POSH Compliance Checklist for Indian Startups: Internal Committee, Policy, Training, Remote Teams, Interns and Investor Diligence
Every Indian startup should set up POSH compliance before it becomes a crisis file. If the startup has ten or more workers at a workplace, the employer must constitute an Internal Committee by written order…
Direct answer for founders
Every Indian startup should set up POSH compliance before it becomes a crisis file. If the startup has ten or more workers at a workplace, the employer must constitute an Internal Committee by written order. Even a smaller team should still have a clear anti-sexual-harassment policy, complaint routing, awareness material and access to the Local Committee route, because the law protects women at the workplace and covers employees, contract workers, probationers, trainees, apprentices, volunteers and people called by any other name.
For founders, POSH is not a narrow HR task. It touches culture, board oversight, employment contracts, consultant onboarding, enterprise procurement, investor diligence, founder reputation and personal trust inside the company. A policy downloaded from the internet is not enough. The startup needs a working complaint mechanism, trained committee members, confidentiality controls, annual reporting discipline and evidence that the process is real.
The core source is the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 on India Code: https://www.indiacode.nic.in/handle/123456789/2104?sam_handle=123456789/1362. The Act defines workplace broadly, requires Internal Committee constitution under section 4, sets complaint and inquiry routes, lists employer duties under section 19, requires annual reporting under sections 21 and 22, and provides penalties under section 26.
Why POSH becomes urgent earlier than founders expect
Founders usually think about POSH when a company reaches 50 or 100 employees. That is late. The obligation can become relevant when the team crosses ten workers at a workplace, but the practical risk starts earlier: mixed employee-contractor teams, interns, offsites, co-working spaces, client visits, investor events, WhatsApp work groups, remote collaboration, late-night support shifts and founder-led reporting lines.
The law is deliberately broad. The definition of employee includes regular, temporary, ad hoc and daily wage workers, whether directly or through an agent, including contractors, probationers, trainees and apprentices. Workplace includes a private sector organisation, enterprise, institution, office, branch or unit, and also any place visited by an employee arising out of or during employment, including transportation provided by the employer.
That means a startup should not ask only, “Do we have ten payroll employees?” It should ask, “Can a woman working with or visiting our company make a complaint and get a fair, confidential, timely process?”
Founder operating checklist
| Area | What the founder should check |
|---|---|
| Worker count | Count employees, contract workers, trainees, interns, apprentices and regular workplace participants |
| Workplace map | List office, co-working space, branch, warehouse, event venue, client site and employer-provided travel |
| Internal Committee | Constitute it by written order where required, with proper composition |
| Policy | Write a policy that matches the Act, not a generic corporate values page |
| Training | Conduct awareness for employees and orientation for committee members |
| Complaint route | Provide a written, accessible, confidential channel |
| Records | Keep IC order, policy, attendance, training decks, complaint register and annual report files |
| Board oversight | Include POSH compliance in HR, governance or audit updates |
| Vendors | Add workplace conduct clauses for contractors, consultants and staffing agencies |
| Diligence | Keep a clean folder ready for investors, acquirers and enterprise customers |
Internal Committee composition
Section 4 requires every employer of a workplace to constitute an Internal Committee by written order. Where offices or administrative units are located at different places, the committee must be constituted at all administrative units or offices.
The composition is not optional:
| Role | Requirement |
|---|---|
| Presiding Officer | Woman employed at a senior level at the workplace, with fallback options if unavailable |
| Employee members | At least two employees, preferably committed to women’s causes, social work or legal knowledge |
| External member | One member from an NGO or association committed to women’s causes, or a person familiar with sexual harassment issues |
| Gender balance | At least one-half of total members must be women |
| Tenure | Presiding Officer and members can hold office for a period not exceeding three years |
Startups commonly make three mistakes here. First, they name only internal employees and skip the external member. Second, they appoint a committee but never issue a written order. Third, they appoint people who have no training, time or independence to handle a complaint.
What if the startup has fewer than ten workers?
The Local Committee route exists for establishments where an Internal Committee has not been constituted because the workplace has fewer than ten workers, or if the complaint is against the employer. This does not mean a small startup can ignore POSH. It means the founder should still create a visible route for employees to understand where complaints can go.
For a sub-ten startup, the practical file should include:
- Anti-sexual-harassment policy.
- Named internal contact for support and escalation.
- Local Committee information where available.
- Founder commitment that retaliation will not be tolerated.
