Introduction
POSH Act compliance is one of those obligations founders assume — wrongly — applies only to large corporates with dedicated HR departments — right up until they cross ten employees and realize it applies to them too, immediately, with no grace period. I advise businesses on employment law regularly, and gaps in POSH Act compliance are what I see most often, not because employers are careless, but because most of what’s published on POSH Act compliance is either outdated or focuses narrowly on forming a committee while missing the annual cycle of obligations that actually keeps a business compliant. This guide covers everything: who the Act applies to, how to properly constitute an Internal Committee, what a compliant policy actually needs, the complaint timeline, annual reporting, and a 2025 rule change connecting POSH Act compliance directly to Companies Act penalties — something most currently published guides still don’t mention.
POSH Act Compliance: What the Law Requires and Who It Applies To
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 applies to every workplace in India with 10 or more employees, across every sector — private companies, LLPs, partnership firms, startups, NGOs, hospitals, and educational institutions alike. The employee count that triggers this obligation includes regular staff, temporary and contract workers, and interns, counted per workplace location rather than as a single company-wide total — meaning a business with multiple offices may need to constitute a separate Internal Committee at each location that independently crosses the ten-employee threshold. “Workplace” itself is defined broadly under the Act to include any place visited by an employee during the course of employment, including client sites and work-related travel, not just the physical office.
POSH Act Compliance Step One: Forming an Internal Complaints Committee (ICC)
Under Section 4, every employer meeting the threshold must constitute an Internal Committee (commonly still called the ICC, though the Act itself refers to it as the “Internal Committee”) through a formal, written order. Getting the composition right is where POSH Act compliance most commonly goes wrong at the formation stage:
- A Presiding Officer — a senior woman employee at the workplace. If no sufficiently senior woman employee is available, the Act requires nominating one from another office of the same organisation.
- At least two internal members, employees committed to the cause of women or with experience in social work or legal knowledge.
- One external member, mandatorily from an NGO or association committed to the cause of women, or someone familiar with sexual harassment issues — this external seat is not optional, and its absence is one of the most common technical defects found in improperly constituted committees.
- At least 50% of total ICC membership must be women.
- A three-year term, after which the committee must be reconstituted.
Skipping the external member, or treating the role as a formality filled by someone without genuine independence from the organisation, is a defect that can undermine the legitimacy of any inquiry the committee later conducts — a much costlier problem to discover after a complaint has already been filed than at the formation stage.
POSH Act Compliance Step Two: Drafting a Policy That Actually Works
A written POSH policy — distinct from simply having a constituted committee — should clearly define what constitutes sexual harassment consistent with the Act’s language, name the current ICC members and how to reach them, set out the complaint procedure and timelines, describe confidentiality obligations under Section 16, and specify the consequences of both substantiated harassment and, separately, of filing a false or malicious complaint. This policy needs to actually be communicated and displayed, not just drafted and filed away — Section 19(a) specifically requires employers to prominently display the penal consequences of sexual harassment and the order constituting the Internal Committee at conspicuous places in the workplace.
The Complaint and Inquiry Process: The Timelines That Actually Matter
POSH Act compliance isn’t just about having the right documents in place — it’s about the process working correctly under pressure, within statutory timelines that don’t bend for a busy quarter:
- A complaint must generally be filed within three months of the incident (extendable by the ICC in appropriate circumstances).
- The ICC has 90 days to complete its inquiry once a complaint is received.
- Following the inquiry, the ICC must submit its report with recommendations within 10 days of completing it.
- The employer then has 60 days from receiving the report to act on the ICC’s recommendations.
- Before a formal inquiry, the complainant may request conciliation as a first step — though this option cannot be used to pressure a settlement, and no monetary settlement can be the sole basis of conciliation.
Missing these windows, particularly the 60-day employer action deadline, is itself a distinct POSH Act compliance failure under Section 26, separate from whatever the underlying complaint concerned.
Employer Obligations Beyond the Committee: Section 19
Section 19 sets out a broader list of employer duties that go well past simply having a committee on paper, and this is where a surprising number of otherwise compliant-looking businesses fall short:
- Organising regular workshops and awareness programmes for employees, at intervals frequent enough to be genuinely meaningful rather than a single onboarding-day mention.
- Providing the ICC with reasonable assistance to secure the attendance of witnesses during an inquiry.
- Treating a finding of sexual harassment under the Act as misconduct under the applicable service rules, and initiating action accordingly.
