Beyond The Companies Act: The Impact Of Allied Laws On Corporate Governance In India

Introduction

Corporate governance in India has undergone a significant transformation over the past two decades. While governance was once viewed largely as a matter of statutory compliance under the Companies Act, 1956 (and subsequently the Companies Act, 2013), today's corporate governance framework is far broader, encompassing financial regulation, securities law, foreign exchange management, competition law, labour regulations, environmental obligations, data privacy, anti-money laundering measures and ESG related responsibilities. Consequently, effective governance can no longer be achieved through compliance with a single legislation alone.

This evolution has largely been driven by the increasing complexity of business operations, globalisation of Indian enterprises, rising investor expectations and a series of high profile corporate governance failures. Cases such as the Satyam Computer Services accounting fraud, the IL&FS financial crisis, and governance concerns surrounding financial institutions have demonstrated that corporate failures often arise not merely from violations of company law but from deficiencies in risk management, internal controls, ethical leadership and regulatory oversight. These events prompted regulators to strengthen governance standards by introducing stricter disclosure norms, enhanced board accountability and greater emphasis on transparency and stakeholder protection.

Simultaneously, international developments have influenced India's governance framework. The OECD Principles of Corporate Governance, increasing focus on Environmental, Social and Governance (ESG) standards, sustainability reporting requirements and growing investor activism have shifted the role of boards from passive statutory oversight to proactive strategic governance. Boards are now expected to oversee enterprise wide risks, cyber security, data privacy, sustainability, regulatory compliance and organisational culture alongside traditional financial reporting.

The Companies Act, 2013 undoubtedly remains the cornerstone of corporate governance in India by prescribing the legal framework governing incorporation, management, administration and winding up of companies. However, the governance obligations of Indian corporates today extend well beyond the Act. A listed company, for instance, simultaneously operates within the framework of the Companies Act, the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015 (SEBI LODR), the Foreign Exchange Management Act, 1999 (FEMA), the Competition Act, 2002, tax statutes, labour laws, the Digital Personal Data Protection Act, 2023 (DPDP Act), the Prevention of Money Laundering Act, 2002 (PMLA), and various environmental and social welfare legislations. These statutes collectively create an integrated governance ecosystem where compliance under one law frequently intersects with obligations under another.

Accordingly, modern corporate governance is no longer confined to legal compliance. It is an integrated framework that seeks to promote ethical conduct, transparency, accountability, sustainable value creation and responsible decision making. Boards are increasingly expected to embed compliance into business strategy through effective risk management systems, internal controls, stakeholder engagement and ethical leadership.

This article examines how the Companies Act, 2013 is complemented by various allied legislations that collectively define the contemporary corporate governance framework in India. It analyses the governance objectives underlying these statutes and demonstrates how they have transformed the role of boards from compliance supervisors to strategic custodians of organisational integrity and long term sustainability.

The Companies Act as the Foundation

The Companies Act, 2013 represents the principal legislation governing companies in India and forms the bedrock of corporate governance. Enacted to replace the Companies Act, 1956, the legislation sought to modernise India's corporate legal framework by strengthening transparency, accountability and investor protection while facilitating ease of doing business. The Statement of Objects and Reasons accompanying the Act emphasised improved governance standards, greater shareholder participation and enhanced regulatory oversight.

Unlike its predecessor, the Companies Act, 2013 adopts a governance oriented approach rather than focusing solely on procedural compliance. It recognises that effective governance requires responsible boards, independent oversight, transparent disclosures and robust accountability mechanisms. Consequently, several provisions of the Act are specifically designed to improve board effectiveness and protect stakeholder interests.

Board Composition and Independence

One of the most significant reforms introduced by the Act is the strengthening of board independence. Certain classes of companies are required to appoint Independent Directors to ensure objective decision making and reduce the possibility of management dominance. Similarly, mandatory appointment of at least one woman director for prescribed companies promotes diversity in boardrooms and recognises the value of varied perspectives in corporate decision making.

