IN
USA
CA
IN
A sales executive at a software company had been managing a key enterprise account for two years. The client’s senior representative, who was not her employer’s employee, had made a habit of comments that she found deeply uncomfortable. On a site visit, his behaviour crossed a line she could not ignore. She reported it to HR the next week.
HR’s first response was a question that should not have been a question: “But he’s not our employee. What can we actually do?”
The answer, grounded in the plain text of the PoSH Act, is quite a lot. The assumption that the Act only operates between co-employees is one of the most consequential misreads in Indian workplace compliance. It leaves women without recourse in precisely the situations where they are most structurally vulnerable: dealing with clients they cannot easily refuse, vendors their company depends on, or visitors whose business matters.
What the Law Actually Says
The PoSH Act was not written to protect women only from their colleagues. Its architecture is broader, deliberately so.
Section 2(a) defines an “aggrieved woman” as one who, “whether employed or not,” alleges harassment at the workplace. The phrase “whether employed or not” is the operative phrase. It means the Act’s protection is not conditional on an employment relationship between the complainant and the organisation where the harassment occurred. A vendor’s representative who is harassed during a meeting at your office can file a complaint with your Internal Committee. A client who is harassed by your employee during a business visit is equally protected.
Section 2(n) defines sexual harassment as any unwelcome act or behaviour of a sexual nature, including physical contact, demands or requests for sexual favours, sexually coloured remarks, showing pornography, and any other unwelcome physical, verbal, or non-verbal conduct of a sexual nature. Critically, this definition does not require the person engaging in that conduct to be employed by anyone at the workplace.
Section 2(m) defines a “respondent” as the person against whom the aggrieved woman has made a complaint. Under the PoSH Act, the IC primarily has jurisdiction to inquire against an employee as defined under Section 2(f) where the alleged harasser is a third party Anyone, including a client, vendor, delivery executive, auditor, or visitor, can be a respondent before an IC.
And then there is Section 19(g), the employer’s obligation provision, which is where the third-party question becomes most consequential for HR and leadership.
Section 19: The Employer’s Duty When the Harasser Is an Outsider
Section 19 of the PoSH Act lists the employer’s duties. Most compliance programmes focus on the internal-facing obligations: form an IC, conduct annual training, display notices, submit annual reports. But Section 19 contains a clause that is routinely overlooked in practice.
It requires every employer to “cause to initiate action, under the Indian Penal Code or any other law for the time being in force, against the perpetrator, or if the aggrieved woman so desires, where the perpetrator is not an employee, in the workplace at which the incident of sexual harassment took place.”
Read that again. Where the perpetrator is not an employee. In the workplace where the incident occurred.
This provision directly addresses the scenario HR teams most often feel helpless about. When a client, vendor, or visitor harasses a woman at your workplace, the Act requires you to act. The form that action takes depends on the circumstances, but inaction is not a legally defensible position.
In ICICI Bank v. Vinod Kumar, the court held explicitly that employers cannot absolve themselves of liability for sexual harassment by claiming that the perpetrator was not their employee but a third party or contractor. The employer’s duty to maintain a safe workplace does not disappear because the harasser carries a visitor’s badge rather than an employee ID.
The Three Scenarios HR Needs to Plan For
Scenario 1: Your employee is harassed by an outsider at your workplace
This is the most directly covered situation. A client visits your office and harasses a woman employee. A vendor’s representative makes unwelcome advances during a meeting. A delivery partner behaves inappropriately with staff.
In all these cases, the woman can file a complaint with your IC. Your IC has jurisdiction to investigate. And under Section 19, your organisation is required to take action at her request, including initiating appropriate legal proceedings against the perpetrator and, where the harasser belongs to another organisation, forwarding the inquiry report to that organisation for further action.
The IC cannot discipline someone who does not work for you. But it can conduct a fair inquiry, document findings, recommend interim protective measures such as reassigning the client account, and formally communicate findings to the harasser’s employer. It can also provide the complainant with support to pursue action under criminal law if she chooses that route.
Scenario 2: Your employee harasses someone from outside the organisation
A vendor’s sales representative reports that she was harassed by your employee during a meeting. A client’s staff member raises a complaint about your salesperson’s conduct. A visitor is harassed by someone in your team.
Here, the complainant is not your employee. But your IC still has both the authority and the obligation to investigate. The Delhi High Court, in a ruling that later informed the Supreme Court’s position in Dr. Sohail Malik v. Union of India, clarified that there is nothing in the PoSH Act that limits its scope to cases where the aggrieved woman is employed by the same organisation as the respondent. The IC can inquire into the complaint, and it can recommend disciplinary action against your employee.
This is also where your organisation’s PoSH policy needs to explicitly name vendors, clients, and visitors as people covered under the policy, both as potential complainants and as people your employees are expected to treat with the same standard of conduct applied to colleagues.
Scenario 3: Harassment happens off-premises during a work-related interaction
Your employee is harassed by a client during a business dinner. A vendor harasses your staff member during a site visit. A client sends inappropriate messages after a work-related call.
Section 2(o) defines “workplace” expansively to include “any place visited by the employee in connection with work or for reasons arising out of work.” This means the IC’s jurisdiction is not limited to the physical office. A client dinner, a site visit, a work conference, even a work-related communication on a personal device can fall within the Act’s coverage if there is a sufficient nexus to the employment relationship.
