SDD Certificate: What Exchanges Check & How to Prepare

InsiderQ • SDD Certificate • 9 min read

Months after a financial year ends, a compliance officer is asked to show the evidence behind the company's SDD certificate. The Structured Digital Database (SDD) should hold it: a record of who shared unpublished price sensitive information (UPSI), with whom and when. Instead, the officer finds partial spreadsheet entries, email threads and timestamps nobody can explain.

Under Regulation 3(5) of the SEBI PIT Regulations, 2015, maintaining the SDD is a substantive obligation, not paperwork. An SDD certificate is only as credible as the database behind it; certification depends on examining that database and its evidence, not simply producing a document. Missing details, inconsistent timestamps, incomplete sharing records and weak audit trails all make verification harder.

What Is an SDD Certificate and Why Does It Matter?

Quick answer: An SDD certificate is an annual confirmation that the Structured Digital Database has been maintained. Maintaining the database is the obligation; the certificate attests to that maintenance and does not replace it.

Regulation 3(5) requires the board of directors, or the head of the organisation, to ensure a structured digital database is maintained. It must contain the names of those who shared UPSI and those who received it, with PAN or another permitted identifier, and the nature of the information. Regulation 3(6) requires preservation for not less than eight years after completion of the relevant transactions.

The exchanges' circulars of 18 October 2024 (NSE/CML/2024/31 and BSE notice 20241018-44) set out the confirmation process. As summarised in an ICSI advisory, entities subject to Regulation 24A of the LODR Regulations confirm SDD status in the Annual Secretarial Compliance Report, while others submit a certificate from a Practising Company Secretary (PCS), within sixty days of the financial year-end. Non-compliant entities certify quarterly until they comply. Check the current circular text for your category.

The certificate is a professional confirmation of database maintenance. SEBI does not certify or approve SDD software, and no certificate guarantees immunity from regulatory action.

What Do Exchanges and Certifying Professionals Check?

Quick answer: They look for proof that the SDD exists, captures the required UPSI records with dates and times, restricts access, keeps an audit trail and can be reviewed with verifiable evidence.

The NSE's PCS format lists six confirmations:

1. The company has a Structured Digital Database in place.
2. Control exists as to who can access it.
3. All UPSI disseminated in the period has been captured.
4. The system captures the nature of UPSI with date and time.
5. The database is maintained internally and an audit trail is maintained.
6. The database is non-tamperable and can retain records for eight years.

These are the explicit certification points. Beneath them sit practical, recommended internal checks, not prescribed formats: reports, logs, user lists and reconciliations a professional may reasonably request.

To see how each point maps to evidence, read this SDD certification checklist for Practising Company Secretaries. Questions about obligations or inspection evidence may be answered in the SDD and SEBI PIT compliance FAQs.

The SDD Records Every Compliance Team Should Be Able to Retrieve

Quick answer: A company should be able to retrieve complete, consistent UPSI records and explain the sequence of information-sharing events: what was shared, by whom, with whom, when and through which channel.

A usable record shows the nature of the UPSI, the sender and recipient, their PAN or other permitted identifier and a reliable date and time. Recording the mode of sharing is good practice. Together, entries build a chronology of who knew what, and when. Fields need not be repeated in every record unless the rule requires it, but each entry must stand up to review.

Consider draft quarterly results. The CFO emails them to the auditor on a Tuesday evening. A week later, the entry reads "financial information shared with auditors", with no recipient names, no identifier and a date reflecting when someone typed it into a sheet. Months on, nobody can tell who received the draft or whether the entry was later changed. Nothing proves wrongdoing, but the verification gap is real.

Common SDD Gaps That Can Delay Certification

Quick answer: Incomplete records, unexplained inconsistencies and unreliable audit trails make it harder to establish that the database has been properly maintained, even when there was no intent to conceal anything.

Not every gap is a violation, but each adds friction:

• Inconsistent sender or recipient details. The same person appears under different names or without identifiers, so the chronology cannot be reconciled.
• Vague UPSI descriptions. Entries omitting the nature of the information are hard to match with board or event records.
• Unreliable timestamps. If dates can simply be typed in, a reviewer cannot confirm when sharing was recorded. InsiderQ's PCS guidance notes that SEBI has issued an administrative warning where entries were accurate but late.
• Fragmented records. Spreadsheets, emails and personal files force manual reconciliation.
• Untraceable corrections. An overwritten cell leaves no history of what changed or who changed it.
• Slow historical retrieval. Records that take days to assemble weaken confidence in the whole database.
• Unclear access and ownership. If no one is clearly responsible for entries, or leavers retain access, the access-control confirmation is hard to support.

