How to Create a POSH Policy for Small Businesses (Step-by-Step)

To create a POSH policy, define what counts as harassment, name your ICC members, spell out the complaint process, and share the document with every employee. The POSH Act India (Sexual Harassment of Women at Workplace Act, 2013) requires this from every employer, regardless of team size. Most small business owners either skip it or copy a generic template off the internet. Both paths lead to legal risk, because when a complaint actually lands, a vague or missing policy leaves you with no framework to respond.

Key Takeaways

• Every Indian employer must have a written POSH policy under the POSH Act India
• The policy must cover definitions, ICC details, complaint process, timelines, and penalties
• Businesses with 10+ employees need an Internal Complaints Committee (ICC)
• Display the policy at your workplace and share it during onboarding
• Annual awareness training is a legal requirement, not optional

Why Does Your Business Need One?

Section 19 of the POSH Act India, notified by the Ministry of Women and Child Development, lists specific duties for every employer, and a written anti-harassment policy is one of them. But beyond the legal mandate, there is a very practical reason.

At Petpooja, we work with over 30,000 businesses across India. When a harassment complaint comes in and there is no written policy, the response stalls. Nobody knows the process, the timelines, or who is supposed to handle it. Within a week, what could have been handled internally turns into a legal notice from a lawyer. A written policy prevents that by spelling out the rules before anyone needs them.

What Should the Harassment Definition Include?

Section 2(n) defines sexual harassment as any unwelcome act or behaviour, direct or implied. But a bare legal line does not help the floor manager at a garment showroom in Surat or the billing staff at a warehouse in Bhiwandi. You need examples that match their daily reality.

Under Section 2(n) of the POSH Act 2013, sexual harassment covers five categories: unwelcome physical contact, verbal harassment, non-verbal conduct, quid pro quo demands, and creating a hostile work environment. Your policy must define each type with workplace-specific examples that employees across all roles can understand.

If your team cannot read a sentence in the policy without looking up a word, that sentence needs rewriting.

Name Your ICC Members in the Document

Any business with 10 or more employees must set up an Internal Complaints Committee under the POSH Act India. Four members at minimum: a senior woman as Presiding Officer, two internal members the team trusts, and one external member from an NGO or legal practice who is not on your payroll. Women must make up at least half the panel, and each term caps at three years.

Here is what we see go wrong most often at Petpooja. The policy says “contact the ICC” but lists no names, no phone numbers, no email IDs. When someone actually needs to file a complaint, they open the document and find nothing useful. So name every member. Print their contact details right there in the policy. If a member’s three-year term has expired and you have not replaced them, that is a Section 4 violation that can invalidate any inquiry the panel conducts.

For businesses with fewer than 10 employees, you skip the ICC. Instead, complaints go to the Local Complaints Committee (LCC) at the district level. Your policy should name the LCC, explain how to reach it, and make clear that you will help the complainant file. The POSH compliance checklist from Arohana Legal covers this process.

How Should the Complaint Process Work?

This is the section generic templates get most wrong. They write “report to the committee” and move on. Your policy needs to walk someone through the full sequence.

A complainant files in writing: email, letter, or a printed form. Verbal complaints should be accepted too and noted down by the ICC. The deadline is three months from the incident, though the ICC can extend it by another three months with a valid reason. Once filed, the ICC has seven days to begin the inquiry and 90 days to finish it. After that, the employer has 60 days to act on the ICC’s recommendation.

Under the POSH Act, a complainant has three months from the date of the incident to file with the ICC. The committee must begin the inquiry within seven days, complete it within 90 days, and the employer must act on the findings within 60 days.

Picture a retail store manager in Lucknow who picks up this policy for the first time because someone just walked into their office with a complaint at 11 AM on a Tuesday. Can they follow the process from that document alone? That is the test.

Confidentiality, Anti-Retaliation, and Penalties

Three clauses that small business policies almost always miss, bundled together because they work as a set.

Under Section 16, sharing complaint details with anyone outside the ICC is a punishable offence. That includes casual mentions in the admin’s WhatsApp group or a conversation over chai with another manager. Your policy must promise that complaint details stay private, that the complainant faces no negative action (no transfer, no demotion, no quiet reduction in duties), and that anyone who leaks information faces disciplinary consequences.

On the penalty side, lay out the range of actions the ICC can recommend if the respondent is found guilty: written apology, formal warning, transfer, withholding a promotion, salary deduction as compensation, suspension, or termination. Section 16 makes it a punishable offence to share complaint details outside the ICC. The Act also prohibits retaliation against complainants and allows penalties ranging from apology to termination. Section 14 permits action against malicious complaints, but unproven complaints do not qualify as false.

Make that distinction clear in the policy. If employees fear punishment for complaints that do not succeed, they will stop reporting.

Translate the Policy and Display It

Under Section 19, you must put the policy and the penalties for harassment at a visible spot in your workplace. Laminated sheet on the notice board, poster near the entry, printout in the canteen.

Language is where most SMEs fall short. If your team in Tirupur speaks Tamil, the English notice board version is decoration, not communication. Pin a Tamil copy next to it. Warehouse staff in Pimpri who speak Marathi need a Marathi version. The test is whether every person in your workplace can actually read the policy.

On top of the physical display, share a digital copy during onboarding. Every new hire gets it on day one and signs an acknowledgement. Petpooja Payroll lets you handle new employee setup and track these acknowledgements digitally, so you are not chasing paper across three branches.

How Often Should You Run POSH Training?

A policy nobody has read might as well not exist. Section 19, read with Rule 13, requires awareness workshops at regular intervals. One session per year is the legal floor.

Cover the basics: what the Act says, what behaviour counts as harassment, how to file, who sits on the ICC, what happens during the inquiry, and the confidentiality protections. For businesses with branches in multiple cities, a task management tool helps schedule sessions and track who showed up.

The SHe-Box portal guidance for 2026 recommends quarterly sessions for managers, especially around harassment through digital channels. Not a legal must yet, but quickly becoming what auditors expect.

What Mistakes Do SMEs Keep Making?

We have worked with thousands of businesses at Petpooja, and certain errors repeat regardless of industry.

The first is the Google template problem. Someone downloads a generic POSH policy, saves it in a folder, and never touches it again. But a diagnostic lab in Chennai and a construction firm in Hosur have very different daily interactions. Their harassment examples should reflect that. A copied template with corporate-office examples does nothing for a shop floor team.

The second is expired ICC terms. A policy written during company registration in 2022 with four names listed. By 2025, at least one term has lapsed. We saw this at a retail chain in Rajkot in January 2026: the respondent’s lawyer got the entire inquiry thrown out because one panel member’s term had expired seven months earlier.

And the third is scattered records. When a compliance issue hits, you need joining dates, branch assignments, and training attendance within hours. If that data lives in WhatsApp groups and different Excel files across three managers’ laptops, you have lost before you start. A proper payroll and HR system fixes that.

Conclusion

A POSH policy is not a formality. Along with other HR and payroll basics, it gives your team a clear framework for what is acceptable, how to report problems, and what happens next. Define harassment, name the ICC, write the complaint process, add confidentiality and penalty clauses, display it in every language your team speaks, and train people every year. Fines start at ₹50,000, so do not wait.

Frequently Asked Questions