POSH Compliance for Indian Startups: The Complete Founder’s Guide

A CEDA study surveying 200 senior HR officers found that 59% of Indian organisations had not set up an Internal Complaints Committee — the single most critical requirement under the POSH Act 2013. For startups hiring their 10th employee this month in Bengaluru or Pune, that statistic is a legal liability, not just a data point. POSH compliance for startups India isn’t optional. It’s a statutory obligation with a penalty of ₹50,000 on the first offence, escalating to licence cancellation on repeat violations.

The MCA made it even harder to ignore: from July 14, 2025, every company must now disclose POSH complaint data inside its Board Report. Founders who treat POSH as an HR afterthought are about to face audit tables, District Officer surveys, and Supreme Court-directed district-level verification checks. Here’s everything you need to set it up correctly — before a complaint forces you to.

TL;DR: Every Indian startup with 10 or more employees must comply with the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — commonly called the POSH Act. POSH compliance for startups India requires constituting an Internal Complaints Committee (ICC), drafting and displaying a POSH policy, conducting annual awareness training, and filing an ICC Annual Report by January 31 each year. Non-compliance attracts a fine of up to ₹50,000 (with licence cancellation for repeat offences), plus mandatory Board Report disclosures under the MCA’s July 2025 amendment. Lawizer can help you set up the full POSH framework — policy, ICC, and filings — entirely online.

What You’ll Learn

— When exactly the POSH Act applies to your startup and who it covers — How to constitute a legally valid ICC under Section 4 of the POSH Act — What your POSH policy must include, how to display it, and annual filing requirements — Penalties your startup faces for non-compliance in 2025 and 2026 — The 2025 MCA amendment and SHe-Box registration — what changed and what you must do now

When Does the POSH Act Apply to Your Startup?

The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 kicks in the moment your organisation crosses 10 employees. And the headcount isn’t restricted to permanent staff on payroll. Interns, contractual workers, freelancers, consultants, and even gig workers attached to your business all count toward the threshold. A Bengaluru SaaS startup with 8 full-time engineers and 3 contract QA testers? That’s 11 people. POSH applies immediately.

Here’s the thing: the Act covers every kind of workplace. Remote employees, hybrid setups, client sites, co-working spaces like WeWork or IndiQube — all fall under ICC jurisdiction. A 2024 advisory from the Ministry of Women and Child Development explicitly extended POSH obligations to remote and work-from-home arrangements, making digital workplace conduct — Slack messages, Zoom calls, email — covered behaviour. “PoSH will stop being location-related and become behaviour-oriented,” as one HR professional put it. Startups that scaled fast through the pandemic and never addressed POSH are now operating in a high-risk grey zone.

What most founders miss: if your startup has fewer than 10 employees, you don’t need an ICC — but you must ensure your team is aware of the Local Complaints Committee (LCC) constituted by the District Officer under Section 6. Once you cross 10, the ICC obligation is immediate. There’s no grace period in the Act.

How to Constitute a Valid ICC Under Section 4

The Internal Complaints Committee (ICC) — the body mandated under Section 4 of the POSH Act to receive, investigate, and resolve workplace sexual harassment complaints — is the structural backbone of your entire POSH framework. Get the composition wrong and every inquiry the ICC conducts can be legally challenged. District Officer surveys and the Supreme Court’s August 2025 direction in Aureliano Fernandes v. State of Goa have placed incorrectly constituted ICCs directly in the crosshairs of enforcement.

A legally valid ICC must have at minimum four members. Here’s the exact composition:

Presiding Officer: A senior woman employee. She chairs the ICC and signs off on the Annual Report.

Two internal members: Employees committed to the cause of women’s rights or with experience in social work. At least one must be from the same establishment.

One external member (mandatory): A person from an NGO or association committed to women’s rights, or a lawyer or advocate with relevant expertise. This is not optional. An ICC without an external member is improperly constituted and its findings are voidable.

At least 50% of ICC members must be women. Members serve a maximum term of 3 years, after which the ICC must be reconstituted or members renewed. The founding document — an ICC constitution order signed by the CEO or authorised signatory — must be issued, appointment letters sent, and ICC details published on your intranet and displayed on notice boards. This is the paperwork most early-stage founders in Delhi and Mumbai skip entirely.

