Explicit Messages at Work: POSH and Cyber Evidence Steps

You receive a sexually explicit message, image, or video from a coworker. Your first impulse may be to delete it, confront the sender, or forward it to several colleagues so that someone believes you. Each reaction can make the next step harder. Preserve the material carefully, restrict its circulation, and create a written record before memories, accounts, or devices change.

This is an India-focused action plan for protecting yourself, using the Prevention of Sexual Harassment at Workplace Act, 2013, and preserving electronic material for an internal or police investigation. It cannot determine whether a particular communication meets every legal element. If the conduct includes an immediate threat, stalking, coercion, or a risk that intimate material will be distributed, prioritize your safety and contact the police and an Indian lawyer promptly.

Preserve your choices before you confront or report

You do not need to provoke another message or continue an upsetting exchange to build a case. One communication may be enough to report. If you reply at all, keep it brief and do not negotiate, threaten, or invite further material. Preservation matters more than argument.

Key takeaways

• Keep the original device and account available where possible; a screenshot is useful, but it should not be your only record.
• Capture the sender identifier, platform, date, time, and surrounding conversation, then use the platform’s own export function if it has one.
• Do not forward explicit material through ordinary email groups or workplace chats. Give it only to the designated Internal Committee, investigator, lawyer, police officer, or forensic professional through an agreed channel.
• A POSH complaint is ordinarily due within three months of the incident, although an extension may be available where delay is justified.
• An Internal Committee or Local Committee process and a criminal complaint can proceed at the same time. Neither replaces the other.
• You can request interim measures that reduce contact with the respondent while the inquiry is pending.

Build a clean incident record

1. Capture the complete screen. Include the sender’s visible name or address, account or telephone identifier, platform, timestamp, and enough surrounding conversation to preserve context. Avoid a tight crop that shows the offensive content but hides where it came from.
2. Record the sender’s account details. Where the platform permits it, capture the profile page, email address, telephone number, username, or other platform identifier connected with the communication.
3. Export the conversation. Use the application’s built-in export or download function. Keep the exported file in its original format. If you need an annotated or printable version, make that a separate working copy.
4. Retain the original device. Do not factory-reset it, reinstall the application, clear the conversation, or discard the handset or computer before obtaining professional advice. You can still mute, restrict, or block contact after preservation if that is necessary for your safety.
5. Write a chronology. Note when the communication arrived, when you saw it, what preceded it, whether it continued after an objection, and whom you informed. Date the note and distinguish what you directly observed from what another person told you.
6. Preserve connected records. Save relevant emails, call logs, meeting invitations, workplace-chat notifications, access records, and the names of witnesses who saw the communication or its immediate effects.
7. Create a simple evidence index. Give each item a label, describe what it is, state where the original remains, and record every person to whom you provide a copy.

Original devices, platform exports, visible identifiers, timestamps, metadata, and a documented chain of custody make it easier to test authenticity later. A screenshot shows what appeared on a screen; the underlying account, device, export, and metadata help establish how it got there and whether it was altered.

Preservation does not mean repeated exposure. Once the material is secured, move it out of your everyday view and limit access. If handling it is distressing, ask a trusted lawyer, investigator, or designated committee contact to supervise collection. Do not circulate explicit material merely to build support. Wider distribution can violate privacy, contaminate witness accounts, and create separate legal risk.

Choose the reporting route by what you need it to accomplish

The workplace process addresses safety, employment consequences, and institutional responsibility. The criminal process addresses suspected offences and the state’s investigative powers. You may need one or both. Do not let an employer tell you that a police complaint automatically ends its workplace duty, and do not assume that an internal inquiry can exercise the powers of the police.

Verify that the Internal Committee is real and properly constituted

An employer with 10 or more employees must constitute an Internal Committee. It should have a senior woman employee as Presiding Officer, at least two employee members with relevant commitment or experience, and an external member familiar with workplace sexual-harassment issues. At least half of the committee must be women.

Ask HR for the committee’s official contact details and current composition. Make the request in writing. If a covered employer cannot identify its committee, preserve that response and seek advice from an Indian employment lawyer or the appropriate district authority. Failure to constitute the committee is not a reason for you to abandon the complaint; it may itself indicate non-compliance.

