What the law actually says — and what it means in practice.
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — universally known as POSH — applies to every employer in India with ten or more employees. It applies to full-time, part-time, contractual, and temporary employees. It applies to incidents that occur at the workplace, in the course of employment, or in any location connected to the employee's work — including client sites, travel, and virtual environments. And it creates personal liability for the employer, not just organisational liability, in cases where the prescribed mechanisms are absent or inadequately implemented.
Despite being twelve years old, POSH remains among the most under-implemented compliance requirements in Indian business. A study by the National Commission for Women found that a significant proportion of companies required to constitute an Internal Complaints Committee (ICC) had not done so. Annual reports required to be filed go missing. IC members are untrained. Policies exist as documents but are never communicated. And when incidents occur, the absence of a functioning process creates both immediate harm and substantial legal exposure.
The reason for non-compliance is rarely indifference. Most founders and HR leaders who have not implemented POSH properly are not unconcerned with workplace safety. They are busy, they believe the requirements are simpler than they are, or they have conflated awareness with compliance. Posting a POSH policy on the intranet is not compliance. Having an HR email address as the "complaints mechanism" is not compliance. Asking a manager to "handle it" is not compliance. These approaches create the appearance of process without any of its substance.
The five requirements that most companies miss.
Genuine POSH compliance is built on five structural requirements. Most companies satisfy one or two. Genuine compliance requires all five.
1. A written policy that employees have actually received.
The policy must be written, approved by management, and distributed to every employee. Distribution means active communication — email, physical copies, inclusion in offer letters and onboarding documentation — not uploading a PDF to a shared drive that no one visits. The policy must describe what constitutes sexual harassment, how to make a complaint, who the ICC members are, and what happens after a complaint is made. It must be available in the language that employees actually read.
2. A properly constituted Internal Complaints Committee.
The ICC is the cornerstone of POSH compliance, and it is where most organisations fail most completely. The law is specific: the ICC must have at least four members. The presiding officer must be a woman employed at a senior level. At least half the members must be women. At least one member must be an external person — typically a lawyer, social worker, or NGO representative committed to the cause of women. Members are appointed for a term of three years. Appointing a committee that does not meet these requirements does not satisfy the Act — it creates the liability of non-compliance while providing the false comfort of apparent process.
3. Trained committee members.
Appointing an ICC is not sufficient. The members must be trained to conduct an inquiry. This training is not a half-day awareness session on harassment awareness — it is specific training on the inquiry procedure under the Act: how to receive and acknowledge a complaint, how to conduct a fair inquiry, how to evaluate evidence, how to draft findings, and how to make and implement recommendations. Untrained ICC members who conduct an inquiry create additional liability, because a procedurally flawed inquiry can be challenged in court.
4. Annual awareness sessions for all employees.
The Act requires that employers conduct awareness programmes for employees to sensitise them to the issue of sexual harassment and their rights and responsibilities under the Act. In practice, this means at least one training session per year for all employees, covering what constitutes harassment, how to report, and what the IC process looks like. These sessions should be documented — date, attendance, facilitator, content covered — because documentation is the evidence of compliance in the event of an inspection or complaint.
5. The annual report to the District Officer.
This is the requirement that most companies — including many that have done everything else right — miss entirely. Section 21 of the Act requires that the IC submit an annual report to the employer and to the District Officer, covering the number of complaints received, the number disposed of, and the number pending. This report must be submitted by 31 January each year, even if no complaints were received during the year. Non-submission attracts penalties under Section 26 — fines and, in repeat instances, cancellation of business licences.
When an incident occurs: how to handle it properly.
The test of any compliance system is what happens when it is actually needed. The POSH process is a quasi-judicial procedure — it has defined timelines, principles of natural justice, and specific remedies. When a complaint is received, the clock starts.
The complainant must be told within seven days of the complaint whether the complaint has been accepted for inquiry or declined with reasons. The inquiry must be completed within sixty days of receiving the complaint. The inquiry report and recommendations must be sent to the employer within ten days of completion. The employer must act on the recommendations within sixty days of receiving them. These timelines are not aspirational — they are statutory requirements, and failure to meet them can be challenged.
During the inquiry, both the complainant and the respondent have the right to be heard, to present evidence, and to respond to the other party's evidence. The IC conducts this process — not HR, not a manager, not legal counsel acting for the company. The IC is independent of management for the purposes of the inquiry. Attempts by management to direct or influence the inquiry create additional liability.
Confidentiality requirements apply throughout. The identity of the complainant, the respondent, witnesses, and any information about the inquiry must not be disclosed. Violation of confidentiality is itself an offence under the Act, punishable separately from any finding about the underlying complaint.
The business case beyond compliance.
Companies that have invested in genuine POSH implementation — not compliance theatre, but real infrastructure — consistently report three benefits beyond the obvious one of avoiding legal liability. First, women employees are more likely to join and more likely to stay when they believe the organisation takes harassment seriously and has a functioning process for addressing it. In markets where female talent is scarce and valuable, this is a meaningful competitive advantage. Second, the awareness sessions required under POSH create a broader culture of respect and appropriate conduct that reduces the incidence of the everyday behaviours — dismissive language, exclusion from decisions, casual condescension — that precede more serious incidents. Third, having a documented and tested process means that when an incident does occur, the organisation responds quickly, professionally, and in a way that minimises reputational damage, rather than improvising under pressure.
“POSH compliance is not a legal checkbox. It is the minimum standard of what it means to take your people seriously.”
