POSH Act Compliance Guide: What Indian Employers Actually Need to Do
Most employers know the POSH Act requires an Internal Committee. Fewer know the committee needs a fixed term, that the annual filing deadline genuinely isn’t the same date everywhere, or that the Supreme Court has spent the better part of the last year actively pushing states to check whether companies have even set one up. This guide covers the mechanics most HR teams need day to day, cites the actual sections behind each requirement, and is honest about the handful of points where the Act itself leaves room and practice varies.
Who needs an Internal Committee
Any workplace with 10 or more employees must constitute an Internal Committee (IC), sometimes still called an Internal Complaints Committee. Below that threshold, complaints go to the district’s Local Committee instead, set up by the District Officer under the Act, not something the employer runs. Coverage under the Act is broad by design: it applies to permanent, temporary, contract and apprentice employees, and to any complainant present at the workplace regardless of employment status.
How the IC has to be composed
Under Section 4 of the Act, the IC must include:
- A Presiding Officer, a senior woman employee (if no sufficiently senior woman is employed at that office, one can be nominated from another office of the same organisation)
- At least two employee members, ideally with a background in social work or legal knowledge
- One external member, from an NGO or association committed to women’s causes, or someone familiar with sexual harassment law
The committee’s term is capped at three years under Section 4(3). This is a statutory limit, not a matter of internal policy, so an IC that’s been running unchanged for five or six years is technically operating outside the Act even if nobody has challenged it yet.
What the policy itself needs to cover
A POSH policy on paper isn’t the same as compliance, but it’s the documented backbone the rest of the process hangs off: the definition of sexual harassment as used in the Act, how to file a complaint and with whom, the IC’s composition and contact details, the timeline for resolution, and the confidentiality obligation under Section 16, which prohibits publishing or disclosing details of a complaint, the respondent’s identity, or the inquiry’s proceedings.
The complaint and inquiry process
A complaint must generally be filed within three months of the incident, extendable by the IC where there’s reasonable cause for delay. Once filed, the IC has 90 days to complete its inquiry, a timeline that’s widely cited but worth building real process discipline around, since a slow inquiry is one of the more common ways employers end up in front of a labour court regardless of how the underlying facts play out. Sections 10 and 11 also allow for conciliation at the complainant’s request before a full inquiry, though this route cannot be used to resolve a monetary settlement.
The annual report, and a real ambiguity worth knowing about
Every IC must submit an annual report to the employer and to the District Officer under Section 21. Most guidance defaults to a 31 January deadline, but this isn’t uniform: some districts, Gurugram among them, allow filing until the end of February. If you operate across multiple districts, checking your specific district’s actual cutoff is worth the ten minutes it takes, rather than assuming the commonly quoted date applies everywhere.
A second, genuinely unresolved point: several states have pushed employers toward registering their IC on the SHe-Box portal, and current guidance from POSH-focused legal practitioners suggests SHe-Box today mainly confirms that a filing happened rather than serving as the filing mechanism itself. If your compliance team is unsure whether SHe-Box replaces the physical or emailed report to your District Officer, that uncertainty is shared broadly right now, not a gap specific to your organisation.
Penalties for non-compliance
Section 26 sets a fine of up to ₹50,000 for an employer’s first failure to constitute an IC, adopt a policy, or otherwise comply. A repeat offence within a defined period escalates to a higher fine and can extend to cancellation or non-renewal of business licences or registration, and disqualification from government tenders. The exact enhanced-fine figure for repeat offences isn’t fixed at a single rupee amount in the way the first-offence fine is, so treat any specific number you see for that tier with caution unless the source cites the section directly.
What’s changed recently and why “2026” isn’t just a marketing date
This isn’t a static area of law right now. Following Aureliano Fernandes v. State of Goa, the Supreme Court ordered a six-week, district-wise compliance survey around August-September 2025 after finding widespread failure to even set up ICs. A further Supreme Court direction in January 2026 sought structured updates on implementation, and the Court has also clarified that a complainant can approach her own workplace’s IC even where the respondent works at a different location within the same organisational group, relevant for any company with more than one legal entity or office. Separately, amendments to company-law disclosure rules effective mid-2025 now require sexual-harassment-related disclosures in the Board’s Report for applicable companies, a compliance link that sits outside the POSH Act itself but is easy to miss.
A working compliance checklist
- IC constituted with the correct composition, and its three-year term tracked so it doesn’t quietly lapse
- Written policy circulated to all employees, referencing the correct complaint channel and timeline
- Awareness training conducted, not just documented as a one-time onboarding slide
- Annual report filed with your specific district’s actual deadline, not an assumed national one
- A documented process for tracking the 90-day inquiry timeline on any live complaint
Frequently asked questions
Does a company with under 10 employees need to do anything at all?
Yes, though not an IC. Complaints from employees at very small establishments go to the district’s Local Committee, and awareness of that pathway is still worth building into onboarding even without an in-house committee.
Can the same IC serve multiple office locations?
The Presiding Officer is meant to be a senior woman at that specific workplace; where none is available, one can be nominated from elsewhere in the organisation. Many multi-location employers run separate ICs per location rather than one committee covering everything, partly for exactly this reason.
What happens if the IC’s three-year term lapses without reconstitution?
The Act doesn’t spell out an automatic penalty for a lapsed term specifically, but operating with an expired IC undermines the compliance defence a properly constituted one provides, and would likely be treated the same as not having one at all if challenged.
Is training legally mandatory, or just good practice?
The Act requires the employer to organise workshops and awareness programmes, so it’s a statutory obligation, not optional best practice, even though enforcement of the training requirement specifically tends to be less visible than enforcement around IC formation itself.
Does a contractor or vendor employee working on-site fall under our POSH policy?
The Act’s protection extends broadly to anyone present at the workplace, which includes contract staff and visitors in many circumstances, so most employers apply their policy and IC access to on-site contractors even though the employment relationship sits with a different entity.
POSH policy sits naturally alongside the rest of your employee handbook, and complements the broader legal-ethics ground covered in our HR ethics guide and the distinction between harassment and workplace bullying.
- Best Staffing and Recruitment Agencies in India - September 15, 2026
- Right to Disconnect in India: Where the Law Actually Stands - September 15, 2026
- AI in HR and Recruitment: What’s Actually Real in 2026 - September 15, 2026
