Legal basis: Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (Act No. 14 of 2013) — Sections 2, 4, 21, and 26 — Effective: 9 December 2013. Source: official text at indiacode.nic.in (unavailable at time of review; refer to the Act). Last reviewed by CA Harun Raaj: September 2026.
Key point: A POSH policy document is not compliance — the Act requires a validly constituted Internal Complaints Committee with a named external member, and failure to constitute one is a Section 26 offence carrying a fine of up to ₹50,000.
The gap founders don't see coming
A 42-employee SaaS company has an HR policy that says "zero tolerance for sexual harassment" and a POSH training email sent eighteen months ago. The founders consider themselves compliant.
Then a District Officer's show-cause notice arrives — a routine inspection, not a complaint. It asks for two documents: the formal order constituting the Internal Complaints Committee (IC), including the external NGO member's name, and the last annual report filed with the District Officer. Neither exists. The company has never formally constituted an IC, never appointed an external member, and never filed an annual report — a Section 26 violation. The gap between a "policy" and a functioning IC is the most common POSH failure among startups.
Who this applies to
The Act applies to every employer in India — private limited companies, LLPs, partnerships, PSUs — once a workplace crosses ten or more employees (Section 4(1)). "Employer" (Section 2(g)) covers any person responsible for management, supervision, and control of a workplace — in a Pvt Ltd company, this reaches directors and officers personally, not just the corporate entity.
"Workplace" (Section 2(o)) covers the registered office, branches, client premises where employees regularly work, and hybrid arrangements where work is assigned by the employer. Each physical office location is a separate workplace: a company with a Mumbai HQ and a Hyderabad dev centre needs an IC at each location that individually crosses ten employees.
Section 4: what a valid IC actually needs
Section 4(2) prescribes a specific composition. A policy document that hasn't set up this committee is non-compliant regardless of wording.
The external member is the most commonly skipped requirement — and skipping it isn't a minor lapse, it makes the IC invalidly constituted, exposing every proceeding it runs to challenge. For POSH compliance set-up including IC documentation and external member sourcing, a structured engagement handles each of these five requirements.
Section 21: the annual report you can't skip
The IC must prepare an annual report and submit it to both the employer and the District Officer, stating: complaints received during the year, complaints disposed of, cases pending beyond ninety days, workshops or awareness programmes conducted, and action taken by the employer on IC recommendations.
The employer must then reflect relevant IC disclosures in its own Directors' (Board's) Report under the Companies Act, 2013. That creates a chain obligation: failing to file the IC report breaches the POSH Act, and omitting it from the Board's Report independently exposes the company under the Companies Act. A company that has never filed with the District Officer is in breach of both statutes at once.
Section 26: what non-compliance costs
First offence: fine of up to ₹50,000 (Section 26(1)).
Repeat offence: doubled fine and/or cancellation or non-renewal of the licence, registration, or approval under which the business operates (Section 26(2)). For a Pvt Ltd company this creates ROC scrutiny exposure; for regulated entities (NBFC, FSSAI licence, RERA registration) the sectoral regulator can act independently on the same facts.
Section 26 is triggered by: failing to constitute a compliant IC (Section 4), failing to act on IC recommendations, breaching confidentiality (Section 16), failing to file the annual report (Section 21), or any other contravention of the Act or Rules.
What to do this week
- Count employees per location — the IC obligation triggers separately at each workplace once it crosses ten employees, including remote staff supervised from that office.
- Appoint the Presiding Officer and two employee members, and formalise the appointments in writing on company letterhead.
- Appoint an external member from a women's NGO, bar association, or POSH advisory service, and document it with a formal letter. This same requirement recurs across labour law compliance mandates like EPF and ESI, where a single engagement can cover multiple obligations.
- Issue a formal IC constitution order signed by the MD or a Board-authorised officer, naming all members, designations, and term dates — the document a District Officer asks for first.
- Run a documented awareness session with an attendance record; an email blast does not satisfy Section 19's training obligation.
- Publish a visible complaint channel (Section 9) — a named contact, dedicated email, or anonymous channel displayed on notice boards and the intranet.
- Calendar the annual report alongside your AOC-4 and MGT-7 filing dates, and track IC term expiry every three years — a lapsed IC is treated as no IC under Section 26.
I'm CA Harun Raaj. If this affects your company's compliance calendar, reach out.
---
See Also
Frequently asked questions
We have only eight employees. Are we exempt from POSH compliance?
Yes — Section 4(1) sets the threshold at ten employees per workplace, so companies below that don't need an IC. Complaints at such workplaces go to the Local Complaints Committee constituted by the District Officer under Section 6. The threshold is assessed per workplace, not per company, so a company with two locations of six employees each has no obligation until one location crosses ten.
Can one external member serve on ICs for multiple companies?
Yes. An external member may sit on multiple ICs at once provided there's no conflict of interest with any of the employers. Women's NGOs and professional POSH advisory services routinely offer shared external-member arrangements, which is a practical option for smaller companies.
What counts as sexual harassment under Section 2(n) of the POSH Act?
The Act's definition includes any unwelcome act or behaviour — physical contact, demands or requests for sexual favours, sexually coloured remarks, showing pornography, or any other unwelcome physical, verbal, or non-verbal conduct of a sexual nature. It also covers quid pro quo situations and hostile work environment creation. The standard is what the affected person found unwelcome, not what the accused intended.
We employ only male staff. Is POSH still relevant to us?
Yes. The Act protects women employees in any capacity — permanent, temporary, daily-wage, contractual, or domestic workers. If any woman, including a contractor, delivery person, or client representative, can interact with your workplace environment, the employer's obligations under Section 4 still apply.
When must the IC file its annual report under Section 21?
Section 21 requires the IC to prepare an annual report and submit it to both the employer and the District Officer, covering complaints received, disposed of, pending beyond ninety days, and awareness activities conducted. The draft recommends flagging this alongside your AOC-4 and MGT-7 filing dates so it isn't missed at financial year-end.
How long does an IC member's term last?
Section 4(3) caps each IC member's term at not more than three years, after which a fresh appointment order must be issued. IC memberships do not auto-renew, and a lapsed appointment leaves the committee non-functional.
Does POSH apply to remote or hybrid teams?
Section 2(o)'s definition of workplace has been read by courts to cover hybrid working arrangements where work is assigned by the employer. Remote employees are counted toward the office location that supervises their work, and each physical location that independently crosses ten employees needs its own IC.
What happens if our IC's term has lapsed and we haven't reappointed members?
A lapsed IC appointment is treated as equivalent to having no IC at all, which falls within the failures that trigger Section 26 penalties — a fine of up to ₹50,000 for a first offence, with doubled fines or licence action for repeat offences.
Ready to incorporate or sort your compliance?
Our team handles every filing. You focus on building.