Introduction
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 — commonly known as the POSH Act — has been in force for over a decade. Most organisations with 10 or more employees are aware of it. Many have a POSH policy document. A significant number have an Internal Complaints Committee (ICC) listed on paper.
In 2026, that is no longer enough.
Recent Supreme Court interventions, the government’s expansion of the SHe-Box digital monitoring portal, and the intersection of POSH obligations with the newly enacted Labour Codes have collectively moved POSH compliance from an HR checkbox into a Board-level governance responsibility. Courts are examining whether ICCs are properly constituted, procedurally sound, and actively functioning — not just whether they exist.
This article explains what the POSH Act requires, what has changed in 2025–26, and what the most common compliance gaps look like in practice.
This article provides general information about POSH compliance in India. It does not constitute legal advice. POSH compliance requirements vary depending on organisational structure, sector, and State-specific rules.
What the POSH Act Requires: The Statutory Framework
The POSH Act applies to all workplaces in India — private companies, government organisations, NGOs, educational institutions, hospitals, and remote/hybrid work environments — that employ 10 or more employees. Organisations with fewer than 10 employees are covered through the Local Committee mechanism notified by the District Officer.
The Act’s core obligations for covered employers are:
- Constitute an Internal Complaints Committee (ICC) at every branch or office with 10 or more employees
- Draft and display a written POSH policy that defines sexual harassment, outlines complaint procedures, and provides protection against retaliation
- Conduct regular training and awareness programmes for all employees
- Ensure the ICC completes any inquiry within 90 days of receiving a complaint
- Submit an annual report to the District Officer detailing complaints received, resolved, and pending
- Disclose POSH compliance in the company’s Board’s Report under the Companies Act, 2013
Non-compliance carries penalties: under the Act, first-time violations attract fines of up to Rs. 50,000. Repeat violations can result in higher penalties and, in certain circumstances, cancellation of the business licence.
The ICC: What Proper Constitution Looks Like
The most common POSH compliance failure in practice is an ICC that exists on paper but is not properly constituted as required by law.
Under Section 4 of the POSH Act, the ICC must include:
- A Presiding Officer who is a senior woman employee of the organisation
- At least two other employees (preferably committed to women’s rights and social work)
- One external member from an NGO or body committed to women’s causes, or a person familiar with issues related to sexual harassment
- At least half the total ICC members must be women
Common constitution errors that courts have flagged:
- The Presiding Officer is no longer employed at the organisation and the ICC has not been reconstituted
- The external member’s term has expired and has not been renewed — the term is three years
- The ICC has fewer than 4 members after resignations, without a replacement process
- The ICC is constituted at the headquarters but not at branch offices or remote locations with 10 or more employees
In Aureliano Fernandes v. State of Goa (2023), the Supreme Court issued detailed directions on the proper constitution and functioning of ICCs, emphasising training, procedural rigour, and adherence to the principles of natural justice. Courts are now actively reviewing ICC constitution when POSH-related cases reach them.
SHe-Box: The Government’s Digital Monitoring System
SHe-Box (Sexual Harassment electronic-Box) is the Government of India’s centralised complaint management and monitoring system for POSH, administered by the Ministry of Women and Child Development. The portal was revamped in August 2024, and its usage has increased significantly since.
According to Parliamentary data cited by compliance specialists, 254 workplace sexual harassment complaints were filed on SHe-Box in 2025, with 296 complaints received since the portal’s August 2024 revamp, and additional filings in early 2026.
The significance of SHe-Box for employers: when a complaint is filed through this government portal, it enters a traceable ecosystem visible to the relevant regulatory authority. Complaints filed through SHe-Box are no longer confined to internal HR channels. Organisations are expected to be registered on the portal and to respond to complaints routed through it within defined timelines.
Employers are now expected to register their ICC details on SHe-Box as part of compliance documentation. An ICC whose details are outdated or incorrect on the portal is a visible compliance gap.
POSH in the Remote and Hybrid Workplace
The definition of ‘workplace’ under the POSH Act has always been broader than a physical office. The Act covers any place visited by an employee in connection with their work, including client sites, conferences, and business travel.
In 2025 and 2026, judicial and regulatory practice has firmly confirmed that the POSH Act’s workplace definition extends to remote work. A WhatsApp message, a Zoom call, an email, or a communication on a professional messaging platform can fall within the jurisdiction of the ICC if the conduct is connected to the employment relationship.
Organisations must update their POSH policies to explicitly address:
- Conduct on digital communication platforms
- Virtual meetings and online interactions during work hours
- Behaviour on professional networking sites where the employment connection is present
- Remote work situations where colleagues interact without being physically co-located
What the Labour Codes Change for POSH
The four Labour Codes, which came into force on November 21, 2025, do not replace the POSH Act — the POSH Act remains a standalone statute. However, the Labour Codes interact with POSH obligations in one important practical way.
The Occupational Safety, Health and Working Conditions (OSHWC) Code, 2020 now formally recognises night shifts for women employees, with prescribed safeguards including consent requirements. Organisations operating night shifts must ensure that their POSH compliance and workplace safety frameworks align with the new OSH Code requirements.
Additionally, the mandatory appointment letter requirement under the Labour Codes — which must be provided to all workers, including contractual and fixed-term staff — creates a natural integration point: the appointment letter is an appropriate vehicle for communicating the existence of the POSH policy and the ICC contact details to all new workers from day one.
The Board’s Report Obligation
Under Section 134(3)(o) of the Companies Act, 2013, every company’s annual Board’s Report must include a statement on whether the company has complied with the POSH Act. This makes POSH compliance a Board-level disclosure requirement, not merely an HR function.
In practice, this means that non-compliance with the POSH Act is a matter that company directors must address in their annual filings — and omitting or providing incorrect information in the Board’s Report carries its own legal consequences under the Companies Act.
A Practical 2026 POSH Compliance Checklist
Based on the statutory requirements and the most common gaps identified in practice, organisations should assess themselves against the following:
- ICC is properly constituted: Presiding Officer is a current senior woman employee; at least half the members are women; an external member from an NGO or relevant body is appointed.
- ICC terms are current: All member terms are within the three-year tenure limit; replacements have been made for departed members.
- ICC is constituted at every branch or office with 10 or more employees — not just headquarters.
- POSH policy is written, current, and displayed prominently in both physical workspaces and on internal digital platforms.
- Policy has been updated to cover remote and hybrid work.
- Annual training has been conducted for all employees; ICC-specific training has been conducted for committee members.
- Annual Report has been submitted to the District Officer for the relevant financial year.
- POSH compliance is disclosed in the Board’s Report.
- Organisation is registered and ICC details are current on the SHe-Box portal.
- Appointment letters issued to all employees include reference to the POSH policy and ICC contact information.
Conclusion
The POSH Act is not new. What is new in 2026 is the enforcement environment around it. Courts are examining ICC constitution in detail. The SHe-Box portal has created a traceable complaint ecosystem. The Board’s Report obligation has made POSH a corporate governance matter, not just an HR one. And the Labour Codes have created new integration points between employment compliance and workplace safety.
An ICC on paper is not an ICC in function. A policy displayed in the office is not training. The compliance question in 2026 is not ‘do we have a POSH policy?’ It is ‘does our POSH framework hold up to scrutiny?’