A Quick Example: How a 15-Person Startup Should Structure Its ICC

Say you’re a 15-person fintech in Hyderabad. Your Presiding Officer could be your senior woman engineer or a woman co-founder. Two internal members — one from ops, one from product. Your external member could be empanelled through a POSH compliance services firm or sourced from a local NGO working on women’s issues. Issue appointment letters, fix a small honorarium for the external member, and document the constitution order. That’s your ICC. Simple — but you have to actually do it.

Drafting Your POSH Policy: What Must Actually Be in It

Under Section 19 of the POSH Act read with Rule 13 of the POSH Rules, 2013, every employer must formulate a written POSH policy and disseminate it widely. A generic template downloaded from the internet is not enough — courts have held that a boilerplate policy that employees have never seen is no different from having no policy at all. Your POSH policy must include at minimum:

— A clear definition of sexual harassment with workplace-specific examples (physical, verbal, non-verbal, digital) — The complete complaint procedure — how to file, timelines, and what happens after — Protections for complainants, witnesses, and ICC members against retaliation — Confidentiality obligations — breaching these attracts a separate fine of ₹5,000 — ICC member names, contact details, and the external member’s credentials — Penal consequences of sexual harassment under both the POSH Act and the Bharatiya Nyaya Sanhita, 2023 (which replaced the IPC)

Once drafted, the policy must be displayed prominently — both physically (notice boards, breakrooms) and digitally (company intranet, onboarding portal). Every new hire must be oriented on the policy. Annual awareness training for all employees is mandatory, not just for ICC members. If your startup uses Zoho People or Darwinbox, embed the POSH policy acknowledgement into the onboarding flow — that creates a documented paper trail if a complaint is ever raised. You can get expert help structuring a watertight compliance framework through Lawizer’s startup legal services (https://lawizer.com/startup-businesslegal), which covers POSH policy drafting alongside incorporation, IP, and employment contracts.

Statutory Timelines: What Happens After a Complaint Is Filed

Let’s break this down. Once a complaint lands with the ICC, the POSH Act prescribes a strict inquiry timeline that cannot be ignored. Missing these deadlines exposes the employer — not just the ICC — to legal liability.

7 days: Complaint copy must be sent to the respondent after ICC receives it 10 working days: Respondent must submit reply with evidence and witnesses 90 days: Full inquiry must be completed 10 days post-inquiry: ICC must issue its report to employer and both parties 60 days post-report: Employer must act on ICC recommendations 90 days: Window for either party to appeal before a Labour Court or tribunal

What most founders miss: an internal POSH inquiry does not bar criminal action. A complainant can simultaneously file under the Bharatiya Nyaya Sanhita or pursue civil damages. The two tracks run in parallel. This is why thorough ICC documentation — verbatim interview notes, evidence chain of custody, reasoned findings — matters far more than founders realise. One poorly documented ICC inquiry can turn into a High Court writ petition under Article 226 citing natural justice violations.

Annual Filings, MCA 2025 Amendment, and SHe-Box Registration

POSH compliance isn’t a one-time setup. There are recurring annual obligations that every startup must calendar. Under Section 21 of the POSH Act, the ICC must submit an Annual Report to both the employer and the District Officer — typically by January 31 each year (some states like Gurugram have moved this to February 28). The report must capture the number of complaints received, disposed of, and pending beyond 90 days, along with details of awareness training conducted.

The July 2025 MCA amendment — through the Companies (Accounts) Second Amendment Rules, 2025, effective July 14, 2025 — added a significant new layer. Every company must now disclose inside its Board Report: the number of POSH complaints received, disposed of, and pending beyond 90 days, plus the gender composition of the workforce. Missing these disclosures can attract penalties up to ₹5 lakh under the Companies Act, 2013. This means POSH data is now part of your ROC filing — a hard deadline item alongside AOC-4 and MGT-7 for your Private Limited Company.

Additionally, the SHe-Box (Sexual Harassment Electronic Box) portal — run by the Ministry of Women and Child Development — now requires IC registration. The Delhi government directed all entities to register their internal committees on SHe-Box in June 2025, following the Supreme Court’s directive. Protecting your startup legally from multiple fronts — from POSH to trademark disputes — is best handled end-to-end; Lawizer’s business protection services (https://lawizer.com/startup-businesslegal/protectbusiness/TrademarkRegistrationPage) cover both legal compliance and IP protection in one place.

