What does it take to implement the POSH Act, 2013 in one of India’s most complex workplaces: the non-profit sector?

Imagine a belief, rather than a statement from any particular organisation: “We are a nonprofit. Everyone here is committed to the same cause.”

It sounds reassuring. It can also become the reason an organisation postpones asking difficult questions about itself.

My concern is the ease with which good intent can be mistaken for good governance. A mission-driven organisation is not automatically a safe organisation. People can believe deeply in equality, dignity or justice and still exercise power without sufficient accountability. Shared purpose does not eliminate that power. Sometimes, it makes questioning it feel like questioning the cause itself.

I see the non-profit workplace as particularly complex because its responsibilities do not stop at an employment contract. A volunteer may depend on a reference. A field worker may depend on project accommodation. A beneficiary may depend on access to food, healthcare or shelter. The person who controls that access can hold considerable power without appearing anywhere on an HR organisation chart.

Implementing POSH in this setting requires legal discipline and an honest understanding of those relationships. Copying a corporate policy will not do the whole job.

Start with the workplace that actually exists

I would begin with a map of people, places and authority, before reviewing the policy’s wording.

Include employees, consultants, volunteers, interns, fellows and community workers. Map implementing partners, donors and trustees as well as beneficiaries, including children and vulnerable adults. These groups do not all have the same legal status. They all matter to the organisation’s prevention and response arrangements.

Then map the work: field visits, shelters, camps, schools, hospitals, remote workplaces, transport and overnight accommodation. Record who allocates rooms, approves travel, selects volunteers, signs fellowship extensions and decides whether a person remains eligible for assistance. Include work-related digital contact, even where people use personal phones.

The POSH Act expressly includes NGOs, societies and trusts within its workplace definition, alongside other specified establishments. It also includes places visited during employment and employer-provided transport for those journeys.[1] Its definition of employee extends beyond payroll, including work without remuneration and work on a voluntary basis; an aggrieved woman at a workplace may be employed there or not.[1] The Ministry’s March 2026 parliamentary response also explains the inclusion of consultants, unpaid interns and field staff.[10]

Those provisions matter when someone says a woman cannot complain because she is “only a volunteer” or “not our employee”. Her status alone does not settle the question. Examine the workplace connection, parties and appropriate jurisdiction rather than rejecting her at reception.[1]

For organisational prevention, I would go further than debating the boundary of each location. The travel briefing should explain conduct expectations, accommodation arrangements and reporting contacts before the team leaves. A partner-run camp should not become a place where nobody accepts responsibility.

Trust needs rules when relationships become unequal

Informality can make small organisations responsive. It can also leave people unsure whether they are speaking to a friend, supervisor, mentor or decision-maker.

Consider a hypothetical fellowship. A senior programme lead sends personal messages to a fellow after field hours and links access to a future role with private meetings. The fellow tells a coordinator, who promises to “have a word”. Nothing is recorded. Months later, the fellowship is not renewed, and nobody can establish what was reported or how it was handled.

The failure starts before anyone decides whether the alleged conduct is established. The organisation has allowed a concern to disappear into an informal relationship.

A founder may also be the person who raised the money, recruited the trustees and built the programme’s public credibility. Asking a junior colleague to challenge that person through their immediate manager is a poor design. Friendship, gratitude and dependence need to be considered when setting reporting routes.

Reputation and funding pressures deserve explicit discussion. If raising a concern is framed as endangering the programme, the person affected is being asked to carry responsibility for everyone else’s future. I would make it a leadership obligation to reject that bargain, including when the allegation involves a respected fundraiser or long-serving colleague.

Connect the policies without collapsing the law

People should not need to diagnose their experience before asking for help. The organisation, however, must distinguish the processes that follow.

POSH provides a statutory framework for sexual harassment of women at work. A broader organisational policy can address people of all genders, but that does not make every complaint a statutory POSH complaint or expand the IC’s statutory jurisdiction.[1] Keep the wider protection and the legal distinction visible.

Safeguarding should address harm involving programme participants and others affected by the organisation’s activities. Bullying, discrimination, abuse of authority, retaliation, whistleblowing, conflicts of interest and partner misconduct also need identifiable routes. Some concerns overlap. Others require a different process or external authority. “Outside POSH” must never become shorthand for “nothing we can do”.