The Act also codifies directors' duties requiring directors to act in good faith, exercise due and reasonable care, avoid conflicts of interest and promote the interests of the company, its employees, shareholders, the community and the environment. This statutory recognition of fiduciary duties marks an important shift from shareholder centric governance to a broader stakeholder oriented approach.

Board Committees and Oversight

Recognising that specialised oversight improves governance, the Act mandates the constitution of key board committees such as the Audit Committee, Nomination and Remuneration Committee and Stakeholders' Relationship Committee for specified companies. These committees enable closer supervision of financial reporting, internal controls, executive remuneration and shareholder grievances.

The Audit Committee, in particular, plays a critical role in maintaining financial integrity by overseeing statutory audits, internal audit functions, related party transactions and internal financial controls. The Nomination and Remuneration Committee contributes to governance by ensuring transparent processes for appointment, evaluation and remuneration of directors and senior management.

Transparency and Disclosure

Transparency remains one of the fundamental pillars of good corporate governance. The Act significantly expands disclosure obligations by requiring comprehensive financial statements, Directors' Reports, Secretarial Audit Reports for specified companies and enhanced disclosures regarding related party transactions, loans, guarantees and corporate social responsibility initiatives.

Secretarial Standards issued by the Institute of Company Secretaries of India (ICSI) further reinforce governance by promoting uniformity in board and shareholder meetings, improving procedural discipline and strengthening decision making processes.

Internal Controls and Risk Management

The Companies Act recognises that governance extends beyond statutory filings. Directors are required to affirm in the Directors' Responsibility Statement that adequate internal financial controls are in place and operating effectively. This obligation has significantly enhanced board accountability by requiring directors to actively oversee financial reporting systems, risk management processes and internal compliance mechanisms.

The increasing emphasis on enterprise wide risk management reflects the evolving expectation that boards should identify strategic, financial, operational, technological and regulatory risks before they materialise into governance failures.

Protection of Minority Shareholders

The legislation also strengthens shareholder democracy through enhanced remedies against oppression and mismanagement before the National Company Law Tribunal (NCLT). Stringent provisions governing related party transactions, stricter disclosure norms and expanded rights during mergers and restructuring transactions collectively improve minority shareholder protection and reinforce investor confidence.

Corporate Governance in Practice

The importance of these governance mechanisms became evident following the Satyam Computer Services scandal, where weak board oversight, inadequate internal controls and ineffective independent directorship contributed significantly to one of India's largest corporate frauds. The lessons from Satyam strongly influenced the governance philosophy underlying the Companies Act, 2013, particularly in relation to auditor independence, board accountability and financial disclosures.

Similarly, in Tata Consultancy Services Ltd. v. Cyrus Investments Pvt. Ltd. (2021), the Supreme Court reiterated that while directors enjoy commercial discretion in managing corporate affairs, such discretion must be exercised within the framework of law, fiduciary duties and principles of good governance. The judgment underscores the judiciary's recognition that corporate governance extends beyond technical compliance and requires responsible exercise of managerial powers.

Governance Significance

The Companies Act, 2013 therefore serves as the foundational governance legislation in India. However, despite its comprehensive framework, it does not operate in isolation. Listed companies, multinational corporations, financial institutions and increasingly even unlisted entities are simultaneously subject to multiple specialised regulatory frameworks governing securities markets, foreign investment, competition, labour, taxation, environmental protection, The Companies Act, 2013 therefore serves as the foundational governance legislation in India. However, despite its comprehensive framework, it does not operate in isolation. Listed companies, multinational corporations, financial institutions and increasingly even unlisted entities are simultaneously subject to multiple specialised regulatory frameworks governing securities markets, foreign investment, competition, labour, taxation, environmental protection, data privacy and financial integrity. Collectively, these allied laws expand governance beyond the boardroom and transform compliance into an integrated enterprise wide responsibility.

SEBI Regulations and Governance of Listed Entities

While the Companies Act, 2013 establishes the fundamental governance framework for all companies, listed entities are subject to an additional layer of governance through the Securities and Exchange Board of India (Listing Obligations and Disclosure Requirements) Regulations, 2015 (SEBI LODR). The Regulations consolidate the governance and disclosure requirements applicable to listed companies with the primary objective of protecting investors, promoting market integrity and ensuring timely dissemination of material information.

