If you manage HR at an Indian company with 10 or more employees, you must comply with the POSH Act. Since 17 June 2026, the rules for reporting and tracking have changed. The Ministry of Women & Child Development (MWCD) has upgraded the SHe-Box portal to SHe-Box 2.0, made Internal Committees (ICs) follow stricter case-filing rules, and made the annual report machine-readable. Instead of a yearly Word document, you now have a live, trackable compliance record that regulators can review quickly.
The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 (POSH) has been in place for more than ten years. On 17 June 2026, the MWCD introduced SHe-Box 2.0 with five important updates:
Portal-generated Case IDs. Every complaint gets a unique SHe-Box ID. You cannot use your own case number.
Real-time status for complainants. Complainants can log in and see case status (received, under inquiry, evidence stage, report drafted, employer action awaited).
Structured annual report. The annual report is now a structured form on the portal (validated fields). Free-text Word uploads are no longer accepted.
Local Committee (LC) integration. Establishments with fewer than 10 employees can route complaints to the District-level Local Committee via SHe-Box 2.0.
Compliance dashboards for MWCD and regulators. The Ministry and sector regulators can view aggregate compliance data (complaints, resolutions, pending cases) by state and sector.
These updates change the process, not the POSH Act itself. However, compliance is now monitored more strictly and transparently.
POSH SHe-Box 2.0: 12-Step Compliance Checklist
Getting Started (Sections 4–6)
1. Set up a properly formed Internal Committee (IC). Section 4 says every workplace with more than 10 employees must have an IC. Here are the rules for who should be on the committee:
Presiding Officer: This should be a senior woman employee. If there isn’t one, choose a senior woman from another unit or branch of the same company.
Include at least two employees committed to women’s causes or with experience in social work or legal matters.
Add one external member from an NGO or association that works for women, or someone who understands sexual harassment issues.
Make sure at least half of the committee members are women.
A common mistake is leaving out the required external member. If this happens, any IC inquiry can be challenged.
2. Make IC contact details easy to find. Section 19(b): Show the IC members and the penalties for sexual harassment in visible places like notice boards and on the intranet.
3. Ensure a safe working environment. Section 19(a): Ensure women are safe not only from employees but also from clients, vendors, and visitors they meet at work.
Responding to Complaints
4. Create a clear process for receiving written complaints. The IC should be easy to contact through email, a physical drop-box, phone, and SHe-Box 2.0. Share this process during onboarding, annual training, and on the intranet.
5. Stick to the required inquiry timelines.
Start the inquiry within 7 working days after receiving a complaint.
Complete the inquiry within 90 days.
The IC should send its report to the employer within 10 days after the inquiry ends.
The employer must take action within 60 days of getting the IC report.
Missing these timelines means failing to comply with the law
6. Provide interim relief when necessary. Section 12: The IC can recommend transferring the respondent, transferring the complainant if she requests it, or granting leave for up to three months. Failing to consider interim relief is a compliance gap, even if the complaint is later found unsubstantiated.
The audit process
7. Send the annual report to the District Officer using SHe-Box 2.0. Section 21 + Rule 14: Every employer must file an annual report containing:
Complaints received
Complaints disposed of
Cases pending beyond 90 days
Awareness programmes conducted
Action taken by the employer with SHe-Box 2.0, you file this report through the portal in a set, validated format.
8. Add POSH details to the Directors' Report. Section 22: Companies must disclose the number of complaints received, disposed of, and pending in the Directors' Report under the Companies Act.
9. Retain records for 5 years. Rule 7(6): Maintain a register of complaints, inquiry reports, actions taken, and annual reports for at least 5 years.
Building awareness
10. Hold regular workshops and training sessions. Rule 13(a): Organize orientation for IC members and regular awareness sessions for all employees. Do this at least once a year, but twice a year is even better.
11. Raise awareness during onboarding. Brief every new employee on the POSH policy, IC members, and complaint process at induction. Provide this information in writing and get a signed acknowledgement.
12. Keep working on workplace culture. POSH focuses on both prevention and redressal. Having a responsive IC is important, but building a respectful workplace culture is the main goal.
The top HR challenges for 2026
Challenge 1: Rules for IC composition are now enforced more strictly. SHe-Box 2.0 now checks if the IC you register matches the IC handling each case. If you change your external member but don’t update the portal, your cases will be flagged.scconline+1
Challenge 2: The numbers in your Directors' Report must match what you file in SHe-Box. Auditors now compare the POSH case numbers in your Directors' Report with your SHe-Box 2.0 submissions. If the numbers don’t match, you can expect audit questions.scconline+1
Challenge 3: POSH and DPDP compliance overlap. Inquiry records include sensitive personal data. The DPDP Act 2023 requires your IC to handle evidence, storage, access, and retention in line with both POSH and data protection rules.ssrana+1
Challenge 4: It’s hard to find external members. Qualified external members, such as NGO or gender experts, are difficult to find in mid-sized cities. Make sure to budget a proper honorarium, since not having an external member puts you at compliance risk.registerkaro+2
Challenge 5: Issues for cross-border companies. If you have employees in India, POSH rules apply. A global helpline or a US ombudsman cannot replace a properly set up Indian IC for your Indian workplace.
Frequent compliance mistakes with POSH SHe-Box 2.0
The Internal Committee (IC) is sometimes only list ed on the notice board but does not actually meet or receive training.
Some complaints are handled outside the Internal Committee, such as through a conversation with a supervisor. However, all harassment complaints must be addressed by the IC.
Some organizations skip the annual report in years with no complaints. Section 21 requires an annual report every year, even if there are zero complaints.
Contract workers, interns, and consultants are sometimes excluded. Section 2(f) defines "employee" broadly to include contract, temporary, apprentice, probationer, and similar roles.
Sometimes, an HR member who reports to the same line as the accused chairs the IC. Structural independence matters more than simply having a senior person in charge.
Key changes since the SHe-Box 2.0 launch on 17 June 2026
The portal must now generate Case IDs. You can no longer use your own numbering system.
The annual report must be filled out using the structured form on the portal, with validated fields. Free-text Word documents are no longer accepted.
Complainants can now log in and track their cases in real time.
There is now sector-level visibility. Regulators can view overall POSH metrics, and listed companies’ POSH data is included in broader governance reporting.
How to catch up if you’re behind
Update your IC as required by Section 4. Make sure it has the right members, includes an external member, and maintains gender balance.
Register or update your details on SHe-Box 2.0. Link all active cases to the IDs generated by the portal.
Set up your intake channels, such as email, drop-box, intranet, and SHe-Box 2.0, and make sure everyone knows about them.
Hold a mandatory POSH refresher session for all employees within the next 60 days.
Get your next annual report ready using the SHe-Box 2.0 format before December.
Looking to manage POSH compliance without adding extra work for your HR team?
With dcomply's POSH module, you get an IC composition tracker, a complaint intake portal, an inquiry timeline dashboard, and annual report generation that works with SHe-Box 2.0. It covers everything required by the Act, without the hassle of extra spreadsheets.
- Start your POSH compliance workspace at dcomply
- Earn your certification as a POSH Practitioner at dcomply Academy -POSH Act Practitioner: Advanced Certification (in-house HR) ——or ——POSH Lead Practitioner Certification (senior HR / DPO track)
Further reading:
What is the DPDP Act 2023? A Plain English Guide for Indian Business Owners
DPDP compliance checklist for Indian SMEs: 47 things to do before the rules are notified