compliant access controls.

Stock exchanges now regularly seek quarterly SDD compliance certificates from the Compliance Officer, and PCS professionals are required to verify the database during Secretarial Audits.

An SDD lapse can invite direct personal liability for the Compliance Officer and reputational fallout for the board.

Has your organization conducted an external audit of its SDD architecture to validate tamper-proof audit trails?

At Sandeep Lakhotia & Associates, we conduct independent SDD and SEBI (PIT) compliance audits to ensure audit readiness before regulatory inquiries arise.