Penalties for POSH Non-Compliance: What Your Startup Actually Risks

The short answer: the consequences are real, escalating, and now harder to ignore than ever. Under Section 26 of the POSH Act, failure to constitute an ICC, failure to act on ICC recommendations, or failure to file annual reports are all punishable offences. Here’s how the penalty structure breaks down:

First offence: Fine up to ₹50,000 Repeat offence: Double penalty (₹1,00,000+) and potential cancellation of business licence or startup registration Board Report non-disclosure (Companies Act 2013): Penalties up to ₹3,00,000 to ₹5,00,000 for false or missing statements in Directors’ Report Confidentiality breach by ICC members: Fine of ₹5,000

The enforcement environment has also sharpened dramatically. In August 2025, the Supreme Court in Aureliano Fernandes v. State of Goa directed all States and Union Territories to conduct district-wise surveys within six weeks to verify whether ICs had been constituted. Non-compliance during those surveys could result in regulatory action including refusal of licence renewals. For a DPIIT-recognised startup or a company seeking government tenders, a POSH non-compliance flag is an existential risk — not just a fine.

Frequently Asked Questions

Q: Does POSH apply to my startup if I have only 10 employees?

A: Yes. Section 4 of the POSH Act mandates ICC constitution at every establishment with 10 or more employees. This count includes permanent, contractual, intern, and freelance workers. The obligation kicks in from the day your headcount crosses the threshold — there is no grace period, and “10 employees” is a hard statutory trigger, not a guideline.

Q: What happens if my startup doesn’t have a single woman employee — do I still need an ICC?

A: Yes. The POSH Act’s protective scope covers all women who interact with your workplace — clients, vendors, delivery partners, women visiting the office. The ICC obligation is tied to the employer’s headcount, not to whether you currently have women on staff. Additionally, future hiring will almost certainly bring women employees, and setting up the ICC proactively avoids scrambling later when a complaint actually lands.

Q: Can a co-founder or director serve as the Presiding Officer of the ICC?

A: A woman co-founder or senior woman employee can serve as Presiding Officer, provided she meets the requirement of being a “senior woman employee” as per Section 4 of the POSH Act. However, she must not have a conflict of interest with either the complainant or respondent in any inquiry. For very small startups where all senior women are founders, engaging an external POSH consultant to play a structured advisory role alongside internal members is a sensible approach.

Q: What changed with the MCA July 2025 amendment and how does it affect my annual filing?

A: The Companies (Accounts) Second Amendment Rules, 2025, effective July 14, 2025, require every company to include detailed POSH disclosures in its Board’s Report — the number of complaints received, disposed of, and pending beyond 90 days, plus the gender composition of the workforce. These disclosures become part of your ROC annual filing under the Companies Act, 2013. Missing or inaccurate disclosures can attract penalties up to ₹5 lakh on the company and its directors.

Q: Do I need to file a POSH Annual Report even if there were zero complaints during the year?

A: Yes. The ICC Annual Report must be filed with the District Officer by January 31 (or your state’s applicable deadline) regardless of whether any complaints were received. A zero-complaint year still requires reporting on ICC constitution details, awareness training conducted, and overall compliance status. Filing demonstrates your prevention framework is active — and that itself is what regulators and auditors look for.

Q: What is the SHe-Box portal and is registration mandatory for startups?

A: SHe-Box (Sexual Harassment Electronic Box) is the central complaint portal run by the Ministry of Women and Child Development. It allows any woman to file a workplace sexual harassment complaint online, routed to the appropriate IC or LC. Following the Supreme Court’s directive and the Delhi government’s June 2025 order, all entities — including private startups — are required to register their Internal Committees on SHe-Box. Non-registration is increasingly treated as evidence of POSH non-compliance during District Officer surveys.

Ready to set up POSH compliance for your startup? Lawizer’s experts handle everything — ICC constitution, POSH policy drafting, annual report preparation, and SHe-Box registration — fully online, starting at just ₹2,999. No lengthy back-and-forth with compliance consultants needed.

Get Your POSH Framework Set Up → https://lawizer.com/startup-businesslegal

---