In a hypothetical shelter, an adult resident reports that a worker is demanding personal favours in exchange for continued accommodation. The response should consider immediate safety and continuity of services, possible sexual harassment, safeguarding, disciplinary responsibility and any criminal-law implications. It should not begin and end with checking whether the resident has an employee number. Equally, the organisation must assess what authority it has over a non-employee respondent rather than promising an ordinary employee inquiry in every case.[1]

Children require a separate, explicit instruction. POCSO covers persons below eighteen, irrespective of gender.[9] Section 19 requires a person with knowledge of an offence, or apprehension that one is likely to be committed, to inform the Special Juvenile Police Unit or local police; section 21 addresses failure to report, with its specified provisions and exception for children.[9] Internal permission, donor clearance or completion of an IC inquiry cannot be prerequisites to that reporting duty.[9]

Train the first recipient to protect the child, record the disclosure carefully and activate the appropriate reporting and support route. Do not send a child through repeated internal interviews to decide whether leadership is comfortable escalating. For vulnerable adults, design accessible support while respecting agency and assessing the applicable law; do not assume the child-protection reporting framework applies unchanged.

Make the committee credible before it receives a complaint

For workplaces with ten or more workers, the IC requirement must be addressed under the Act; the Local Committee route includes establishments where an IC has not been constituted because there are fewer than ten workers, and complaints against the employer himself.[1] An NGO should assess its actual workforce and administrative units, not assume that a small salaried team or one head-office committee resolves its obligations.[1]

Section 4 requires a senior woman employee as Presiding Officer, at least two employee members, and an external member from the specified NGO, association or relevant-expertise category; at least half the members must be women.[1] Appointment orders, membership terms and contact details need attention, not just names in a policy.[1][2]

Legal composition is the starting point. I would also examine relationships: Is a member the founder’s close associate? Does a trustee supervise the complainant? Does the external advisor also advise the donor whose representative is involved?

Require conflict disclosures, case-specific recusals and lawful replacement arrangements. A person being “external” does not, by itself, settle independence. Ungender’s external member services are relevant to this discussion, but selection should still examine experience, relationships and availability for the organisation’s circumstances.[5]

For complaints against a founder, establish whether that person is the employer within the Act’s definition and therefore whether the Local Committee route applies.[1] Seniority alone is not the legal test. Where independent investigation support is appropriate, define its role carefully. It must not replace the statutory IC or LC with a private panel simply because leadership prefers that arrangement.[1]

The governing body should secure resources, manage its own conflicts and monitor whether responsibilities are discharged. It should not direct the finding. Give the complainant an independent communication contact, while preserving the respondent’s opportunity to answer and the committee’s fair process.[1][2]

A reporting route must work without an office email address

An address on an intranet is of little help to someone who never uses the intranet. I would test access with a volunteer arriving for one day, a community worker using a shared phone and a beneficiary who cannot read the policy language.

Provide named contacts and a route outside the reporting hierarchy, including access to the external member or an independent advisor for guidance. Publish verified LC and relevant emergency contacts where appropriate. An advisor who receives a concern must explain their role and the competent authority, not quietly become the decision-maker.

Offer a combination of phone, appropriately managed WhatsApp intake, in-person assistance and written channels. Choose languages people use. Ask whether it is safe to call back, leave a message or send a notification. Avoid collecting a detailed account in a group chat or on a manager’s personal device.

A familiar messaging app is not a guarantee of confidentiality or security. Set ownership, access, transfer into the restricted case record and retention arrangements. Tell people who may need the information and why. Never promise that nobody else will learn of a complaint: fair process and legal reporting obligations can require disclosure.[1][2][9]

An anonymous signal may justify a safety check or closer attention to a pattern. It is not automatically a valid statutory POSH complaint. Section 9 provides for a written complaint and reasonable assistance to a woman who cannot make it in writing.[1] Explain that distinction without making assistance conditional on perfect English or a completed corporate form.

After receipt, communicate the next step, responsible contact and limits of the process. A person should not have to ask the manager they fear whether anyone is acting.

Conduct’s incident-reporting capabilities can provide a digital route alongside these assisted channels.[7] For an NGO, I would test who can actually use that route, how someone on a shared device gets help and who follows up after submission. Software does not remove connectivity or literacy barriers, and the statutory complaint requirements still apply.