The governance philosophy underlying the SEBI LODR Regulations extends beyond statutory compliance. It seeks to foster a culture of transparency, accountability and ethical decision making by imposing continuous disclosure obligations and prescribing higher governance standards than those applicable to unlisted companies.

Board Composition and Independence

SEBI LODR reinforces the importance of an independent and effective board by prescribing detailed requirements relating to board composition, independent directors and committee structures. The Regulations require an optimum combination of executive and non-executive directors, with a prescribed proportion of independent directors depending upon the nature of the chairperson.

Independent directors are expected to provide objective oversight over management decisions, protect minority shareholder interests and enhance board deliberations. Annual performance evaluations of the Board, its committees and individual directors further strengthen accountability and encourage continuous improvement in governance practices.

Board Committees

The Regulations assign significant responsibilities to specialised board committees.

The Audit Committee oversees financial reporting, statutory audits, internal controls, related party transactions and the effectiveness of internal audit systems. The Nomination and Remuneration Committee ensures transparent appointment and remuneration policies for directors and senior management, while the Stakeholders' Relationship Committee focuses on investor grievances and shareholder engagement.

Large listed entities are also required to constitute a Risk Management Committee, reflecting the increasing expectation that boards proactively identify and manage strategic, financial, operational, technological and regulatory risks.

Continuous Disclosure and Transparency

One of the defining features of SEBI LODR is its emphasis on continuous disclosure. Regulation 30 requires listed entities to promptly disclose material events that may influence investment decisions, including mergers, acquisitions, significant litigation, defaults, changes in key managerial personnel and regulatory actions.

Unlike periodic financial reporting under the Companies Act, these disclosure requirements ensure that investors receive timely and accurate information, thereby reducing information asymmetry and strengthening market confidence.

Related Party Transactions

SEBI has progressively tightened the framework governing Related Party Transactions (RPTs). Material RPTs require shareholder approval, while independent directors and the Audit Committee play an important role in reviewing such transactions to ensure fairness and prevent conflicts of interest. This framework enhances transparency and safeguards minority shareholders from abusive transactions.

Business Responsibility and Sustainability Reporting (BRSR)

Corporate governance has increasingly become intertwined with sustainability. Recognising this shift, SEBI introduced the Business Responsibility and Sustainability Reporting (BRSR) framework for the top listed entities.

BRSR requires companies to disclose their performance on environmental, social and governance parameters, including greenhouse gas emissions, employee welfare, diversity, occupational safety, human rights, community development and ethical business practices. These disclosures enable investors to assess not only the financial performance of companies but also their long-term sustainability and governance standards.

Governance Significance

The SEBI LODR Regulations have transformed governance in listed companies from a periodic compliance exercise into a continuous process of transparency, stakeholder engagement and risk oversight. They complement the Companies Act by introducing enhanced governance standards that strengthen investor confidence and improve corporate accountability.

Foreign Exchange Laws and Cross-Border Governance

The Foreign Exchange Management Act, 1999 (FEMA) marked a significant shift in India's regulatory philosophy by replacing the restrictive Foreign Exchange Regulation Act, 1973 (FERA). Unlike FERA, which focused on controlling foreign exchange transactions through criminal enforcement, FEMA adopts a facilitative approach aimed at promoting external trade, foreign investment and orderly development of the foreign exchange market.

As Indian companies increasingly engage in international business, FEMA has become an integral component of corporate governance.

Governance Responsibilities

Cross-border transactions expose companies to complex regulatory requirements relating to foreign investment, overseas investments, external commercial borrowings, overseas acquisitions and cross-border financing. Boards are expected to ensure that such transactions comply with the applicable RBI regulations, sectoral caps, pricing guidelines and reporting requirements.

Governance under FEMA therefore requires active oversight rather than post-facto compliance.

Board Oversight

The board plays an important role in approving foreign investments, overseas direct investments, borrowings from overseas lenders and cross-border restructuring transactions. Directors are expected to ensure that adequate internal controls exist for monitoring foreign exchange transactions and timely reporting to the Reserve Bank of India through Authorised Dealer Banks.

