A company with 15 employees in Bengaluru received a notice from the District Officer last year. The reason wasn’t a complaint from an employee. It was the annual return they’d never filed. The POSH Act was on their HR checklist. The ICC was constituted. The policy existed. But nobody knew there was a filing requirement, and nobody had filed it for three years.
This is the most common POSH compliance failure in Indian companies not because employers are indifferent to sexual harassment, but because the ongoing obligations under the Act are poorly understood. The ICC gets set up once and then forgotten. The policy goes into the employee handbook and stays there. And the annual return, which has to be filed every January, quietly lapses.
This guide covers what the POSH Act actually requires not just at setup, but as an ongoing compliance obligation and what happens when companies don’t follow through.
What the POSH Act Is
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 called the POSH Act makes it a legal obligation for Indian employers to prevent sexual harassment at work, provide a mechanism for complaints, and ensure those complaints are investigated and resolved fairly.
It came out of the Supreme Court’s Vishaka Guidelines (1997), which were judicial directives without penalties. The POSH Act gave those guidelines statutory force with an ICC requirement, defined timelines, and penalties for non-compliance. It covers every workplace in India: private companies, government departments, NGOs, hospitals, educational institutions, and even places employees visit in the course of employment.
Who it applies to: every establishment with 10 or more employees. This includes full-time, part-time, temporary, contractual, and even intern staff. The count is on any day during the year not just on a fixed date. Once you cross 10, the Act applies.
The Internal Complaints Committee ICC
The ICC is the core mechanism. Every company with 10+ employees must have one. Not just on paper it has to be actually constituted, with specific people in specific roles, and those people need to be functional and trained.
Who must be on the ICC
- Presiding Officer a senior woman employee. This is non-negotiable. If there’s no senior woman at the workplace, she must be appointed from another branch or office.
- At least 2 internal members employees committed to the cause of women, preferably with legal knowledge or social work experience
- 1 external member someone from an NGO or a person familiar with issues related to sexual harassment. Cannot be an employee of the company.
- Minimum 50% of members must be women across all roles combined, not just the Presiding Officer
- Term 3 years maximum per member. After that, new appointments needed.
The most common ICC constitution error: no external member. A lot of companies constitute the ICC with internal employees only and assume that’s enough. It isn’t Section 4 explicitly requires an external member. An ICC without the external member is technically invalid, which can invalidate an inquiry if it’s ever challenged.
What powers the ICC has
The ICC has the powers of a civil court for the purpose of an inquiry. It can summon witnesses, ask for documents, and examine evidence. Its inquiry must follow the principles of natural justice both parties must have an opportunity to present their case. The ICC cannot impose criminal penalties its role is to recommend action to the employer but ignoring its recommendations is itself a violation.
The Complaint and Inquiry Process
When a complaint is received, a specific sequence of steps is required. The ICC doesn’t have discretion on timelines the Act sets them.
| Stage | Timeline | What Happens |
|---|---|---|
| Complaint filed | Day 0 | Employee submits written complaint to ICC Presiding Officer |
| Inquiry begins | Within 7 days | ICC sends written notice to respondent; interim relief may be granted |
| Conciliation (optional) | Before inquiry starts | ICC may offer settlement but cannot impose it. Both parties must agree. |
| Inquiry concludes | Within 90 days | ICC examines evidence, records statements, makes findings |
| Report submitted | Within 10 days of inquiry close | ICC submits recommendations to employer and District Officer |
| Employer acts | Within 60 days of report | Implements recommendations action against respondent or dismissal of complaint |
| Appeal window | Within 90 days of decision | Either party can appeal to appropriate authority |
One point worth noting on conciliation: the Act allows the ICC to attempt conciliation before beginning a full inquiry but only if the complainant requests it. The ICC cannot force conciliation. And a monetary settlement through conciliation is specifically prohibited the Act doesn’t allow cases to be ‘paid off.’
What the Policy Must Cover
Having a POSH policy is mandatory. ‘Sexual harassment is not tolerated here’ in the employee handbook is not a POSH policy. The policy must specifically address:
- Definition of sexual harassment as per the Act including physical, verbal, non-verbal, and written forms
- Who can file a complaint and within what timeframe (typically 3 months from the incident, extendable by the ICC to another 3 months)
- The complaint process how to file, where to submit, who the ICC members are and how to contact them
- Protections for the complainant no retaliation, confidentiality of proceedings
- Consequences for false complaints the Act provides for action against malicious complaints, which is a point many policies miss
- Third-party harassment what to do if the harassment is from a client, vendor, or visitor
Display requirement: The policy must be displayed prominently at the workplace physical notice board plus digital channels (intranet, email). Putting it only in the employee handbook that nobody reads is not sufficient.
