What HR policies are legally mandatory in India?

Very few documents are mandatory as policies in themselves. A POSH policy and a constituted Internal Committee are required at ten employees. Certified standing orders are required for industrial establishments above the applicable threshold. Beyond that, most obligations are about doing the thing — paying minimum wages, depositing PF, granting statutory leave — rather than about publishing a policy describing it. The policies matter because they make consistent compliance possible.

How many HR policies does a small company need?

Fewer than most think. Below fifty employees, around eight policies covering leave, attendance and hours, probation and confirmation, code of conduct, POSH, IT and confidentiality, reimbursement, and exit will handle almost everything. Companies that write thirty policies at twenty employees end up with a document set nobody follows.

Do we need a separate POSH policy?

Yes. The POSH Act requires the employer to formulate and display a policy, constitute an Internal Committee including an independent external member at ten or more employees, conduct awareness programmes, and file an annual return. It is the one policy that is genuinely mandatory and specifically prescribed.

When should a company write an HR policy manual?

The trigger is not headcount but decision-making. Once more than one person is making decisions about hiring, pay, leave or discipline, inconsistency starts compounding — and inconsistency is what creates both grievances and legal exposure. For most companies that is somewhere between twenty and thirty people.

HR Policies List for Indian Companies

Most companies write HR policies in the wrong order, at the wrong time, and in the wrong quantity. Either there is nothing at all at eighty employees, or there are thirty-four policies at twenty-five employees, written by copying a manual from a much larger company.

Both fail the same way: policies nobody follows, which is worse than no policy, because an unenforced rule establishes that your rules are advisory.

This is what to write, and when.

The principle: policy follows decision-making

The trigger for writing a policy is not headcount. It is the point at which more than one person is making the same kind of decision.

While the founder approves every leave request personally, a leave policy is documentation of what they already do consistently. Once three managers are approving leave independently, you have three policies whether you wrote them or not — and the differences between them will surface as a grievance.

That crossover typically happens between twenty and thirty people.

Stage 1 — At ten employees

Small, and two of these are legal obligations.

POSH policy and Internal Committee. Mandatory at ten employees. Requires a formulated and displayed policy, a properly constituted Internal Committee with a woman at senior level as Presiding Officer and an independent external member, awareness programmes, and an annual return. This is the one genuinely prescribed policy, and the one most commonly missing at this stage.

Employment documentation set. Offer letter, appointment letter and terms, drafted together so they agree. Not a policy, but the foundation everything else sits on.

Leave policy. Even if brief. Entitlement, how it accrues, how it is applied for, and what carries forward — checked against the applicable state Shops and Establishments Act so it is not below the floor.

Code of conduct. One page is enough at this size. Professional conduct, conflict of interest, confidentiality, use of company property.

That is four items. Companies that build more at this stage are usually solving for an investor question rather than an operational one.

Stage 2 — Around twenty-five to fifty employees

Where informality genuinely stops working.

Attendance, working hours and remote work. Hours, flexibility, and the rules for hybrid or remote arrangements. Most current questions arise here, and most handbooks are silent.

Probation and confirmation. Duration, extension, the process, and — critically — what happens if confirmation is neither given nor refused. That omission produces a specific and recurring dispute.

Reimbursement and travel. Categories, limits, approval, claim process and timelines.

IT, systems and confidentiality. Acceptable use, whether you monitor (say so if you do), data handling, and what happens to access at exit.

Grievance procedure. A real route, with an alternative where the grievance concerns the line manager.

Exit policy. Resignation, notice, handover, full and final settlement timeline, and the documents the employee will receive.

Compensation administration. Pay dates, payslips, the increment cycle, how variable pay works. Not individual salaries.

Around eight to ten policies in total at fifty people. That is sufficient, and it is followable.

Stage 3 — Around fifty employees

Two things trigger here.

Creche facility. Establishments with fifty or more employees must provide a creche within the prescribed distance, with four permitted visits a day. The trigger is total headcount, not the number of mothers — which is why it is missed.

Performance management. Once you have fifty people, ratings, increments and promotions need a defensible basis. Goal setting, review cycle, calibration across managers, and what a performance improvement plan actually involves.

Learning and development, if there is a budget. Built from a training needs analysis rather than a catalogue.

Stage 4 — Around one hundred employees

Certified standing orders, for industrial establishments. The Industrial Employment (Standing Orders) Act generally applies at one hundred workmen, and several states have reduced the threshold — in some cases to fifty. Where it applies, model standing orders govern until yours are certified. The certified list of misconduct is what your disciplinary action rests on.

Formal disciplinary procedure, aligned to those standing orders.

Succession and high-potential identification, for the roles where an unplanned departure would genuinely hurt.

Structured compensation bands. By this size, ad hoc compensation has produced parity problems that are expensive to unwind.

Policies most companies write too early

Detailed travel policy with grade-wise entitlements. At thirty people, a limit and an approver is enough.

Elaborate rewards and recognition frameworks. These become administrative overhead before there is anything to administer.

Multi-level PIP procedures. Necessary at scale, theatre at forty people.

Whistleblower policy, unless required by your sector or your customers. Where it is required, it needs to be real.

Extensive values and culture documentation presented as policy. Values belong in a handbook. Framing them as rules confuses what is actually binding.

Policies commonly missing when they should not be

POSH, or a POSH policy with an Internal Committee that was constituted years ago and has since lost half its members.

Data protection for HR data. HR usually holds the largest volume of personal data in the organisation with the weakest controls around it. The DPDP Act applies to it.

Remote and hybrid working, still absent from a large number of handbooks.

Confirmation-by-default, the silent gap described above.

Moonlighting and outside employment. Increasingly contested, and usually unaddressed until it becomes a problem.

Social media conduct, particularly where employees are identifiable as yours.

Making them actually work

A policy that exists and is not followed is a liability, because it evidences a standard you did not meet.

Write for the person applying it. If a line manager cannot answer a routine question from it, rewrite it.
Do not include what you will not enforce.
Check for contradiction against the appointment letter and standing orders, clause by clause.
Date and version everything, so you can establish which version applied when.
Obtain acknowledgement, and re-acknowledge on material change.
Brief managers separately. They are the ones applying it.
Review annually, and immediately on crossing a threshold or opening in a new state.

The minimum viable set

If you are starting from nothing and have fewer than fifty people, this is the list:

Employment documentation — offer letter, appointment letter, terms
POSH policy and constituted Internal Committee
Leave policy, checked against your state’s Shops Act
Attendance, working hours and remote work
Probation and confirmation, including confirmation by default
Code of conduct
IT, systems and confidentiality
Reimbursement and travel
Grievance procedure
Exit and full and final settlement

Ten policies. Perhaps two weeks of work done properly, once. It covers almost everything that actually comes up, and it is short enough that people can be expected to have read it.

Everything beyond this list should be written when a real situation demonstrates you need it — not in anticipation of one.

The HR policies every Indian company actually needs