POSH Act Compliance in India: What US-Managed GCCs Need to Know

A mid-size IT company in Bengaluru had an internal complaints committee on paper. The Presiding Officer had left the organization eight months earlier. Nobody reconstituted the committee. When a complaint was filed in early 2026, the entire inquiry was challenged because the ICC was improperly constituted. Proceedings were invalidated. The employer received a show-cause notice from the District Officer.

This is exactly the kind of compliance failure that US-managed GCCs run into. The POSH Act exists on the India team's onboarding checklist. An ICC gets set up at launch. Nobody reviews it again until something goes wrong.

If you manage or are building a global capability center in India, this guide explains what the POSH Act requires, where US companies most often fall short, and what "compliant" actually looks like in 2026.

POSH Act Full Form and What the Law Actually Does

The POSH Act's full form is the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013. It came into force on December 9, 2013, giving statutory form to the Supreme Court's Vishaka guidelines from 1997, which had filled the legislative gap after the landmark Vishaka vs. State of Rajasthan judgment.

The law does three things. It defines sexual harassment broadly to include physical contact and advances, demands or requests for sexual favors, sexually colored remarks, displaying pornographic material, and any unwelcome physical, verbal, or non-verbal conduct of a sexual nature. It creates a mandatory institutional mechanism, the Internal Complaints Committee (ICC), to receive and adjudicate complaints. And it places the compliance burden squarely on the employer, with penalties for non-compliance that go beyond fines to include business licence cancellation.

The law focuses on the protection of women. In practice, many organizations extend their POSH policy to cover all genders, but the statutory obligation under the Act applies to women employees, including permanent, contractual, temporary, and part-time staff.

Who Must Comply: The 10-Employee Threshold

Every organization with 10 or more employees must implement a POSH policy and constitute an Internal Complaints Committee. There is no industry exemption, no entity-type carve-out, and no grace period for new establishments.

For US-managed GCCs, this threshold is crossed before the first engineering sprint finishes. Most GCCs launch with 15 to 30 employees and scale from there. The compliance obligation exists from the day the 10th employee joins, not from the day someone in legal notices it.

For international businesses setting up operations in India, POSH compliance must be integrated from the incorporation stage itself. Building it in retrospectively, after the team is already at 25 or 50 people, creates gaps that are harder to close cleanly.

Organizations with fewer than 10 employees fall under a separate mechanism. Complaints go to the Local Complaints Committee (LCC) established by the district officer, rather than an internal committee.

The Internal Complaints Committee: What It Must Look Like

The ICC is the core institutional requirement of the POSH Act. Getting it wrong is the single most common compliance failure.

A valid ICC must have:

• A Presiding Officer who is a senior woman employee. If no senior woman is available within the establishment, one may be nominated from another office or unit of the same organization.
• At least two internal members from among employees, committed to the cause of women or who have experience in social work or legal knowledge.
• One external member from an NGO or association committed to the cause of women, or a person familiar with issues relating to sexual harassment. This external member cannot be an employee of the organization.
• At least 50% of the total members must be women.

The ICC term is three years. Members cannot be reappointed to the same committee indefinitely. The Presiding Officer and members must be formally appointed by written order from the employer.

The most common compliance failure: the ICC exists on paper but is not properly constituted due to an expired term, a missing external member, or a Presiding Officer who no longer works at the organization.

This is the scenario that invalidated the Bengaluru company's inquiry. An ICC that was validly constituted at launch becomes invalid the moment the Presiding Officer resigns and nobody acts. When that happens, any complaint filed during that gap cannot be properly adjudicated. The employer faces both the original complaint and a procedural challenge simultaneously.

For US leadership teams managing India teams remotely, ICC reconstitution is the kind of task that falls through the cracks. It requires local HR attention on a three-year cycle, which means building it into someone's annual compliance calendar, not assuming it will self-manage.

What "Workplace" Means Under the POSH Act

The POSH Act defines workplace broadly under Section 2(o) to include any place visited by the employee arising out of or during the course of employment, covering work-from-home setups, virtual meetings, official travel, company transport, and any digital platform used for work communication.

