POSH Compliance for Startups and SMEs: Checklist, Costs, Training and Penalties

Founders usually discover POSH in one of three ways: an investor's diligence checklist, a large customer's vendor onboarding form, or a complaint. The first two are inconvenient. The third is expensive. This guide sets out exactly what a startup or SME has to do, what it costs, and how to run it on an annual cycle without a full compliance team.

Does POSH apply to startups?

It does. Nothing in the Act turns on the age, size, funding or recognition status of the business. A DPIIT-recognised startup, a bootstrapped agency, a family-run trading firm and a listed company are subject to the same law — only the reporting layer on top differs.

Two thresholds matter:

• Ten or more workers at a workplace → the employer must constitute an Internal Committee under Section 4.
• Fewer than ten workers → no IC obligation. Complaints go to the Local Committee constituted by the District Officer under Section 6. The employer's preventive duties under Section 19 continue to apply.

Does POSH apply to small companies, LLPs and firms?

Yes, in each case. The Act attaches to the employer and the workplace, not to the corporate form.

The distinction matters commercially. A small private limited company often assumes that because Rule 8 does not apply to it, POSH does not either. It does. Only the Companies Act disclosure format changes; the IC, the policy, the training and the Section 21 annual report all remain.

Counting your employees correctly

The single most common startup error is counting only the payroll.

Counted towards the ten: full-time employees, part-time employees, probationers, trainees, apprentices, interns (paid or unpaid), fixed-term and contractual staff, daily-wage workers, and personnel engaged through a contractor or manpower agency.

Assessed per workplace, not per company. If you run a 14-person office in Bengaluru and a 6-person office in Indore, the Bengaluru office needs an IC. The Indore office does not — but its employees are not left unprotected: their route is the Local Committee, and your policy should tell them so.

Crossing the threshold is a compliance event. The obligation arises when the workplace employs ten or more workers. If you hire past ten in March, the committee should be constituted then — not deferred to the next financial year.

What if we have fewer than ten employees?

You are not required to constitute an Internal Committee. You are still expected to:

• Provide a safe working environment under Section 19
• Adopt and circulate a POSH policy, and tell employees that complaints go to the Local Committee of the district
• Display the penal consequences of sexual harassment
• Assist an aggrieved employee in approaching the Local Committee or the police
• Keep records of any awareness activity you run

Practically, most sub-ten startups adopt a policy anyway, because client onboarding and investor diligence ask for one, and because the cost of doing so is negligible.

What a startup actually has to put in place

1. POSH policy

A policy tailored to your business — not a downloaded template. It must define sexual harassment as the Act does, define your workplace including remote and travel settings, name your committee, and set out the complaint route and timelines. Drafting guidance: POSH policy for companies.

2. Internal Committee

By written order, at each workplace with ten or more workers:

• A Presiding Officer — a woman employed at a senior level. If your team genuinely has no senior woman, the Act allows nomination from another office or administrative unit of the same employer, or from another workplace or organisation
• At least two members from among employees
• One external member from an NGO or association committed to the cause of women, or a person familiar with issues relating to sexual harassment
• At least half the members must be women; tenure up to three years

For a 15-person startup this usually means a four-member committee, three internal and one external.

3. The external member — the part startups cannot do in-house

This is the seat that cannot be filled by a co-founder's contact or the company's retained lawyer. It requires an independent person meeting the statutory description. Under Rule 3, the employer pays the external member an allowance of ₹200 per day of proceedings plus travel reimbursement; in practice, qualified practitioners are engaged on an annual retainer or per-sitting professional fee, which is entirely permissible.

Full detail: Internal Committee under the POSH Act.

4. Employee training and IC orientation

Section 19 requires awareness programmes for employees and orientation for committee members at regular intervals. The Act does not fix a number; the accepted standard is one employee session and one IC session per year, each evidenced by a dated attendance record. For a small team, a 60–90 minute session covers it.