Train for the decisions people actually face

Section 19 requires regular employee awareness programmes and IC orientation; Rule 13 addresses policy dissemination, committee capacity building and publication of members’ contacts.[1][2] A single annual presentation should not be the whole learning plan.

I would use local-language sessions, short audio explanations and low-literacy visual material, tested with intended users. A translated legal document is not necessarily understandable. Ask participants to explain how they would get help rather than merely signing attendance.

Keep some sessions separate. Leadership needs to work through founder allegations, donor pressure and conflicts. Managers need practice receiving concerns without investigating them informally. Volunteers need a short induction before deployment. Frontline teams need field, travel and accommodation scenarios. The IC needs sustained learning on jurisdiction, evidence, hearings, confidentiality and reasoned documentation. IC training is a distinct service, not a substitute for the rest of this work.[6]

A hypothetical exercise might involve a volunteer receiving sexual messages from a partner representative while staying at a remote project site. Ask who can arrange safe transport, who receives the concern, which organisation has authority over the respondent and what information may be shared. Another exercise could examine a donor requesting private meetings with a beneficiary.

Repeat the essentials when a new cohort joins, a project moves or a field supervisor changes. Do not require anyone to disclose a personal experience during training. The point is to practise a response, not collect live complaints in front of colleagues.

Conduct’s e-learning modules offer self-paced learning, including multilingual training.[7] I would use them for repeat learning between facilitated sessions, checking language suitability, device access and comprehension with the intended group. They should support, not replace, accessible in-person or assisted learning for people who need it.

Protection must include what people stand to lose

An assurance against retaliation needs operational meaning. For a fellow, the risk may be a stipend or reference. For a volunteer, it may be removal from assignments. For a field worker, it may be accommodation or transport. For a beneficiary, it may be access to services.

In a hypothetical programme, a woman reports misconduct and is then removed from community visits “for her own comfort”. Her allowance falls and she loses the work she values. A measure described as protection has shifted the cost onto her.

I would require a documented safety discussion, consideration of the person’s preferences and review of adverse changes after a report. Preserve lawful interim measures and avoid treating them as findings of guilt. POSH section 12 provides for specified interim recommendations on the aggrieved woman’s written request; Rule 8 addresses certain supervisory responsibilities.[1][2] Broader anti-retaliation commitments should expressly cover witnesses and those helping someone report.

Partner agreements should identify contacts, referral responsibilities, cooperation with competent authorities, preservation of relevant records and lawful information-sharing boundaries. They should also address how services continue while a concern is assessed. Neither organisation should use the partnership as a reason to send the person back and forth.

Donor accountability is not unrestricted case access

I would ask donors to support the cost of credible reporting and response, not reward a declaration that there have been no complaints. A zero count, by itself, tells a governing body too little about whether people can speak.

Agree reporting expectations before an incident. Aggregate information about training reach, functioning committees, timeliness and corrective actions can support oversight. Be careful even with aggregation: a role, district and programme name can identify someone in a small cohort.

Section 16 restricts public disclosure of complaint contents, identities and inquiry-related information.[1] A donor contract does not override statutory confidentiality. For any proposed case-level disclosure, assess lawful authority, necessity, the recipient’s role and the minimum information required. Restrict access to those with a legitimate need; do not circulate a case file through a fundraising chain.

The governing body needs enough information to hold the organisation accountable for delays, resources and implementation. That is different from receiving every statement or negotiating an acceptable verdict. Child-protection reporting must continue through the legally required route regardless of the donor’s preferences.[9]

Build an operating plan the NGO can sustain

Resource constraints should shape the design, not excuse an absent system. I would phase the implementation work, while dealing immediately with urgent safety needs and existing legal non-compliance. This is a proposed operating plan, not a statutory grace period.

First, name an accountable implementation owner and an unconflicted governing-body sponsor. Map the workforce, locations and partners; establish the correct committee arrangements; verify contacts; and identify gaps in immediate reporting access. Budget for external expertise, interpretation, travel, training time and protected records. Do not assume an unpaid volunteer will maintain this indefinitely.

Next, agree how POSH, safeguarding and general grievances connect. Give each concern a restricted record of receipt, routing and responsibility. Document conflict checks, communications, interim measures and follow-up. Keep detailed case material separate from ordinary programme files. Assign a backup owner so that an employee’s departure does not erase the process.