For GCCs running hybrid or fully remote India teams, this matters. A WhatsApp message or Zoom call can fall under POSH jurisdiction. An incident on an official messaging platform or during a video call with a US manager is within scope of the Act.

This is not a theoretical edge case. As more GCCs operate with US managers and Indian engineers on the same video calls, Slack channels, and project management tools, the definition of "workplace" expands beyond any physical office boundary.

Your POSH policy needs to address this explicitly. A policy drafted in 2014 that references the office address and the physical notice board is not adequate for a hybrid team in 2026.

The Employer's Full Compliance Obligations

Having an ICC is necessary but not sufficient. Under the POSH Act, employers have the following core legal obligations: establish and maintain a functional ICC; formulate and communicate a written POSH policy to all employees; conduct regular awareness and training programs; provide a safe mechanism for filing complaints; complete investigations within 90 days of receiving a complaint; submit a mandatory annual report to the District Officer; and display information about the Act and the ICC in conspicuous workplace locations.

The annual report to the District Officer must include the number of complaints received, the number resolved, complaints pending at year-end, and details of any disciplinary action taken. This filing is separate from the Board Report disclosure (see below) and has its own deadline.

Effective July 14, 2025, amendments to the Companies (Accounts) Rules 2014 now require organizations to make detailed disclosures about POSH compliance, including the number of complaints filed, their resolution status, and the preventive measures in place, directly in the Board's Annual Report. For GCCs structured as Indian private limited companies or subsidiaries, this disclosure is now a mandatory part of annual corporate filings.

The SHe-Box portal, the government's centralized complaint and monitoring platform, also requires employer registration. In 2026, SHe-Box registration is treated as a compliance indicator, not just a voluntary step.

Complaint Timelines the ICC Must Follow

When a complaint is filed, the clock starts immediately. The Act specifies:

• Complaints must be filed within three months of the incident (extendable to six months by the ICC for reasonable cause).
• The ICC must complete its inquiry within 90 days of receiving the complaint.
• The employer must act on the ICC's recommendations within 60 days of receiving the inquiry report.
• Appeals can be filed within 90 days before the appropriate authority.

These are statutory timelines, not guidelines. An ICC that takes five months to complete an inquiry is in procedural violation, regardless of how thorough the investigation was.

For US-managed GCCs where the ICC includes members who are also handling full-time engineering or operations roles, meeting the 90-day inquiry deadline requires active scheduling and prioritization. The inquiry process involves receiving the complaint, sending a copy to the respondent, giving both parties an opportunity to present their case, examining witnesses if needed, preparing a written report, and submitting it to the employer. That is a structured legal process, not a quick HR conversation.

Penalties for Non-Compliance

Failure to constitute an ICC attracts a fine of up to INR 50,000 for a first offence, with the possibility of cancellation of business licences or registration for grave non-compliances.

Repeat offences carry a doubled penalty. Beyond the statutory fine, a mishandled complaint exposes the employer to civil liability, regulatory scrutiny, and reputational damage.

For US companies with GCCs in India, the reputational dimension is especially relevant. India's tech talent market is concentrated and well-networked. A mishandled POSH complaint, or a complaint that surfaces in the press because the internal process was visibly inadequate, affects hiring in ways that go well beyond the immediate legal exposure.

How This Applies Differently to GCCs vs. EOR-Based Teams

The POSH Act compliance structure is the same regardless of how you hire. But the practical application differs depending on your setup.

GCC with its own Indian entity: You are the employer. Your entity must constitute and maintain the ICC, file the annual report, make the Board Report disclosure, and handle all complaints directly. The compliance obligation sits with your India leadership and HR team, with US parent oversight.