Regular compliance reviews and legal due diligence become particularly important where multinational group structures involve multiple jurisdictions.

Governance Risks

Failure to comply with FEMA may result in significant monetary penalties, compounding proceedings and reputational damage. Delayed reporting of foreign investment, non-compliance with pricing guidelines or violations relating to overseas investments may adversely affect future transactions and investor confidence.

Accordingly, FEMA compliance is no longer viewed merely as a finance function but as an important aspect of enterprise wide governance.

Governance Significance

As Indian businesses continue expanding globally, boards must integrate FEMA compliance into their overall governance framework by ensuring robust approval processes, effective documentation, periodic compliance reviews and proactive regulatory reporting.

Competition Law and Fair Market Conduct

The Competition Act, 2002 seeks to promote and sustain competition in Indian markets, protect consumer interests and ensure freedom of trade. The legislation replaced the Monopolies and Restrictive Trade Practices Act, reflecting India's transition towards a market driven economy focused on competitive efficiency rather than mere market concentration.

Corporate governance today extends beyond protecting shareholders; it also requires companies to compete fairly and ethically.

Board Responsibility

Many competition law violations originate from strategic business decisions taken at the highest level. Pricing arrangements, exclusive supply agreements, bid rigging, market allocation and cartelisation often involve senior management and board level decision making.

Consequently, directors must ensure that commercial strategies are developed within the framework of competition law.

Merger Control

The Act requires combinations crossing prescribed financial thresholds to obtain approval from the Competition Commission of India (CCI). Boards must therefore evaluate competition law implications at the transaction planning stage to avoid implementation delays and regulatory intervention.

Competition due diligence has become an essential component of mergers, acquisitions and corporate restructuring.

Competition Compliance Programmes

Leading companies increasingly implement competition compliance programmes comprising employee training, legal review of commercial arrangements, internal reporting mechanisms and periodic compliance audits. Such programmes help minimise regulatory risk while promoting ethical business conduct.

Governance Lessons

Several investigations conducted by the Competition Commission of India demonstrate that inadequate governance, weak compliance culture and insufficient board oversight can expose organisations to substantial financial penalties and reputational harm.

An effective board therefore views competition compliance not merely as a legal obligation but as an essential component of responsible corporate conduct.

Governance Significance

The Competition Act reinforces the broader principle that corporate governance encompasses ethical behaviour in the marketplace. By encouraging transparency, accountability and fair competition, the legislation contributes significantly to investor confidence, consumer welfare and sustainable business growth.

Tax Governance and Board Accountability

Traditionally, tax compliance was viewed as a finance or accounting function confined to the timely filing of returns and payment of statutory dues. However, increasing regulatory scrutiny, cross-border transactions, heightened disclosure requirements and investor expectations have transformed taxation into an important element of corporate governance. Today, boards are expected not only to ensure compliance with tax laws but also to oversee tax strategy, manage tax risks and promote responsible tax practices consistent with the company's ethical standards.

Tax governance encompasses compliance under the Income-tax Act, 2025, the Goods and Services Tax (GST) framework, transfer pricing regulations and other fiscal statutes. Effective tax governance requires companies to establish robust internal controls, maintain accurate documentation and adopt transparent tax positions. Aggressive tax planning, although legally permissible in certain situations, may expose companies to prolonged litigation, financial penalties and reputational damage, making board oversight indispensable.

For multinational enterprises, governance challenges are further compounded by transfer pricing regulations, permanent establishment issues, withholding tax obligations and international tax initiatives such as the OECD's Base Erosion and Profit Shifting (BEPS) framework. Consequently, boards increasingly require periodic reporting on significant tax exposures, ongoing litigation, tax provisioning and the implications of major business transactions

Audit Committees also play a critical role by reviewing tax positions that may materially affect the financial statements, ensuring consistency between tax disclosures and financial reporting, and assessing the adequacy of internal controls relating to tax compliance.

Increasingly, institutional investors also evaluate whether companies adopt responsible tax practices that align with broader ESG principles. Transparent tax governance therefore contributes not only to regulatory compliance but also to corporate reputation, investor confidence and long term value creation.

