Prevent workplace harassment

Two duties apply to every employer, whatever its size.

First, you must take all reasonable steps to prevent sexual harassment of your employees in the course of their employment, by colleagues, managers or anyone else they deal with at work. The duty began on 26 October 2024 as 'reasonable steps', and the Employment Rights Act 2025 raised it to 'all reasonable steps' on 30 October 2026. You must take every step that is reasonable for your organisation, not just some of them, and focus on prevention rather than reacting to incidents.

Second, you must not permit a third party, such as a customer, client, service user or contractor, to harass your employees. This liability began on 30 October 2026 and covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation. You are liable if it happens in the course of the employee's work and you failed to take all reasonable steps to prevent it.

You are also liable for harassment by your own staff in the course of their work unless you show you took all reasonable steps to prevent it.

How the duties are enforced

An employee cannot bring a tribunal claim for breach of the prevention duty on its own. Instead:

• When a tribunal upholds a sexual harassment claim and awards compensation, it must consider whether you also breached the prevention duty. If you did, it can add up to 25% to the compensation, reflecting how far you fell short.
• The Equality and Human Rights Commission (EHRC) can investigate if it suspects a breach, issue an unlawful act notice requiring an action plan, agree binding undertakings with you, or ask a court for an injunction. It does not need an individual complaint to act.

Employees can bring harassment claims, including claims about third parties, to an employment tribunal within 6 months of the act complained of where it happened on or after 1 October 2026. For earlier acts the limit is 3 months.

What employers must do

There is no fixed list of steps. What is reasonable depends on your size, sector, resources, the work your employees do, who they deal with and how often, and whether harassment has happened before. Larger or more complex organisations will usually need to do more.

Risk assessment

Do not assume harassment will not happen. Assess the risks across your organisation, covering:

• Customer and client interactions, including meeting clients or service users alone
• Contractor and supplier relationships
• Visitor access to your premises
• Lone working situations
• Late-night or alcohol-related environments
• Power imbalances between workers
• Work-related social events, and travel including overnight stays
• Online harassment, including messaging and video calls

Some people are at higher risk, for example younger workers, apprentices and interns. Review the assessment regularly and after any incident.

Policies and procedures

• Have a harassment policy, or cover harassment in your bullying or equality policy, and consult employees or their representatives on it
• Explain what harassment is, with examples, and state that it will not be tolerated and may lead to dismissal
• Cover harassment by third parties: how staff report it and what action you will take against the harasser
• Include the support available to affected employees and how you will treat any resulting time off
• Bring your social media and other policies into line, so online harassment is covered too

Training

• Tell everyone at induction that harassment is not acceptable
• Train all staff to recognise harassment and how to report it, including why 'banter' is no excuse
• Train managers to assess and manage harassment risks and to respond to reports
• Train someone to advise people thinking about making a complaint
• Train senior leaders on prevention and on encouraging people to report
• Train customer-facing staff on handling difficult customers, and consider bystander intervention training
• Review training regularly and keep a record of who attended and when

Visible deterrence

• Display notices that harassment of staff will not be tolerated
• Include anti-harassment statements on websites and in customer communications
• Consider body cameras or CCTV in high-risk areas

Reporting and response

• Give staff more than one way to report, including to someone other than their manager, and consider an anonymous route
• Encourage reports of situations where someone felt at risk, even if nothing happened
• Give lone staff a way to get help quickly, such as a panic alarm
• Make clear that no one will be disadvantaged for reporting in good faith
• Handle complaints through a full and fair procedure in line with the Acas Code of Practice on disciplinary and grievance procedures, and never ignore or cover one up
• Support the affected employee straight away and follow up afterwards
• Have the power to remove or ban harassers, and a contractual right to act when a contractor's staff harass yours
• Record each complaint and your response, and watch the records for patterns

A disclosure that sexual harassment has occurred, is occurring or is likely to occur has been capable of being a protected whistleblowing disclosure since 6 April 2026. You must not use a confidentiality agreement to stop someone making one.

The 'all reasonable steps' defence

Employers can defend third-party harassment claims by showing they took 'all reasonable steps' to prevent harassment. This is a higher standard than 'reasonable steps'.

To rely on this defence, you should be able to evidence:

• Comprehensive harassment policy covering third parties
• Regular training for all staff
• Risk assessment of third-party harassment
• Visible deterrence measures
• Effective reporting mechanisms
• Prompt action when harassment is reported
• Regular review and improvement of measures

Common mistakes

• Relying on a policy alone, without risk assessment, training and review
• Training once and never refreshing it
• Telling staff to put up with customers' behaviour
• Assuming a small business has nothing to do. The steps may be simpler, but the duty is the same
• Training only the team where an incident happened, rather than tackling culture across the organisation

Sector-specific guidance

Retail

• Display notices at tills and customer service points
• Train staff on de-escalation techniques
• Ensure managers are available to support staff
• Consider panic buttons or security presence

Hospitality

• Clear policies on refusing service to harassers
• Staff training on handling intoxicated customers
• Safe procedures for lone closing staff
• CCTV in public areas

Healthcare

• Signage about acceptable patient/visitor behaviour
• Lone worker procedures
• Incident reporting systems
• Support for staff experiencing harassment

Compliance checklist

1. A harassment risk assessment, including third-party risks, written up and reviewed regularly
2. A harassment policy covering third parties, shared with all staff
3. Training for all staff at induction, and further training for managers and senior leaders
4. Signage and customer communications saying harassment of staff will not be tolerated
5. More than one reporting route, reviewed regularly
6. A complaints procedure in line with the Acas Code
7. Records of risk assessments, training, complaints and the action taken
8. A senior person responsible for checking the measures work