Home › Blog › Policies and compliance

How to Write a Sexual Harassment Policy for the New 30 October 2026 Duty

A sexual harassment policy sets out what the business means by harassment, what it does to prevent it, how anyone can report it and what happens next. For UK employers it has stopped being optional in practice. Since October 2024 employers have had to take reasonable steps to prevent sexual harassment of their workers, and from 30 October 2026 the Employment Rights Act 2025 raises that to all reasonable steps and makes employers liable for harassment of their staff by customers, clients and other third parties. This page explains the law in plain terms and gives a ten-section structure you can adapt, with a review checklist at the end.

What the law now requires

The Worker Protection (Amendment of Equality Act 2010) Act 2023 added a positive duty on employers to take reasonable steps to prevent sexual harassment of their employees in the course of their employment. It came into force on 26 October 2024. It is anticipatory: you must act before anything has gone wrong, not just respond to complaints.

The Employment Rights Act 2025 strengthens it. Under the government's updated implementation timeline, from 30 October 2026:

• Reasonable steps becomes all reasonable steps. Doing some sensible things is no longer enough if there was another reasonable step you could have taken and did not.
• Third-party harassment. Employers become directly liable for harassment of their workers by third parties, such as customers, clients, patients, contractors and members of the public, unless they took all reasonable steps to prevent it. This applies to harassment related to any protected characteristic, not only sexual harassment.

The Act also lets ministers set out specific steps in regulations, which would sit alongside the general duty rather than replace it. None had been made at the time of writing.

The Equality and Human Rights Commission's technical guidance on sexual harassment and harassment at work is the main reference for what tribunals will expect. It lists an effective policy, training, a clear reporting route, risk assessment and monitoring among the steps employers should consider.

The ten sections of a sexual harassment policy

Use these headings as the skeleton. Keep the language plain; a policy that staff do not read does little to show you took all reasonable steps.

1. Purpose and commitment. A short statement, signed by the most senior person, that the organisation does not tolerate sexual harassment or harassment related to any protected characteristic, and that it will act to prevent it.
2. Who and where it covers. Employees, workers, agency staff, contractors, volunteers and job applicants; on site, remotely, at client premises, at work events and parties, on business travel, and online in work chats, email and social media.
3. Definitions with examples. Sexual harassment, harassment related to a protected characteristic, and less favourable treatment for rejecting or submitting to harassment, using the Equality Act wording, followed by concrete examples: comments about appearance, sexual jokes, unwanted touching, sharing images, persistent requests for dates.
4. Third-party harassment. State that harassment by customers, clients, contractors or the public is covered, what staff should do if it happens, and that the business will act, including warning or refusing service to the person responsible.
5. Prevention measures. What the organisation actually does: risk assessment, training, rules for events and alcohol, lone working arrangements, how client-facing staff are supported.
6. How to report. At least two routes, so nobody has to report to the person they are complaining about: a line manager, a named HR contact, a senior manager, and where possible an anonymous channel. If you already run a speak-up line, link it here; see how to set up a whistleblowing policy.
7. What happens after a report. Timescales, informal and formal options, how an investigation runs, who makes decisions, interim measures such as changing shifts, and how the person reporting is kept informed.
8. Protection from victimisation. No one will be treated badly for raising a concern in good faith or giving evidence, and victimisation is itself a disciplinary matter.
9. Confidentiality and support. Information is shared only with those who need it; signpost the employee assistance programme, external helplines and the right to be accompanied at meetings.
10. Responsibilities, monitoring and review. Who owns the policy, how complaints are recorded and analysed, and the annual review date.

Steps that sit around the policy

A policy on its own will not meet an all reasonable steps standard. The Commission's guidance and the case law point to a set of supporting actions that make the document real:

Check how harassment interacts with your other policies. A conflict of interest policy should require declaration of personal relationships with reports, and your code of conduct should link to the harassment policy rather than restate it.

A checklist before 30 October 2026

• Does the policy name third-party harassment and cover every protected characteristic?
• Is there a reporting route that avoids the line manager?
• Have you completed and written down a risk assessment, including client-facing work and Christmas events?
• Have managers had training in the last 12 months, and can you prove it?
• Do customer-facing terms and notices say abuse of staff will not be tolerated?
• Is there a named owner and a review date?

Acas publishes free guidance on handling complaints and investigations that complements the Commission's technical guidance. Small businesses can scale the policy down, but not the steps: a five-person firm with client-facing staff still needs a reporting route and a plan for abusive customers.

Sources: Equality Act 2010 as amended by the Worker Protection (Amendment of Equality Act 2010) Act 2023; Employment Rights Act 2025 and the government's implementation timeline (updated July 2026); EHRC technical guidance. This page is general information, not legal advice. Back to the e-Business Ethics homepage.