How to Prepare for SDD Certification Before the Deadline

Quick answer: Run an evidence-led readiness review well before certification, instead of waiting until the certifying professional asks for documents. Test the database against current requirements and fix gaps early.

No internal checklist is officially prescribed; this sequence reflects sound practice:

1. Identify the review period and the reporting route that applies to your entity.
2. Review the database against the current certification requirements, including the six points above.
3. Check completeness and consistency by reconciling UPSI entries against board meetings, results, fund-raising and other price-sensitive events.
4. Examine timestamps, correction history and audit logs on a sample of entries.
5. Confirm access controls and who maintains entries. Remove dormant or leaver accounts.
6. Prepare reports and supporting evidence, such as UPSI statements, audit logs and user lists.
7. Record unresolved gaps, assign owners and document corrective action.
8. Coordinate with the PCS early, using the current applicable certification framework.

Timeliness deserves attention. InsiderQ's summary of the 2025 amendment to Regulation 2(1)(n) says deemed UPSI categories expanded, and externally sourced information may need entry within two calendar days of receipt. Verify the wording against the notified text.

Can Manual SDD Records Keep You Ready?

Quick answer: Manual processes can work only if they deliver the required controls, but they typically add reconciliation and traceability work, especially when records are fragmented, frequently updated or hard to retrieve.

No rule makes every spreadsheet automatically unlawful. The test is whether the database provides internal controls, time stamping and audit trails, and whether the organisation can demonstrate them. A shared file anyone can edit without trace struggles on each count.

Compare the two approaches:

• Consistency: Spreadsheets depend on user discipline; a controlled workflow can enforce required fields.
• Timestamping: Typed dates are weak evidence; system-applied timestamps are stronger.
• Retrieval: Spreadsheets scatter across inboxes; a central database can filter by period, person or event.
• Audit history: Spreadsheet edits are often invisible; a controlled workflow can log each action.
• Access management: File permissions are blunt; role-based access separates users and certifiers.

Internal control matters just as much. Regulation 3(5) says the database shall not be outsourced and shall be maintained internally. SEBI's FAQs of 31 December 2024, as summarised by InsiderQ, focus on who can access the records, not only where they are hosted. Whatever the deployment model, assess how it protects confidentiality, integrity and access, and understand who controls and accesses your SDD data.

How SDD Software Can Strengthen Readiness

Quick answer: Suitable SDD software can support structured recordkeeping, retrieval and auditability, but the organisation remains responsible for its compliance obligations and for the accuracy of what is entered.

InsiderQ is an SDD and UPSI management solution built around Regulation 3(5). According to its website, it logs each UPSI sharing with sender, recipient, nature of the information and a system timestamp, and produces a UPSI Statement and an Audit Logs report exportable to PDF or Excel. It offers defined user roles, including a separate PCS login, and states that it is deployed on infrastructure the client controls, with no administrative credentials retained after handover.

These features support evidence preparation, such as reconciling a period's UPSI Statement against the company's own list of price-sensitive events. See SDD software for listed companies.

Some limits deserve plain statement. No SEBI approval or certification exists for SDD software. InsiderQ cannot guarantee certification or prevent every breach, and it does not replace professional judgement, accurate data entry or the organisation's responsibility. If any vendor claims otherwise, ask it to name the certifying body.

Make SDD Readiness a Continuous Practice

Quick answer: Treat SDD maintenance as an ongoing discipline, with regular checks of records, controls and retrieval capability throughout the year rather than a scramble before certification.

Readiness comes down to five habits: record sharing events promptly; keep identifiers and descriptions consistent; protect access and audit trails; test retrieval periodically; and close logged gaps.

A short quarterly review of sample entries, user access and a trial retrieval exposes problems while they are cheap to fix. See these practical guides to SDD and UPSI compliance.

Assess your current SDD process this quarter. To see structured UPSI recordkeeping in practice, explore InsiderQ's UPSI management solution or request a walkthrough.

This article is educational. Regulations and circulars change, so verify current requirements with your compliance adviser or certifying professional.

Krishna Thosar