Annual Filing and Reporting The Part Most Companies Miss
Annual return: every ICC must submit a report to the District Officer by 31 January each year. The report covers: number of complaints received, number resolved, cases pending, and actions taken. This goes to the District Officer, not just kept internally.
For companies registered under the Companies Act which is most private limited companies there’s a second filing obligation. Section 134(3)(q) of the Companies Act requires POSH compliance to be disclosed in the Board of Directors’ Report filed annually. This is separate from the POSH Act filing. Failure to disclose carries penalties of ₹3,00,000 on the company and ₹50,000 on each officer in default.
Listed companies have a third layer: SEBI’s LODR Regulations require POSH compliance to be included in the annual corporate governance report. The number of complaints filed, resolved, and pending must be disclosed. Non-disclosure attracts SEBI penalties.
Penalties What Non-Compliance Actually Costs
Under Section 26 of the POSH Act: first offence carries a fine of up to ₹50,000. Second offence doubled penalty, and the government can recommend cancellation of the company’s business licence or registration. Not just a fine. The licence itself.
The triggers for penalty aren’t limited to a complaint being mishandled. The penalty applies to: not constituting a valid ICC, failing to act on ICC recommendations, not filing the annual return. Any of these, on their own, is enough for a labour department notice.
2023 Supreme Court update (Aureliano Fernandes judgment): The Supreme Court directed District Officers to actively collect and verify annual POSH reports not just wait for them passively. This has increased enforcement activity since 2024, and the trend continues in 2026.
POSH for Remote and Hybrid Teams
The Act covers every place an employee works in the course of employment which includes home offices, client sites, video calls, and work communication channels. Digital harassment messages, emails, video call conduct falls under the Act. The definition of ‘workplace’ is broad by design.
A few practical implications for hybrid or remote companies:
- The ICC must still be constituted remote workforce doesn’t exempt a company from the 10-employee threshold
- Training needs to cover digital scenarios screenshots, forwarded messages, conduct on video calls
- Complaint filing process should be accessible online employees should know how to file without having to come to a physical office
- Confidentiality is harder to maintain in remote settings the ICC needs a clear protocol for digital evidence handling
Full Posh Compliance Checklist
| Compliance Requirement | Frequency | Penalty if Missed |
|---|---|---|
| Constitute a valid ICC (4+ members, 50%+ women, external member) | One-time (renew every 3 years) | ₹50,000 fine + possible licence cancellation |
| Display POSH policy prominently at workplace | Ongoing | Part of non-compliance ₹50,000 |
| Conduct awareness training for all employees | Annually minimum | Not explicitly fined but part of employer duty |
| Annual report submitted to District Officer | 31 January every year | Penalties under Section 26 |
| Board disclosure in Directors’ Report (Companies Act) | Annual with filing | ₹3,00,000 company + ₹50,000 per officer |
| SEBI LODR disclosure (listed companies only) | Annual | SEBI penalties + listing compliance risk |
| Act on ICC recommendations | Within 60 days of report | Non-compliance with ICC order is a separate violation |
| SHe-Box registration (recommended) | One-time registration | Not mandatory but increasingly expected |
What ‘Adequate Compliance’ Actually Looks Like
Companies that check the minimum boxes ICC on paper, policy in the handbook, one annual return filed are technically compliant. Companies that handle POSH well do a bit more:
- Annual training that isn’t a slide deck nobody watches. Role-specific scenarios, manager-specific sessions on how to handle a complaint someone brings to them informally, bystander intervention.
- ICC members who actually know their responsibilities. Appointing someone as a Presiding Officer who has never read Section 4 of the Act is a liability. ICC members should be briefed, trained, and updated annually.
- A complaint mechanism that employees actually know about. Posting the ICC contact details during onboarding, on the intranet, and at the workplace not just in a policy document is the difference between a mechanism that works and one that exists on paper.
- Prompt action on interim relief requests. If a complainant requests a transfer or leave during the inquiry period, the ICC can recommend it. Many companies don’t know this is possible and leave complainants in uncomfortable situations during the inquiry.
POSH compliance is one of the most sensitive areas of HR. Getting it wrong can lead to legal, financial, and reputational consequences and, most importantly, can affect people directly.
Companies that handle POSH well go beyond simply ticking compliance boxes. They build a process that actually works:
- A functioning Internal Committee (ICC)
- A clear POSH policy employees understand
- Practical, meaningful training
- Proper documentation and record-keeping
- A compliance calendar that doesn’t miss key deadlines, including 31 January
Good POSH compliance isn’t just about following the law. It’s about creating a workplace where employees know how concerns are handled and feel safe raising them.