Labour and Employment Laws: Governance Through Workforce Accountability

Corporate governance extends beyond financial performance and regulatory compliance; it also encompasses the manner in which organisations manage their workforce. Employees constitute one of the most significant stakeholder groups, and consequently, labour law compliance has evolved into an essential component of corporate governance. Modern boards are increasingly expected to oversee workplace culture, employee welfare, occupational safety, diversity, industrial relations and human capital management.

Recognising the need to modernise India's fragmented labour law framework, Parliament consolidated 29 Central labour legislations into four comprehensive Labour Codes, namely:

Code on Wages, 2019;

Industrial Relations Code, 2020;

Code on Social Security, 2020; and

Occupational Safety, Health and Working Conditions Code, 2020.

The four Labour Codes have been operationalised by the Central Government, accompanied by Central Rules, while States have progressively notified their respective rules for implementation. This marks one of the most significant reforms in India's labour law landscape.

Code on Wages, 2019

The Code on Wages introduces a uniform legal framework governing payment of wages, minimum wages, bonus and equal remuneration across sectors.

From a governance perspective, the Code promotes:

transparency in wage structures; uniformity in the definition of "wages"; timely payment of salaries;

reduction in wage related disputes; and stronger internal payroll controls.

Boards are expected to ensure that remuneration policies comply with statutory requirements while maintaining fairness and transparency across the organisation.

Industrial Relations Code, 2020

The Industrial Relations Code seeks to balance business flexibility with employee protection by regulating trade unions, industrial disputes, retrenchment and grievance resolution.

For corporate boards, the Code reinforces the importance of:

proactive industrial relations; structured employee grievance mechanisms; transparent disciplinary procedures; workforce restructuring governance; and responsible management of industrial disputes.

Poor industrial relations often lead to operational disruptions, reputational risks and litigation, making board oversight essential.

Code on Social Security, 2020

One of the most significant reforms introduced under the Labour Codes is the expansion of social security coverage beyond traditional employment relationships.

The Code extends the legal framework to cover:

organised sector employees; gig workers; platform workers; unorganised workers; and fixed term employees.

This reflects the changing nature of employment in the digital economy and recognises that workforce welfare is a governance responsibility rather than merely a statutory obligation.

Boards must therefore oversee compliance relating to provident fund, gratuity, employee insurance, maternity benefits and other statutory welfare measures while ensuring appropriate systems for social security compliance.

Occupational Safety, Health and Working Conditions Code, 2020

The Occupational Safety, Health and Working Conditions Code consolidates multiple legislations relating to workplace safety, welfare and working conditions.

The Code places greater emphasis on:

safe workplaces; employee health and well-being; welfare facilities; risk assessments; occupational disease prevention; and employer accountability.

Following the COVID 19 pandemic, workplace health and business continuity have become integral aspects of governance. Boards are increasingly expected to monitor occupational health risks, emergency preparedness and employee well-being as part of enterprise risk management.

Governance Implications of the Labour Codes

The Labour Codes fundamentally transform labour compliance from a documentation exercise into an integrated governance function.

Corporate boards are expected to ensure:

implementation of comprehensive HR compliance frameworks; digital maintenance of employment records; regular compliance audits; effective employee grievance mechanisms; fair employment practices; workforce diversity and inclusion; and periodic reporting on human capital risks.

These expectations also align with SEBI's Business Responsibility and Sustainability Reporting (BRSR) framework, which requires leading listed entities to disclose information relating to employee welfare, occupational safety, diversity, training and inclusion. Consequently, labour compliance now contributes directly to ESG performance and corporate reputation.

As regulatory expectations continue to evolve, boards must view employees not merely as operational resources but as strategic stakeholders whose welfare directly influences organisational resilience, productivity and long-term sustainability.

The POSH Act, 2013 – Workplace Dignity as a Governance Imperative

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 represents one of India's most significant governance legislations aimed at promoting safe and inclusive workplaces. Enacted following the Supreme Court's landmark judgment in Vishaka v. State of Rajasthan, the Act transformed workplace safety from an employment issue into a matter of organisational governance.