- Awareness session record for employees and interns.
- Vendor and consultant conduct clause.
- A plan to constitute an Internal Committee immediately when the threshold is crossed.
Small teams often have concentrated power. A complaint against a founder, senior hire or key salesperson can become more sensitive than in a larger company. The process needs to be credible before the complaint arrives.
POSH policy clauses founders should include
The policy should be short enough for employees to read and strong enough to guide a real case.
| Clause | Why it matters |
|---|---|
| Scope | Covers employees, interns, consultants, contractors, visitors, remote work and work-related travel |
| Meaning of sexual harassment | Tracks the Act and avoids vague moral language |
| Complaint window | Explains the three-month complaint period and extension possibility under the Act |
| Complaint channel | Gives email, physical and support options |
| IC details | Names members, roles, tenure and contact route |
| Confidentiality | Prohibits public sharing of complaint, identity, witnesses, inquiry and recommendations |
| Interim relief | Explains possible work arrangement changes during inquiry |
| Non-retaliation | Protects complainant, witnesses and committee process |
| False complaint caution | Handles bad-faith complaints carefully without discouraging genuine complaints |
| Action after findings | Connects recommendations to service rules, discipline and corrective action |
| Annual reporting | Records reporting of cases and disposal where required |
Do not write a policy that sounds like a criminal-law notice only. POSH is a workplace redressal law. The policy should help people understand how to report, what happens next, how privacy is protected and how the company will prevent retaliation.
Complaint timeline and inquiry discipline
Section 9 permits an aggrieved woman to make a written complaint within three months from the date of the incident, and in case of a series of incidents, within three months from the last incident. The committee may extend the time limit by up to three months for reasons recorded in writing if circumstances prevented the complaint from being filed earlier.
Section 11 states that the inquiry should be completed within 90 days. Founders should build an internal calendar around that. A startup should not treat a POSH complaint like an informal HR conversation that can drift for months.
Practical case file:
| Stage | Record to maintain |
|---|---|
| Receipt | Date, complaint copy, acknowledgement and support offered |
| Jurisdiction | Whether IC or Local Committee route applies |
| Conflict check | Any conflict involving committee members |
| Notices | Communications to parties with confidentiality warning |
| Interim measures | Transfer, leave, reporting-line change or other support where recommended |
| Hearings | Dates, attendance and minutes |
| Evidence | Documents, messages, witness notes and access logs where relevant |
| Report | Findings, recommendations and reasons |
| Employer action | Action taken and implementation record |
| Annual reporting | Case count and disposal entry |
Confidentiality is not a side issue
Section 16 restricts publication or disclosure of the complaint, identities, addresses, witnesses, conciliation and inquiry proceedings, recommendations and action taken. Section 17 provides penalties for breach of that confidentiality obligation.
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
This is where startups can fail fast. Slack speculation, founder corridor conversations, casual all-hands references or public “transparency” statements can damage the process. The company should tell only the people who need to know. It should also instruct committee members, HR, managers, witnesses and external advisors that POSH files are not ordinary office gossip or PR material.
Employer duties under section 19
Section 19 requires the employer to provide a safe working environment, display penal consequences and the IC order, organise workshops and awareness programmes, provide facilities to the committee, assist attendance of parties and witnesses, make information available, assist the woman if she chooses to file a criminal complaint, initiate action where relevant, treat sexual harassment as misconduct and monitor timely submission of reports by the committee.
For startup operators, convert those duties into recurring tasks:
| Frequency | Task |
|---|---|
| On joining | Share POSH policy and acknowledgement |
| Quarterly | Awareness reminder or short session |
| Half-yearly | IC member training and composition review |
| Before offsites | Conduct and escalation reminder |
| Annual | IC annual report, case count review and board note |
| Event-based | Reconstitute IC after resignation, expansion or new office |
If the company opens an office in another city, adds a warehouse, moves into a large co-working space or starts employer-arranged transport, update the workplace map. POSH compliance should follow the operating footprint.
Remote work, founders and offsites
Remote work does not remove POSH risk. Harassment can happen through video calls, chat tools, work emails, shared documents, internal communities, work travel and informal founder events. The policy should cover digital conduct clearly.
Add practical rules:
- Work channels are covered by the policy.
- Screenshots and digital evidence should be preserved, not edited.
- Managers should not run private settlement conversations.
- Offsite alcohol, rooming, transport and late-night work rules should be clear.