5. Display and dissemination

Put the penal consequences of sexual harassment and the IC constitution order on a notice board at each office. Photograph it. Circulate the policy and collect acknowledgements at induction.

6. Annual compliance

• The IC prepares the annual report for the calendar year under Section 21 and Rule 14, and it is submitted to the employer and the District Officer — even in a nil year
• For companies, POSH data goes into the Board's Report. Since 14 July 2025, that disclosure must include the number of complaints received, disposed of, and pending beyond ninety days, in addition to the statement on constitution of the Internal Complaints Committee
• Where the State or district requires it, register on SHe-Box and maintain Nodal Officer and IC details

Full detail: POSH annual report and filing.

SHe-Box registration: what startups should know

Following the Supreme Court's directions in Aureliano Fernandes v. State of Goa and the orders that have followed, the Ministry of Women & Child Development relaunched the SHe-Box portal on 29 August 2024 as a single-window platform for complaints and as a repository of Internal Committee and Nodal Officer details. Several States, including Delhi and Karnataka, have publicly directed organisations to register and upload IC details, and district-level surveys of IC constitution have been under way.

Stated precisely: this is not an express section of the POSH Act. It flows from Supreme Court directions and MWCD and State instructions. For a startup the practical answer is straightforward — check your State's notice, appoint a Nodal Officer, and register. Registration is free and takes an afternoon.

Cost considerations

There is no government fee for POSH compliance. Costs are driven by four things:

The economics are simple. Preventive compliance for a sub-50-person company is a small recurring cost. A defective inquiry, a Section 26 penalty, a failed diligence round or a workplace dispute that reaches litigation is not. We publish costs as drivers rather than fixed figures because location count, headcount and the external member's engagement model change the number materially — ask for a scoped quote rather than working from a headline price.

Common startup mistakes

• "We're too small." The threshold is ten workers at a workplace, counting interns and contractors.
• Counting only the payroll, and missing the threshold by excluding interns and contract staff.
• An all-male or majority-male committee, or a male Presiding Officer.
• No external member, or a "friendly" external member connected to the founders.
• A template policy naming no committee members and quoting timelines that do not exist in the Act.
• No display on the notice board — a direct Section 19(b) failure and the easiest to spot.
• No records. Training happened, but there is no dated attendance sheet, so it cannot be evidenced.
• No annual report because there were no complaints.
• Committee tenure lapsed at three years, with the original order still on the wall.
• Discovering all of the above during diligence, two weeks before a term sheet is signed.

Penalties and non-compliance

Under Section 26, an employer who fails to constitute an Internal Committee, fails to act on the committee's recommendations, or contravenes or abets contravention of the Act or the Rules is punishable with a fine which may extend to ₹50,000. On a second or subsequent conviction the punishment may be twice that quantum, and the appropriate Government may cancel the licence or registration required to carry on business, or withdraw or refuse renewal or approval.

For companies, a missing or incorrect POSH disclosure in the Board's Report is a separate Companies Act default attracting penalty under Section 134(8) on the company and its officers in default.

And for a startup, the commercial consequences usually arrive first: a diligence finding that delays a round, a vendor onboarding rejection, a disqualified RFP, or an inquiry whose findings are challenged because the committee was never validly constituted.

Practical annual POSH compliance calendar

Adjust for the financial-year items if your Board calendar differs, but keep the calendar-year cut for the Section 21 report.

Startup POSH compliance checklist

Who should consider professional assistance?

• Startups crossing ten employees for the first time, at any single location
• Founders with no suitable senior woman employee for the Presiding Officer role
• Companies with no access to a qualified independent external member
• Startups preparing for a funding round, acquisition or large-customer onboarding
• SMEs operating across two or more districts with district-wise reporting to manage
• Companies whose Board's Report disclosure now needs verified complaint data after the July 2025 amendment
• Any employer facing a live complaint without an experienced committee

Frequently asked questions