The legislation imposes positive obligations upon employers to prevent sexual harassment, establish an Internal Committee, conduct awareness programmes, investigate complaints in a fair and confidential manner and submit annual reports regarding compliance.

Unlike many employment statutes that merely prescribe procedural compliance, the POSH Act requires organisations to foster a culture of dignity, equality and respect. Failure to do so may result not only in statutory penalties but also significant reputational damage, loss of investor confidence and erosion of employee trust.

From a governance perspective, boards should not treat POSH compliance as an isolated HR responsibility. Instead, they should receive periodic reports regarding:

constitution and functioning of the Internal Committee;

number and status of complaints;

awareness and sensitisation programmes;

policy implementation; and

broader workplace culture indicators.

Regular oversight enables boards to identify systemic issues before they escalate into significant legal or reputational risks.

Increasingly, investors and ESG rating agencies consider workplace culture, diversity, inclusion and employee well-being as indicators of sound governance. A robust POSH framework therefore contributes not only to statutory compliance but also to organisational resilience, talent retention and sustainable business performance.

Corporate governance is no longer limited to shareholder interests. Modern governance frameworks emphasize stakeholder protection, including employee welfare.

Various labour laws and social security legislations govern:

• Employee compensation;
• Working conditions;
• Provident fund contributions;
• Employee State Insurance obligations;
• Prevention of workplace harassment;
• Occupational safety standards.

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, in particular, places direct responsibilities on employers and boards to establish robust grievance redressal mechanisms.

Governance failures in employee welfare often translate into legal liabilities, reputational damage, and reduced organizational trust.

Environmental Laws and ESG Governance

Corporate governance has traditionally focused on financial accountability and regulatory compliance. However, increasing concerns relating to climate change, environmental degradation and sustainable development have significantly expanded the responsibilities of corporate boards. Environmental compliance is no longer viewed merely as a statutory obligation but as an integral component of enterprise risk management and long-term value creation.

India's environmental regulatory framework comprises several legislations, including the Environment (Protection) Act, 1986, the Water (Prevention and Control of Pollution) Act, 1974, the Air (Prevention and Control of Pollution) Act, 1981, the Hazardous and Other Wastes (Management and Transboundary Movement) Rules, 2016, the Plastic Waste Management Rules, 2016, and the E-Waste Management Rules, among others. These statutes collectively regulate pollution control, waste management, environmental clearances and responsible utilisation of natural resources.

From a governance perspective, environmental compliance extends beyond obtaining statutory approvals. Boards are increasingly expected to identify environmental risks, monitor sustainability initiatives and integrate climate related considerations into corporate strategy. Environmental incidents can result in substantial financial penalties, operational disruptions, reputational damage and loss of investor confidence, thereby making environmental governance a strategic priority.

ESG as a Governance Framework

The emergence of Environmental, Social and Governance (ESG) principles has fundamentally reshaped corporate governance. Investors no longer assess companies solely on financial performance but also evaluate how responsibly organisations manage environmental risks, workforce welfare, ethical conduct and governance structures.

In India, this shift is reflected in SEBI's Business Responsibility and Sustainability Reporting (BRSR) framework, which requires leading listed entities to disclose qualitative and quantitative information on sustainability practices, greenhouse gas emissions, energy consumption, employee welfare, diversity, supply chain management and corporate ethics.

Unlike traditional Corporate Social Responsibility (CSR), ESG represents an enterprise wide governance philosophy integrated into business strategy and risk management. Boards are therefore expected to oversee sustainability objectives, monitor ESG performance indicators and ensure that public disclosures accurately reflect organisational practices.

Climate Risk and Board Accountability

Climate change presents significant strategic and financial risks for businesses. Physical risks arising from extreme weather events, supply chain disruptions and resource scarcity, together with transition risks associated with evolving environmental regulations and changing consumer expectations, require active board oversight.

Increasingly, boards establish dedicated sustainability committees or assign ESG oversight to existing committees to monitor climate related risks, environmental compliance and Increasingly, boards establish dedicated sustainability committees or assign ESG oversight to existing committees to monitor climate related risks, environmental compliance and sustainability targets. Transparent environmental reporting also enhances investor confidence and supports long term business resilience.