The nexus test matters. Not every interaction between two people who happen to have a professional relationship qualifies. But where the interaction clearly arises from or occurs in the course of a work engagement, the Act applies.
Why “He’s Not Our Employee” Is Not a Legal Defence
The response HR gave the sales executive at the start of this piece reflects a common but legally unsupported assumption: that the PoSH Act creates obligations only within the employer-employee relationship.
This assumption has three specific problems.
First, it misreads the text. The Act deliberately distinguishes between who can be an aggrieved woman, who can be a respondent, and what the employer’s obligations are. The employer’s obligations under Section 19 explicitly extend to situations involving perpetrators who are not employees.
Second, it ignores judicial interpretation. Courts have consistently read the Act’s definitions broadly, in line with the legislative intent to protect every woman in every workplace context. The Sohail Malik ruling affirmed IC jurisdiction in cross-organisational complaints. The ICICI Bank ruling rejected the third-party exemption argument directly.
Third, and practically, it creates a safety failure that the organisation is responsible for. If your workplace enables harassment by a non-employee and your response is inaction because he is “not our employee,” you have failed your own team member regardless of what the legal position eventually turns out to be.
The Gaps That Still Exist
Being precise about the law’s reach also means being honest about its limits.
The IC cannot discipline the outsider directly. Your IC can investigate, document, and recommend. It cannot impose penalties on someone who does not work for your organisation. The practical action available is: recommending protective interim measures for the complainant, forwarding findings to the harasser’s employer for action on their side, and supporting the complainant in pursuing criminal or civil remedies if she chooses.
Coordination between organisations is not mandated in detail. The Act allows the IC to forward findings to the respondent’s employer, but does not prescribe what that employer must then do or on what timeline. In practice, the quality of follow-through on the other organisation’s side varies enormously.
Vendor and client relationships create commercial pressure. This is the unsaid part. HR’s “what can we actually do?” often carries a second, unspoken question: “what can we do without losing the account?” The Act has no provision for this consideration. The employer’s duty under Section 19 does not contain a commercial relationships exception. Organisations that allow this pressure to suppress action are not only failing the complainant, they are assuming legal and reputational risk that is considerably larger than the cost of addressing the complaint.
Serial clients are a recurring risk. In sectors where women are routinely client-facing, a client who harasses is frequently not a one-time offender. Account managers, hospitality staff, field sales teams, and customer service roles all see this pattern. The IC needs to be prepared to treat a pattern of complaints involving the same external party as a systemic issue, not a series of isolated incidents.
What Your PoSH Policy and IC Need to Do Differently
Most PoSH policies in Indian organisations are written as if the only people they govern are employees on payroll dealing with other employees on payroll. For any organisation with external-facing roles, that is an incomplete policy.
Explicitly name third parties in your policy scope. Your PoSH policy should state clearly that clients, vendors, contractors, visitors, and any other third parties interacting with the organisation in a work context are covered, both as people your employees must not harass, and as people who can file complaints with your IC if they are harassed at your workplace.
Brief IC members on third-party complaints. IC members are often trained to handle internal complaints. They need to understand the specific procedural steps for complaints involving external respondents: how to conduct an inquiry without direct disciplinary authority over the respondent, what to include in findings when forwarding to another organisation, and how to recommend protective measures for the complainant.
Build an escalation protocol for client and vendor situations. When a third-party complaint is raised, someone in leadership needs to own the commercial relationship decision. That conversation should happen in parallel with, not instead of, the IC process. Account reassignment, vendor engagement review, or formal communication to the client or vendor’s organisation are decisions that require both HR and business leadership involvement.
Train employees who work in external-facing roles specifically. The standard annual PoSH training addresses what harassment is and how to file a complaint. For sales teams, account managers, field staff, and anyone who regularly visits client sites or hosts external visitors, the training should also cover: how to recognise and respond when a client or vendor’s behaviour crosses a line, how to escalate without fear of commercial consequences, and what the organisation will do to protect them.
Display IC contact details visibly. Section 19 requires employers to display notices about the IC and the consequences of harassment. These notices serve a function for third parties too. A vendor representative or client visitor who can see IC contact details at your reception understands that your organisation takes this seriously and that a mechanism exists if they need it.
The Message That Needs to Land Across the Organisation
The sales executive in our opening scenario should not have had to hear “what can we actually do?” She should have heard: “This is covered. Here is what happens next.”
Getting to that response requires preparation that most organisations have not done. It means extending the PoSH policy’s scope explicitly. It means training IC members on external-party scenarios. It means having a clear protocol for when business relationships and legal obligations intersect. And it means building a culture where a woman who is harassed by a client does not assume the commercial relationship will be prioritised over her safety.
The PoSH Act created the framework. The gap is in implementation.
How Kelp Can Help
Kelp works with organisations across India to build PoSH programmes that are complete, not just compliant. Our support includes:
PoSH policy review and drafting that explicitly covers third-party scenarios, including clients, vendors, and visitors. IC member training that addresses the specific procedural steps for complaints involving external respondents. Sector-specific PoSH training for external-facing teams in IT, BFSI, hospitality, pharmaceuticals, and manufacturing. PoSH advisory engagements that help organisations build the protocols, documentation, and escalation frameworks that third-party complaints require.
If your organisation is not certain how its current PoSH programme handles a complaint involving a client or vendor, that uncertainty is worth resolving now.
Reach us at info@kelphr.com, call 95001 29652, or visit www.kelphr.com.