- Monitoring the timely submission of the ICC’s annual report.
POSH Act Compliance and the Annual Report: What Section 21 Requires
Every Internal Committee must prepare and submit a formal annual report for each calendar year, covering the number of complaints received, the number disposed of, cases pending beyond 90 days (with reasons for the delay), the outcome category of inquiries conducted (upheld, dismissed, or settled by conciliation), and the number of awareness workshops held. This report goes to both the employer and the District Officer, and while the exact deadline can vary slightly by state, 31 January is the date most states expect it by. This is not a one-time filing — genuine POSH Act compliance runs on an annual cycle, and treating the annual report as an afterthought is one of the most common and easily avoidable violations under Section 26.
The 2025 Update Most Guides Still Haven’t Caught Up To: Board’s Report Disclosure
This is the single section of POSH Act compliance that changed most meaningfully in 2025, and it’s genuinely underreported in currently published guides. Effective 14 July 2025, Rule 8(5)(x) of the Companies (Accounts) Rules, 2014 requires a company’s Board’s Report to disclose not merely that an Internal Committee exists, but the actual number of sexual harassment complaints received, disposed of, and pending beyond 90 days during the year. This creates a genuinely new, second penalty regime layered directly on top of the existing POSH Act obligations: getting this specific disclosure wrong or omitting it triggers a penalty of up to ₹3,00,000 under Section 134(8) of the Companies Act, 2013, with a further ₹50,000 penalty on every officer of the company in default — entirely separate from and in addition to the ₹50,000 fine already available under Section 26 of the POSH Act itself for the underlying compliance failure. In practice, this means a single lapse — say, an unfiled annual report combined with an inaccurate Board’s Report — can now expose a company to penalties under two completely different statutes simultaneously, a risk that simply didn’t exist in this form before mid-2025.
The Supreme Court’s 2025 Enforcement Push
Adding further weight to the case for taking POSH Act compliance seriously, a 2025 Supreme Court directive prompted a nationwide verification exercise checking whether Internal Committees actually exist and function as required, rather than existing only on paper. This kind of judicial enforcement pressure, combined with state-level audit directives that followed, signals that POSH Act compliance is increasingly being treated as an actively monitored obligation rather than a self-certifying formality — precisely the shift that makes outdated guidance genuinely risky to rely on.
POSH Act Compliance Penalties: The Full Picture
| Violation | First Offence | Repeat Offence |
|---|---|---|
| Failure to constitute the Internal Committee | Fine up to ₹50,000 | Double the penalty, plus possible licence cancellation |
| Failure to act on ICC recommendations within 60 days | Fine up to ₹50,000 | Double the penalty, plus possible licence cancellation |
| Non-filing or incorrect annual report to the District Officer | Fine up to ₹50,000 | Escalated District Officer enforcement action |
| Breach of confidentiality under Section 16 | Penalty per employer’s service rules | Further disciplinary and legal action |
| Incorrect or missing Board’s Report disclosure (Companies Act) | Up to ₹3,00,000 (company) + ₹50,000 per defaulting officer | Enhanced scrutiny, repeated exposure |
Additional Disclosure for Listed Companies
Listed companies carry an additional layer of POSH Act compliance under SEBI regulations, requiring disclosure of POSH compliance status within the annual corporate governance report — a requirement private and early-stage companies don’t face directly, but worth knowing if a startup is on a path toward a public listing down the line.
What Realistic Compliance Actually Costs
For most small and mid-sized businesses, the real cost of first-year POSH Act compliance — covering ICC formation, policy drafting, and initial training — typically runs between ₹15,000 and ₹50,000, with annual recurring costs (refresher training, annual report preparation, ongoing committee administration) generally falling between ₹10,000 and ₹35,000. This is a modest cost relative to the exposure described above, particularly once the 2025 Companies Act penalty layer is factored in.
Common Mistakes Employers Make
- Forming a committee without a genuine external member, treating the role as a formality rather than an independent seat with real substance.
- Counting employees company-wide instead of per workplace, missing that a smaller branch office may independently cross the 10-employee threshold and need its own committee.
- Treating the policy as a one-time document, never updated as committee members change or as the 2025 disclosure requirements evolved.
- Missing the 60-day employer action deadline after receiving ICC recommendations, which is itself a separate violation regardless of how the underlying complaint was handled.
- Overlooking the Board’s Report disclosure entirely, exposing the company to the newer Companies Act penalty on top of any POSH Act exposure.