Data Protection and Digital Governance

The digital economy has transformed personal data into one of the most valuable corporate assets. Consequently, data protection has emerged as a critical governance issue affecting virtually every business sector.

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes India's first comprehensive legal framework governing the processing of digital personal data. The legislation seeks to balance individuals' right to privacy with the legitimate need of organisations to process personal data for lawful purposes.

The constitutional foundation for data protection was laid by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), wherein the Court recognised privacy as a fundamental right under Article 21 of the Constitution. The DPDP Act operationalises this constitutional principle by prescribing obligations for organisations that collect and process personal data.

Governance Responsibilities under the DPDP Act

The Act imposes several governance obligations upon organisations, including:

processing personal data only for lawful purposes;

implementing appropriate technical and organisational safeguards;

maintaining transparency regarding data processing activities;

protecting children's personal data where applicable;

establishing mechanisms for responding to data breaches; and

complying with directions issued by the Data Protection Board of India.

For entities notified as Significant Data Fiduciaries, additional governance responsibilities may include appointment of a Data Protection Officer, periodic data audits and enhanced compliance mechanisms.

Board Oversight of Data Governance

Data breaches now represent significant legal, operational and reputational risks. Consequently, boards must ensure that cybersecurity, privacy compliance and data governance form part of the organisation's enterprise risk management framework.

Effective governance requires periodic reporting on cyber risks, incident response mechanisms, vendor risk management, employee awareness programmes and compliance audits. Boards should also oversee contractual safeguards with third party processors to ensure continued compliance throughout the data processing lifecycle. Data governance has therefore evolved from an IT function into a core board responsibility.

Information Technology Act, 2000 and Cybersecurity Governance

Even prior to the enactment of the DPDP Act, the Information Technology Act, 2000 established the legal framework governing electronic records, cyber offences and intermediary liability. Section 43A of the Act, together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, required body corporates to implement reasonable security practices for protecting sensitive personal information.

Today, cybersecurity is recognised as an essential component of corporate governance. Cyberattacks, ransomware incidents and data breaches may result in significant financial losses, regulatory scrutiny and erosion of customer trust.

Boards are therefore expected to oversee cybersecurity strategy; business continuity planning; disaster recovery mechanisms; third party technology risks; employee cyber awareness; periodic vulnerability assessments; and incident response frameworks.

Increasingly, cybersecurity is viewed alongside financial and operational risks within enterprise risk management programmes.

Artificial Intelligence and Emerging Governance Challenges

The rapid adoption of Artificial Intelligence (AI) introduces new governance challenges concerning algorithmic bias, transparency, accountability and responsible use of data. Although India does not yet have a dedicated AI legislation, boards are increasingly expected to establish governance policies regulating ethical AI deployment, automated decision-making and responsible innovation.

Forward looking governance therefore requires organisations to anticipate emerging technological risks rather than merely responding to regulatory developments.

Anti-Corruption and Ethical Governance

Financial Integrity and Ethical Governance

Corporate governance is fundamentally built upon transparency, accountability and ethical conduct. The Prevention of Money Laundering Act, 2002 (PMLA) strengthens these principles by preventing the laundering of proceeds of crime and imposing compliance obligations upon reporting entities.

Although the Act primarily applies to banks, financial institutions, intermediaries and other notified entities, its governance principles extend across the corporate sector. Boards increasingly recognise that weak anti money laundering controls expose organisations to regulatory enforcement, financial penalties and severe reputational damage.

Governance Responsibilities

Effective governance under PMLA requires organisations to implement robust systems for customer due diligence (KYC); beneficial ownership identification; transaction monitoring; maintenance of statutory records; reporting suspicious transactions; employee training; and independent compliance reviews.

The board must establish an organisational culture that promotes ethical business conduct and zero tolerance towards money laundering, bribery and financial misconduct.

Whistle-blower Mechanisms and Ethical Culture

Corporate misconduct often comes to light through internal disclosures. Accordingly, effective whistle-blower mechanisms have become an indispensable element of modern governance.