- Complaint routing should work for remote employees in different cities.
- HR should not force employees to complain only to their reporting manager.
Founder-led startups also need a route when the allegation involves a founder or promoter. If the employer is the respondent, the Local Committee route may become relevant. Boards and investors care about this because founder misconduct can become a governance event, not only an HR issue.
Diligence documents investors and enterprise customers may ask for
Investors may not read every policy during seed diligence, but they will care if there is an unresolved complaint, missing IC, regulatory notice or public workplace issue. Enterprise customers may also ask for workplace conduct and compliance representations in vendor onboarding.
Keep this folder:
| Folder | Documents |
|---|---|
| Governance | IC constitution order, member list, tenure and external member agreement |
| Policy | POSH policy, employee handbook extract and acknowledgement records |
| Training | Awareness deck, attendance, calendar invites and committee orientation record |
| Complaints | Confidential register, case files and closure records with restricted access |
| Annual reporting | IC annual report and disclosure in company annual report or District Officer intimation |
| Contracts | Employment, consultant, contractor and vendor conduct clauses |
| Board | Periodic compliance note without confidential case details |
| Remediation | Action taken, disciplinary records and process improvements |
The Best CS Firm In India approach is to make POSH compliance visible, operational and evidence-backed, not decorative.
Penalties and business risk
Section 26 provides that failure to constitute an Internal Committee, failure to take action under relevant sections, or contravention of the Act or rules may attract a fine up to Rs 50,000. Repeat conviction can lead to higher consequences, including twice the punishment subject to the maximum and possible cancellation, withdrawal, non-renewal or cancellation of licence or registration required for carrying on business or activity.
The legal penalty is only one part of the risk. A weak POSH process can also hurt hiring, investor trust, founder credibility, board confidence, enterprise sales, public reputation and employee safety. A startup should not wait for a complaint to discover that no one knows who the IC members are.
15-day POSH setup plan
| Day | Action |
|---|---|
| 1 | Count workers and map workplaces, including remote and offsite touchpoints |
| 2 | Review whether Internal Committee is mandatory now |
| 3 | Identify Presiding Officer, employee members and external member |
| 4 | Issue written IC constitution order |
| 5 | Draft or update POSH policy |
| 6 | Add complaint email and confidential access protocol |
| 7 | Update employment, intern, consultant and contractor onboarding packs |
| 8 | Conduct employee awareness session |
| 9 | Conduct IC orientation |
| 10 | Create complaint register and restricted document folder |
| 11 | Display policy, penal consequences and IC details at workplace |
| 12 | Add remote-work and offsite conduct rules |
| 13 | Prepare annual reporting template |
| 14 | Add POSH compliance to board or governance tracker |
| 15 | Store final documents in investor diligence folder |
Sources
- India Code, Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013: https://www.indiacode.nic.in/handle/123456789/2104?sam_handle=123456789/1362
- Ministry of Women and Child Development, SHe-Box portal: https://shebox.wcd.gov.in/
FAQ Section
When must a startup constitute an Internal Committee under POSH?
An employer with a covered workplace should constitute an Internal Committee by written order when the workplace requirement applies. Section 4 is central, and startups should review worker count and workplace footprint instead of waiting for a complaint.
Are interns and consultants covered by POSH risk?
Yes, the Act uses a broad employee definition covering regular, temporary, ad hoc, daily wage, contract workers, probationers, trainees, apprentices and similar categories. Startups should include interns, consultants and contractors in policy awareness.
Does POSH apply to remote work?
Remote work does not remove workplace risk. Work chats, video calls, emails, offsites, client visits and employer-arranged travel can all create situations that need a clear complaint and conduct framework.
What records should founders keep for diligence?
Keep the IC order, member details, POSH policy, training records, complaint register, annual reports, employee acknowledgements, vendor conduct clauses and board compliance notes.
What is the penalty for not complying with POSH?
Section 26 provides for a fine that may extend to Rs 50,000 for specified non-compliance, with higher consequences for repeat conviction, including possible business licence or registration consequences.
Founder / Business Takeaway
POSH compliance should be built before scale: policy, committee, training, confidentiality, annual records and board visibility should all exist in the same governance file.
Need expert support?
BSA helps founders structure POSH, labour, board and governance records so hiring, diligence and enterprise customer reviews do not expose avoidable compliance gaps.
Need expert support?
BSA supports founders across India with ROC, FEMA, due diligence, fundraising readiness, and company secretarial execution.
