Anti-Sexual Harassment Policy: A Practical Guide for UK Employers
For most UK employers, the question is no longer whether there's a policy somewhere in the employee handbook. It's whether the business can show it took real steps to prevent harassment from happening, and whether it has the evidence to prove it.
Since October 2024, employers have had a clear legal duty to take steps to prevent sexual harassment at work. From October 2026, that duty becomes more demanding. The expectation moves from taking reasonable steps to taking all reasonable steps, and employers will also face direct liability where employees are harassed by third parties, such as clients, customers or contractors.
This guide breaks down what the law means now, what is changing in October 2026, and what employers can do in practical terms to build a safer, more respectful workplace.
What the law now requires: sexual harassment and UK employers
The centrepiece of the current framework is the Worker Protection (Amendment of Equality Act 2010) Act 2023, which came into force on 26 October 2024. It introduced a new, proactive duty on every employer, regardless of size or sector, to take reasonable steps to prevent the sexual harassment of employees in the course of their work.
Before October 2024, the law was more focused on what happened after an incident had taken place. Employers could still be held responsible where someone at work had harassed a colleague, but the emphasis was usually on dealing with the issue once a complaint had been made. The new duty changes that. Employers are now expected to look ahead, understand where harassment could happen, and take sensible steps to reduce that risk before it becomes a problem.
Under the Equality Act 2010, sexual harassment is unwanted conduct of a sexual nature that has the purpose or effect of violating a person's dignity, or of creating an intimidating, hostile, degrading, humiliating or offensive environment for them. It isn't confined to the office. It extends to conference rooms, client meetings, work events, office social gatherings and everywhere else work takes people.
How the duty is enforced
Two enforcement routes carry the most practical risk for employers.
Employment tribunals
An employee cannot usually bring a claim just because an employer has fallen short of the new preventative duty. They would first need to bring and win a sexual harassment claim. If that happens, the tribunal can increase the compensation by up to 25% if it decides the employer had not taken reasonable steps to prevent harassment. Compensation for discriminatory harassment is also uncapped, so the financial risk can be significant.
For injury to feelings, tribunals use the Vento bands. For claims presented on or after 6 April 2026, the lower band runs from £1,300 to £12,600, the middle band from £12,600 to £37,700, and the upper band from £37,700 to £62,900, with the most exceptional cases capable of exceeding that. On top of that, a 25% uplift on a mid-range award adds a significant further sum. Factor in legal costs, management time and the reputational impact, and the true cost of getting this wrong is considerably higher than the headline tribunal figure.
The Equality and Human Rights Commission
The EHRC has the power to investigate suspected breaches, issue unlawful act notices requiring an employer to put an action plan in place, and enter into legally binding Section 23 agreements. The case studies below show how actively it has used those powers in recent years.
Calls to Acas about workplace harassment rose by around 39% in the first half of 2025. People are more aware of their rights and more willing to act on them. The enforcement environment is already shifting before the October 2026 changes even arrive.
The risk assessment: the foundation of compliance
One thing runs through the heart of compliance with the Worker Protection Act 2023: the risk assessment. The EHRC's technical guidance makes clear that an employer will struggle to demonstrate it met the preventative duty if it never carried one out.
A meaningful risk assessment is not a tick-box exercise. It is an honest look at where the business is genuinely vulnerable. The EHRC's guidance points to:
Imbalances of power and working relationships, including gendered power dynamics, lone working, and situations where a junior colleague's progression depends heavily on one individual.
Working patterns and environments that may increase risk, such as late-night working, travel, remote or isolated work, or settings where alcohol is involved.
Roles where employees spend time with customers, clients or other third parties, particularly in hospitality, events, travel or entertaining situations.
Anything that may make it harder for someone to speak up, including being younger, newer to the workplace, on an insecure contract, or simply unsure whether they will be listened to.
Once the risks are clear, the next step is to agree what needs to happen and make sure those actions are followed through. The law does not expect every step to prevent every possible incident. What matters is that the business has a thoughtful, practical prevention plan and can show it is taking the issue seriously.
When employers get it wrong: two documented case studies
The following two cases show what enforcement looks like in practice, examined at length by the EHRC, in Parliament and in the press.