Conduct’s case-management tools can support restricted records through role-based access, guided workflows and case tracking.[7] The NGO should define access, ownership and backup arrangements before using them. Continuing oversight should track delays and follow-up without giving trustees or donors unrestricted case access, and the IC must retain its statutory authority and independent judgment.

Track statutory stages separately. The POSH Act provides ninety days for completion of the inquiry, ten days after completion for the findings report, and sixty days from receipt for the employer or District Officer to act on recommendations.[1] These are not a single promised resolution period. Keep local acknowledgement targets distinct from legal deadlines, including the section 9 complaint period and its permitted extension.[1]

Annual reporting also needs an owner. Sections 21–22 distinguish committee reporting from the employer’s reporting obligation; Rule 14 specifies complaint and disposal numbers, matters pending beyond ninety days, awareness programmes and the nature of action taken.[1][2] Check relevant submission instructions and the NGO’s legal form rather than borrowing another entity’s filing calendar.

SHe-Box belongs in this review. The Ministry describes it as a central repository of IC/LC information and a route for forwarding complaints to the committee with jurisdiction and monitoring their status.[4][11] Check current onboarding, registration and information-update requirements with the relevant authorities. Portal use does not substitute for a valid committee, accessible local reporting or the underlying annual-reporting duties.[1][2][4]

Once these arrangements exist, test them. Can someone reach a contact without a manager’s permission? Does the backup answer? Can a non-email user understand what happens next? Review unresolved handoffs and repeat the test after staffing or partner changes.

Where Ungender fits into that work

At Ungender, our work includes reviewing policies and field-workforce arrangements, constituting and strengthening ICs, external membership and advisory support, and training employees, managers, ICs and leadership. We help distinguish POSH from safeguarding concerns and general grievances, design accessible reporting routes for non-email users, and advise on senior-person and conflict situations.

That work also includes conducting or supporting sensitive inquiries within the appropriate mandate, maintaining records, timelines and documentation, and supporting annual reporting, SHe-Box and continuing governance. These are responsibilities that need to connect; buying each as an isolated activity can leave the organisation without a clear owner between them.

Conduct provides reporting and case-management capabilities, including guided workflows, role-based access and tracking.[7] For an NGO, I would assess those capabilities alongside language, connectivity, assisted reporting and access controls. Software cannot decide jurisdiction or supply independence where the underlying relationships remain conflicted.

An organisation reviewing its arrangements can speak to Ungender with its workforce map, partner structure and existing reporting process.[8] That is a more useful starting point than asking only for a policy template.

I want a mission-led organisation to be able to examine itself with the same seriousness it brings to the problem it exists to solve. Informality cannot replace accountability, and protecting the cause cannot require silence from the people doing its work or receiving its support.

If a volunteer, field worker or beneficiary experiences misconduct tomorrow, will they know they can report, whom they can trust, and what happens next?

Are you an HR professional in the non-profit sector? Write to us at contact@ungender.in to explore how Ungender can partner with your organisation on PoSH governance.

Penned by Pallavi Pareek, Founder of Ungender and Conduct.

Sources

[1] https://www.indiacode.nic.in/bitstream/123456789/2104/1/A2013-14.pdf — act

[2] https://shebox.wcd.gov.in/assets/uploaded_content/SH_Rules,_20132.pdf — rules

[4] https://www.pib.gov.in/Pressreleaseshare.aspx?PRID=2079040&lang=2&reg=48 — shebox

[5] https://www.ungender.in/posh-external-member-services — external-member

[6] https://www.ungender.in/ic-training-for-posh-compliance — ic-training

[7] https://www.ungender.in/conduct-posh-compliance-platform — conduct

[8] https://www.ungender.in/contact-us — contact

[9] https://dashboard.doj.gov.in/fast-track-special-court/assets/pdf/POCSO%20Act.pdf — POCSO Act, Department of Justice copy

[10] https://pib.gov.in/PressReleasePage.aspx?PRID=2245028&lang=1&reg=3 — MWCD parliamentary response, 25 March 2026

[11] https://www.pib.gov.in/PressNoteDetails.aspx?ModuleId=3&NoteId=156174&lang=1&reg=3 — PIB: SHe-Box routing and monitoring description