- Failing to properly document confidentiality obligations, which connects directly to the same principles I’ve covered in drafting a proper NDA in India — Section 16 confidentiality during an inquiry is a distinct legal obligation, but the drafting discipline required is the same.
How POSH Act Compliance Fits Into Broader Employment Documentation
POSH Act compliance doesn’t exist in isolation — it’s one piece of a broader employment law framework that includes properly drafted offer letters, IP assignment clauses covering what employees create, and, where relevant, correctly scoped restrictions on competition that actually hold up under Indian law rather than being void on arrival. Businesses building out remote and distributed teams should note that POSH obligations extend to any location an employee works from or visits in connection with their employment, not just a traditional office setting — a nuance that matters increasingly as hybrid and remote arrangements become the norm rather than the exception.
Conclusion: POSH Act Compliance Is a Cycle, Not a Checkbox
POSH Act compliance isn’t something a business does once and files away — it’s an annual cycle of committee maintenance, policy communication, timely complaint handling, and now, accurate disclosure in two separate regulatory filings rather than one. The 2025 Companies Act amendment makes this more consequential than it used to be, turning what was once a single, relatively contained POSH Act penalty exposure into a dual-statute risk that touches both HR and the boardroom. Getting the Internal Committee composition right, keeping the annual report current, and making sure the Board’s Report reflects accurate numbers isn’t just good governance — it’s now the difference between a modest compliance cost and a genuinely painful penalty exposure. If you need help setting up or auditing your organisation’s POSH compliance framework, you can reach out here, or explore more employment and compliance guides on the blog.
Frequently Asked Questions (FAQ)
1. Does POSH Act compliance apply to small businesses and startups? Yes. Any workplace with 10 or more employees — including regular, temporary, contract staff, and interns — must comply, regardless of whether it’s a startup, LLP, partnership firm, or private limited company.
2. What is the minimum composition required for an Internal Committee? A Presiding Officer who is a senior woman employee, at least two internal members with relevant experience, and one mandatory external member from an NGO or women’s association, with at least 50% of the total committee being women.
3. How long does an employer have to act on ICC recommendations? 60 days from the date the employer receives the Internal Committee’s report, under the Act’s overall complaint and resolution timeline.
4. What is the deadline for filing the POSH annual report? The Internal Committee must submit its annual report to both the employer and the District Officer, with most states expecting submission by 31 January each year, covering the preceding calendar year’s complaint activity.
5. What penalties apply for failing to constitute an Internal Committee? A fine of up to ₹50,000 for a first offence under Section 26 of the POSH Act, doubling for repeat offences, with possible cancellation or non-renewal of the business’s licence or registration in serious or repeated cases.
6. What changed in POSH Act compliance in 2025? Effective 14 July 2025, Rule 8(5)(x) of the Companies (Accounts) Rules, 2014 requires companies to disclose specific sexual harassment complaint numbers in their Board’s Report, with a separate penalty of up to ₹3,00,000 (plus ₹50,000 per defaulting officer) under the Companies Act for incorrect or missing disclosure.
7. Can a single compliance failure trigger penalties under both the POSH Act and the Companies Act? Yes. Since 2025, a lapse like an inaccurate or missing Board’s Report disclosure can expose a company to both the POSH Act’s Section 26 penalty and the Companies Act’s Section 134(8) penalty for the same underlying failure.
8. How often must an Internal Committee be reconstituted? Every three years, as the standard term for Internal Committee members under the Act.
9. Does the POSH Act apply to a company’s branch offices separately? Yes, generally. The 10-employee threshold applies per workplace location, meaning a company with multiple offices may need to constitute separate Internal Committees at each location that independently meets the threshold.
10. What must be included in the ICC’s annual report? The number of complaints received and disposed of, cases pending beyond 90 days with reasons for delay, the outcome category of inquiries conducted, the number of awareness workshops held, and the action taken by the employer on ICC recommendations.
11. Is a POSH policy legally required in addition to forming a committee? Yes. Simply constituting a committee without a written policy communicating the complaint procedure, confidentiality obligations, and consequences of harassment falls short of full compliance, and Section 19(a) specifically requires display of the penal consequences and the committee’s constitution order.
12. What happens if a complaint is filed and the employer fails to provide the Internal Committee with support during the inquiry? This can itself constitute a violation of the employer’s obligations under Section 19, which requires providing reasonable assistance to secure witness attendance and cooperating with the inquiry process, separate from the outcome of the underlying complaint.