Use the police route when workplace remedies are not enough

Sending obscene or sexually explicit electronic material may, depending on the content and circumstances, raise issues under Sections 67 or 67A of the Information Technology Act, 2000. Criminal provisions concerning sexual harassment or stalking may also apply. Criminal codes and evidentiary provisions are time-sensitive, so ask the investigating officer or counsel to identify the provisions currently applicable to your facts instead of copying section numbers from an old complaint template.

The two routes also use different standards. An Internal Committee decides a workplace matter on the balance or preponderance of probabilities. A criminal court requires proof beyond reasonable doubt. A police decision, acquittal, or unresolved investigation therefore should not be treated mechanically as the answer to a distinct workplace inquiry; the competent decision-maker must apply the proper standard to the evidence before it.

File a complaint that the committee can act on

A written POSH complaint is ordinarily filed within three months of the incident. An extension may be granted where the delay is justified, but do not rely on receiving one. Submit the core complaint on time even if a forensic export, witness statement, or police record is still pending. Identify the outstanding material and state that you will provide it when available.

Use this complaint structure

1. Identify the parties and workplace connection. Give your role, the respondent’s name and role if known, and how the communication arose through work.
2. Describe each incident separately. State the date, approximate time, location or digital platform, what was sent or said, and why the conduct was unwelcome. If you do not remember an exact time, say that rather than guessing.
3. Explain the sequence. Include relevant communication immediately before and after the incident, any request to stop, later contact, and any change in work treatment.
4. List the evidence. Refer to each item in your evidence index. State which records are copies and where the originals remain.
5. Name witnesses precisely. Explain what each person may know. Distinguish a witness who saw the message from a colleague whom you informed afterward.
6. Request preservation. Ask the employer in writing to retain relevant workplace email, messaging, access, audit, and device-management records before ordinary deletion or overwriting can occur.
7. Ask for specific interim protection. Identify the contact, reporting relationship, shift, location, or system access causing the present risk. Request the narrow change that would reduce it.
8. Request written acknowledgment. Ask for the date of receipt, the committee contact, the next procedural step, and a secure method for transferring sensitive files.

A useful subject line is Formal workplace sexual-harassment complaint and request to preserve records. In the opening paragraph, state that you are submitting a written complaint, identify the incident date, ask that relevant electronic records be preserved, and request secure instructions for delivering the evidence. This prevents a serious report from being treated as an informal request for managerial mediation.

Know what should happen after filing

The committee provides the respondent with the complaint and ordinarily allows 10 working days for a written response, documents, and witness information. It then hears both sides, examines the evidence, and prepares a reasoned report. The inquiry should be completed within 90 days, and the employer must act on the recommendations within 60 days.

Possible recommendations include an apology, warning, suspension, termination, or monetary compensation. Compensation may take account of mental trauma, career impact, and medical expenses. The proper measure depends on the established facts; it should not be assumed in advance.

You do not have to wait for the final report to ask for protection. Section 12 permits interim measures such as a transfer, a change in reporting arrangements, or leave for up to three months. Frame the request around the risk you need reduced. For example, ask that the respondent no longer approve your work, contact you privately, share a shift, or administer an account you must use. Interim protection is a risk-control measure, not a premature finding of guilt.

Confidentiality is not the same as anonymity. Section 16 restricts disclosure, but fairness requires notice to the respondent and an opportunity to answer the complaint and evidence. Do not post the allegations, identities, or explicit files publicly while the inquiry is active. Ask the committee who will receive the material, where it will be stored, and how access will be recorded.

The respondent is entitled to timely notice, a meaningful opportunity to respond, and an impartial hearing. A committee may recommend proportionate action for a demonstrably malicious complaint, but inability to prove an allegation is not by itself proof of bad faith. That distinction protects genuine complainants and preserves the credibility of the process.

Make cyber evidence verifiable, not merely visible

Digital evidence can be duplicated perfectly, edited convincingly, or separated from the account and device that gave it meaning. That is why a neat folder of screenshots may still invite questions. Your evidence packet should help an investigator answer four things: what the item is, where it came from, whether it changed, and who handled it.

Maintain a chain-of-custody log

• Assign each item a unique label, such as E-01 for the original chat export and E-02 for a screenshot set.
• Describe the item without overstating it: original device, native export, screenshot, printout, or working copy.
• Record the device or account from which it was collected and the date and time of collection.
• Record who collected it, who received it, when it changed hands, and why.
• Keep the unaltered file separate from copies used for annotation, printing, redaction, or review.
• Ask Information Security or a forensic professional to calculate and record a cryptographic hash where appropriate. The hash helps detect later alteration; it does not, by itself, prove who authored the content.

