Is moonlighting illegal in India?

Moonlighting is generally a contractual matter rather than a criminal one for private-sector office employees. Most Indian employment contracts contain an exclusivity or full-time-attention clause, and breaching it is a disciplinary issue under the contract. Specific statutory restrictions can apply in particular sectors and categories of employment, so check your own contracts and the rules applicable to your industry.

How did Indian IT companies detect moonlighting?

Primarily through provident fund records. Where two employers both make EPF contributions for the same person, that duplication is visible in the EPFO's own data, and reporting from 2022 describes the EPFO running de-duplication checks and notifying employers. It was a payroll and records signal, not something found by watching desktops.

Can employee monitoring software detect moonlighting?

Poorly, and only in narrow cases. A second job done on a personal device, outside your working hours, is invisible to an agent on a company laptop. What monitoring can show is company equipment being used for work that is not yours — which is a different and much narrower finding than dual employment.

What should a moonlighting policy say?

Whether secondary employment is permitted, prohibited or allowed with written approval; what counts as a conflict of interest; the rules on using company equipment, data and time; and the disclosure process. Ambiguity is what produces disputes, and a policy that simply says nothing is the worst position of the three.

Should employers ban moonlighting outright?

It depends on the work and the market. Blanket bans are common in Indian IT because of client confidentiality and conflict-of-interest obligations, but they are harder to enforce than to write, and they push disclosure underground. A permission-based policy gets you visibility; a prohibition gets you deniability.

Moonlighting: What Indian Employers Can Actually Detect

The 2022 terminations were found in provident fund records, not monitoring software. What detection really looks like, and why it is a policy problem.

In September 2022 Wipro's chairman said the company had discovered around 300 employees working for competitors and had terminated them. Infosys confirmed dismissals of its own without giving a number. The episode shaped how Indian IT talks about moonlighting, and it also produced a persistent misconception about how it was found.

It was not found with monitoring software. It was found in provident fund records.

That detail matters more than anything else in this article, because it tells you where the detectable signal actually lives — and it is not on the desktop.

How detection actually works

If a person is formally employed by two organisations and both run payroll properly, both make EPF contributions against the same universal account number. That duplication exists in the EPFO's records by construction. Reporting from the period describes the EPFO running de-duplication checks across contributions and notifying employers where a worker appears under more than one.

So the strongest detection mechanism in India is an artefact of the social security system, and it requires no surveillance at all.

It also has a specific and important limitation. It only catches formal dual employment. It does not catch freelance or consulting work billed on invoice, work paid through a family member's account, equity-only arrangements at a startup, or anything in the informal economy. A large share of what employers worry about when they say moonlighting falls outside EPF entirely.

Which means the thing most employers reach for — monitoring software — is being asked to cover exactly the cases the reliable mechanism misses, and it is bad at them.

What monitoring can and cannot see

Be precise about this, because vendors in this market are not.

An activity agent on a company laptop can see that company laptop. If someone is doing a second job on your hardware during your hours, that is detectable: unfamiliar applications, a second IDE with a different repository, sustained activity in a tool nobody on the project uses, VPN clients you did not deploy.

What it cannot see is the far more common pattern: a second job on a personal machine, in the evening, on the person's own network. There is no agent there, there should not be one, and in most jurisdictions putting one there is legally difficult and practically worse.

So the honest statement is that monitoring detects misuse of company equipment. That is a real thing to care about, and it is a narrower claim than detecting moonlighting. Conflating the two leads organisations to deploy intrusive collection that cannot answer the question they bought it for — and under the DPDP Act, collecting more than the purpose requires is its own problem. Our DPDP guide covers the minimisation duty.

The question underneath the question

Worth separating two concerns that get bundled together, because they have different answers.

Conflict of interest and confidentiality is the serious one, and it is the reason Indian IT services companies take this as hard as they do. If an engineer on a client project is simultaneously working for that client's competitor, you have a contractual exposure to your client that dwarfs any productivity question. Your master services agreements very likely contain obligations you cannot meet if this is happening. That is a genuine business risk and it justifies real controls.

Divided attention is the softer one: the worry that someone with two jobs is doing yours at half strength. This sounds like the same problem and is not. If output is inadequate, that is a performance conversation with evidence you already have, and it is the same conversation whether the cause is a second job, a sick parent or disengagement. You do not need to establish moonlighting to address underperformance, and trying to turns a manageable discussion into an investigation.

Most organisations would get more from controls aimed squarely at the first and ordinary management aimed at the second. Our piece on time theft as a framing covers why the adversarial version of the second conversation tends to backfire.

What a workable policy contains

Ambiguity is what creates disputes here. Three postures are defensible; silence is not.

Outright prohibition is common in Indian IT and is the simplest to administer. Its cost is that it drives disclosure underground — people with second jobs do not stop, they stop telling you — so your actual visibility goes down.

Permission-based is usually better. Secondary work is allowed with written approval, assessed against a stated conflict test. You get disclosure, you get to refuse the genuinely problematic cases, and you have a clean disciplinary footing when someone does not ask.

Sector-limited sits in between: prohibited for client-facing or confidential project work, permitted elsewhere. More administration, better fit to the actual risk.

Whichever you pick, the policy needs to cover what counts as a conflict, the rules on company equipment, data and working hours, the disclosure route, and the consequence of non-disclosure. Put the equipment rules in the same document as your monitoring policy so people are not reconciling two sets of expectations — our policy template is a reasonable base.

Getting the employment-law part right

Two things to take advice on rather than assume.

The enforceability of your exclusivity clause, which turns on its drafting and on the category of employment. "It is in the contract" is a weaker position than most employers expect, and termination on that basis has been litigated.

And the process. A termination for moonlighting is a termination, with whatever procedural obligations attach to the role and jurisdiction. Companies that got this wrong in 2022 generally got the process wrong rather than the substance.

Separately, if your detection relies on personal data — EPF notifications, monitoring output — the DPDP Act's purpose limitation applies to it. Data collected for workforce analytics being repurposed into a moonlighting investigation is a new purpose, and it needs its own footing and notice rather than inheriting the old one.

Where ProdView fits

ProdView measures activity and application metadata on company-managed devices, so it will show company equipment being used for work that is not yours. That is a legitimate thing to know and we are reasonably good at surfacing it as part of ordinary usage analytics.

When not to pick us as a moonlighting tool: we are not one, and nothing in this category honestly is. We do not capture screen content or keystrokes, we cannot see a personal device, and we would not recommend deploying analytics with dual-employment detection as the stated purpose — it is a weak purpose under DPDP minimisation and it poisons the rollout for everyone. If formal dual employment is your concern, your payroll and EPF records are the stronger instrument, and they are already in your possession.

Try before you commit

Three seats are free forever if the underlying question is actually about capacity and equipment use rather than second jobs. The ROI calculator is free and needs no signup.

The 2022 terminations and the EPFO de-duplication mechanism are as reported contemporaneously; the legal position on exclusivity clauses is general information and not legal advice. Take Indian employment counsel before acting on a specific case.