The Companies Act, 2013 and the SEBI LODR Regulations require specified companies to establish vigil mechanisms enabling employees and stakeholders to report misconduct without fear of retaliation.

Boards should ensure that whistle-blower complaints are investigated independently, corrective actions are implemented promptly and employees remain protected against victimisation. A strong ethical culture reduces compliance risks and strengthens stakeholder confidence.

The Board’s Expanding Role

The increasing convergence of company law, securities regulation, taxation, labour laws, environmental legislation, data protection and financial crime laws has fundamentally transformed the role of corporate boards in India. Traditionally, boards were expected to supervise financial reporting and ensure statutory compliance. Today, however, boards are expected to function as strategic stewards responsible for enterprise wide governance, ethical leadership, risk oversight and sustainable value creation.

This evolution reflects a broader shift in regulatory philosophy. Governance is no longer assessed solely by whether a company complies with applicable laws; rather, regulators, investors and stakeholders increasingly evaluate how companies are governed. Consequently, directors are expected to demonstrate diligence, independence, transparency and accountability while balancing the interests of shareholders, employees, creditors, customers, regulators and society.

Enterprise Risk Management (ERM)

One of the most significant developments in modern corporate governance is the integration of Enterprise Risk Management (ERM) into board oversight. Risks facing organisations are no longer limited to financial reporting or statutory non-compliance. Businesses today confront cybersecurity threats, climate related risks, supply chain disruptions, geopolitical uncertainties, technological changes, regulatory investigations and reputational challenges.

Accordingly, boards are expected to establish structured risk management frameworks capable of identifying, assessing, mitigating and monitoring risks across all business functions. Listed entities are additionally required under the SEBI (LODR) Regulations, 2015 to constitute Risk Management Committees and periodically review enterprise wide risks.

An effective ERM framework enables boards to move beyond reactive compliance and adopt a proactive approach to governance by embedding risk considerations into strategic decision making.

Compliance Management Systems

As regulatory obligations continue to expand, organisations increasingly rely upon integrated Compliance Management Systems (CMS) to ensure continuous monitoring of legal and regulatory requirements.

A robust compliance framework generally includes identification of applicable laws and regulations; compliance calendars; allocation of responsibilities; internal reporting mechanisms; periodic compliance certifications; internal audits; corrective action plans; and board level compliance reporting.

Such systems enable organisations to identify compliance gaps at an early stage and minimise regulatory exposure.

Conclusion

Corporate governance in India has evolved far beyond the traditional confines of the Companies Act, 2013. While the Act continues to provide the statutory foundation for corporate regulation, the governance obligations of modern enterprises are increasingly shaped by a network of allied legislations governing securities markets, foreign exchange, taxation, labour relations, environmental sustainability, data privacy, competition law and financial integrity.

Collectively, these laws establish an integrated governance ecosystem that extends beyond legal compliance to encompass ethical leadership, risk management, transparency, sustainability and stakeholder accountability. They also reflect a broader shift from shareholder centric governance towards a stakeholder-oriented model that recognises employees, customers, regulators, communities and the environment as integral participants in corporate success.

The role of the Board has correspondingly undergone a profound transformation. Directors are no longer expected merely to supervise statutory compliance; they are required to exercise informed judgment, oversee enterprise-wide risks, promote ethical organisational culture, ensure regulatory compliance across multiple legal domains and integrate sustainability into corporate strategy.

Recent developments such as the Labour Codes, the Digital Personal Data Protection Act, 2023, SEBI's enhanced disclosure framework and the growing importance of ESG reporting demonstrate that governance expectations will continue to expand alongside evolving business risks. Boards must therefore adopt a dynamic and integrated approach that combines legal compliance with effective risk management, technological resilience, responsible employment practices and environmental stewardship.

Ultimately, good corporate governance is not measured by the number of laws a company complies with, but by the effectiveness with which it embeds transparency, accountability, integrity and sustainability into its decision-making processes. In an increasingly interconnected regulatory landscape, organisations that embrace integrated governance are better positioned to mitigate risk, strengthen stakeholder trust and achieve sustainable long term value creation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.