If the message is on an employer-controlled account or device, ask for a preservation hold immediately. The request should identify the relevant accounts, approximate time range, platform, and types of logs without demanding access to unrelated personal data. HR, Legal, and Information Security should agree on one evidence custodian so that multiple people do not download, convert, rename, or circulate separate versions.

Do not treat certification as an afterthought

Indian electronic-evidence practice has placed particular weight on authentication and certification when a party relies on a copy rather than the original electronic record. Anvar P.V. v. P.K. Basheer and Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal are the decisions commonly associated with the Section 65B framework for secondary electronic evidence.

Do not assume that attaching screenshots to an email completes this requirement. Ask Indian counsel, the police, or the forensic investigator which certificate and evidentiary provision currently apply, who must issue it, and what system information must be recorded. This is especially important where the original device is outside your control, the employer owns the system, a cloud service holds the data, or an account may soon be deleted.

The safe practical rule is simple: preserve early and certify through the person who actually controls or extracts the record. Trying to reconstruct provenance after a handset is replaced, an employee account is closed, or retention logs expire is harder and may leave an avoidable authenticity dispute.

If you receive the complaint as a manager or employer

Your job at intake is not to decide immediately who is telling the truth. It is to protect safety, preserve evidence, trigger the lawful process, and prevent retaliation while maintaining fairness. An improvised confrontation in a manager’s office can alert someone to delete records, pressure the complainant, or contaminate witness accounts.

1. Acknowledge the report in writing. Record when it was received, give the employee the committee contact, and explain the next procedural step. Do not promise a result or absolute anonymity.
2. Assess immediate risk separately from final merit. Ask whether the parties still share shifts, reporting lines, travel, physical space, systems, or private communication channels. Put proportionate interim controls in place where warranted.
3. Notify the Internal Committee promptly. A manager should not replace the committee with an informal investigation, private settlement, or credibility assessment.
4. Issue a narrow preservation instruction. Coordinate HR, Legal, and Information Security so that relevant logs, messages, accounts, and devices are retained without granting unnecessary access to sensitive content.
5. Control disclosure. Limit the evidence and identities to people with a defined role. Record access and use a secure transfer channel instead of a broad HR mailbox or group chat.
6. Protect both parties from prejudgment. Give the respondent notice and a fair opportunity to answer through the established process. Do not expose the complainant to repeated retelling or direct confrontation.
7. Monitor retaliation. Watch for exclusion from meetings, hostile scheduling, altered appraisals, loss of assignments, pressure to withdraw, or attempts to influence witnesses. Treat new conduct as a separate issue requiring documentation.
8. Offer practical support. Confidential counselling, flexible work adjustments, predictable updates, and a clear point of contact can reduce avoidable harm during the inquiry. These measures support the process; they do not determine its outcome.

Readiness begins before a complaint. Keep the committee properly constituted, display the policy and reporting contacts, train employees and managers regularly, provide more than one confidential reporting channel, and maintain a technology-use policy covering workplace collaboration tools and messaging applications. Define retention, access, escalation, and forensic responsibilities jointly across HR, Legal, and Information Security. A policy that exists only in an onboarding attachment will fail at the exact moment people need it.

Dignity requires both compassion and due process

A dharmic workplace ethic is practical here. Ahimsa requires stopping further harm. Karuna requires receiving a distressed person’s account without humiliation. Dharma requires a fair, competent process rather than prejudice or impulse. Seva requires the institution to do the work of prevention, preservation, inquiry, and support.

The religion, caste, community, or political identity of either party does not prove or disprove workplace misconduct. Conduct and evidence must decide the complaint. Communalizing an allegation weakens that discipline, exposes uninvolved people to hostility, and distracts from the employer’s concrete duty to maintain a safe workplace.

If you are holding an explicit workplace message now, take three steps before closing this page: make an unaltered export, write the chronology, and send a written complaint or preservation request to the proper committee contact. If there is a threat, stalking, coercion, or possible criminal dissemination, contact the police and Indian counsel without waiting for the internal inquiry to finish.

References

• DharmaRenaissance Blog — Mumbai Harassment Arrest: Practical POSH Compliance and Cyber Evidence Guide for Safer Workplaces