Team hired through an EOR: The EOR is the legal employer. In principle, the EOR carries the statutory employer obligation for POSH compliance for your employees. But this requires explicit confirmation from your EOR. Ask: "Do you maintain a valid ICC that covers our employees? How are complaints filed and managed? How do you handle annual reporting for POSH?" If the EOR handles POSH as an afterthought rather than as a structured compliance obligation, your employees are underprotected, and the EOR's compliance posture may not hold up to scrutiny.

Whether you are structured as a GCC or use an EOR, the practical safeguard for US leadership is the same: make sure someone in India is responsible for POSH compliance on a named, accountable basis, and make sure that accountability is reviewed at least annually.

→ For a broader look at India employment compliance for US companies: kaam.work/blog/how-payroll-actually-runs-in-india-a-month-by-month-breakdown

Frequently Asked Questions

1. What is the POSH Act full form?
   The full form is the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013. It is commonly referred to as the POSH Act. It mandates every employer in India with 10 or more employees to constitute an Internal Complaints Committee, draft and publish a written anti-harassment policy, conduct awareness training, and submit an annual report to the District Officer.
2. Does the POSH Act apply to US companies operating in India?
   Yes, without exception. Any employer operating in India with 10 or more employees must comply with the POSH Act, regardless of the parent company's country of incorporation. A GCC that is structured as an Indian private limited company or subsidiary, or that employs workers in India through an EOR, is subject to the same obligations as any Indian employer.
3. What happens if the ICC Presiding Officer leaves the organization?
   The ICC immediately becomes improperly constituted. The employer must appoint a replacement and issue a fresh written order before any new complaint can be adjudicated. Any complaint filed or inquiry conducted during the gap may be legally challengeable on procedural grounds. The employer should treat any change to ICC membership as an urgent compliance action, not an administrative formality.
4. Does the POSH Act cover remote and hybrid employees?
   Yes. The Act defines workplace broadly to include any location visited during the course of employment, as well as digital platforms used for work communication. A message sent on Slack, a comment made during a video call, or an incident during official travel all fall within scope. POSH policies and ICC training need to address hybrid and digital work scenarios explicitly.
5. What is the timeline for resolving a POSH complaint? Complaints must be filed within three months of the incident. The ICC must complete its inquiry within 90 days. The employer must act on the recommendations within 60 days. Appeals can be filed within 90 days of receiving the ICC's findings. These are statutory timelines, not targets.
6. What are the penalties for POSH non-compliance?
   A first offence carries a fine of up to INR 50,000. Repeat offences carry a doubled penalty. In serious cases, business licences or registrations can be cancelled. Beyond statutory penalties, a mishandled complaint or inadequate ICC creates civil liability exposure and reputational risk in India's tech talent market.
7. How often does POSH training need to happen?
   The Act mandates regular awareness programs. In 2026, the practical standard is annual training for all employees, with quarterly sessions recommended for managers, particularly covering hybrid and digital workplace scenarios. Training must be documented, not just conducted.

The Practical Checklist for US-Managed GCCs

For US leadership teams responsible for India operations, POSH compliance comes down to six recurring actions:

1. Confirm the ICC is validly constituted with all four required positions filled, at least 50% women members, and a current external member.
2. Check member terms. Three-year terms expire. Build the reconstitution into the annual compliance calendar before it lapses.
3. Update the written POSH policy annually. If it does not address remote work, digital platforms, and cross-border team dynamics, it is outdated.
4. Conduct and document annual awareness training for all employees. Manager-specific sessions for hybrid work scenarios are the 2026 standard.
5. File the annual report to the District Officer. Know who owns this filing on the India side and when it is due.
6. Make the Board Report disclosure on POSH compliance, now mandatory under the July 2025 amendment to Companies (Accounts) Rules 2014.

None of these require a legal team on retainer. They require someone in India with a compliance calendar, visibility into ICC membership status, and a direct line to US leadership when something needs escalation.

The GCCs that get POSH compliance right are not the ones with the most sophisticated policies. They are the ones where the ICC is actually active, training is actually conducted, and the annual filing actually happens.

For US and UK companies building India teams with full employment compliance managed from day one: kaam.work