McDonald's and the EHRC, 2023 to 2025
After the Bakers, Food and Allied Workers Union reported that more than 1,000 cases of sexual harassment had been raised across UK restaurants, the EHRC stepped in. In February 2023, McDonald's signed a legally binding Section 23 agreement with the regulator, committing to communicate a zero-tolerance approach, run anonymous worker safety surveys, strengthen its policies and complaints handling, and deliver anti-harassment training to all staff with specialist training for managers.
But that was not where things ended. After the BBC’s investigation in July 2023, more than 160 workers contacted the BBC with further accounts. BBC reporting also said around 300 incidents were reported to the EHRC, and law firm Leigh Day later announced that more than 700 current and former crew members had joined legal action.
In November 2025, the EHRC extended and strengthened its agreement with McDonald’s. The updated plan included a new safeguarding policy, support from external safeguarding specialists, an independent auditor to review how complaints were handled, and a requirement for complaints about managers to be investigated by someone outside the restaurant involved.
The key point is simple: signing an agreement with a regulator is not the end of the work. If the culture has not genuinely changed, regulators can and will come back. This is not just a lesson for large businesses or high-profile sectors. It is a reminder that what matters most is whether the policy is actually understood and lived in practice.
Lidl GB and the EHRC, August 2025
Lidl GB concluded a deal with the EHRC in August 2025, after an employment tribunal ruled that the company had failed to take reasonable steps to prevent a young staff member from being harassed. The findings were specific: managers were not familiar with the company's own anti-harassment policy, no risk assessments had been conducted, and action was only taken once a complaint had been made.
This is exactly the kind of gap the Worker Protection Act 2023 is designed to address: a policy that exists, but is not properly understood by the managers who need to use it, and no risk assessment sitting behind it. From October 2026, waiting until someone complains before taking action will not be enough.
The lesson from both cases is the same. A policy on its own is not enough. Employers need to show that people know what it says, managers are supported to act on it, and risks have been thought about before something goes wrong.
Building a policy that actually works
A policy only works if people understand it, trust it and know what to do with it. The points below are the things that make the difference between a document that sits in a handbook and an approach that genuinely helps prevent harm.
Make the policy specific. Your dignity at work, anti-harassment and grievance policies should talk clearly about sexual harassment, including online behaviour, social media, and risks involving clients, customers or other third parties. Generic wording is unlikely to be enough.
Train people in a way that feels real. Everyone should understand what sexual harassment can look like, how to raise a concern, and what support is available. Managers need extra guidance so they can spot risks early, respond well if someone speaks up, and handle sensitive conversations with care. Practical, scenario-based training is usually much more effective than a generic online module.
Make it safe and easy to speak up. People are more likely to raise concerns if they know where to go, what will happen next, and that they will be treated with care. Reporting routes should be confidential, easy to find and, where possible, include an anonymous option.
Respond quickly and support people properly. Concerns should be looked into promptly, fairly and confidentially. It should also be clear that anyone who raises a concern, or supports someone else to do so, will be protected from victimisation. How a concern is handled matters just as much as what the policy says.
Keep an eye on patterns. Record concerns, themes and repeat issues so the business can spot where the risks are. Those insights should feed back into the risk assessment, training and manager support. Good records also help show the steps the business has taken if questions are asked later.
Keep leaders close to it. This needs visible support from senior leaders. When leaders understand the risks, ask the right questions and stay involved, it sends a clear message that this is part of how the business looks after its people.
The standard is about to rise: what changes in October 2026
If you put measures in place in 2024, that was a good start, but it will not be enough to assume the work is finished. The Employment Rights Act 2025 raises the standard again, with further changes coming during 2026.
April 2026, already in force: Sexual harassment now falls within whistleblowing protection. This means a worker who raises a concern about harassment, whether it has happened, is happening, or could happen, is protected from being treated badly because they spoke up.
October 2026: The duty becomes stronger. Employers will need to show they have taken all reasonable steps to prevent sexual harassment, not just some reasonable steps. Tribunals will look at what the employer had in place from that higher standard.
October 2026, third-party harassment: Employers will also be responsible if an employee is harassed by someone outside the business, such as a client, customer, contractor or member of the public, unless they can show they took all reasonable steps to prevent it. This applies to harassment generally, not only sexual harassment.
The sensible approach is to start working towards the higher standard now. A proper risk assessment, clear reporting routes, manager training and practical third-party safeguards all take time to build well.
How JourneyHR can help
The McDonald’s and Lidl cases are a useful reminder that this is not just about having the right words in a policy. Employers need to be able to show that people understand the expectations, managers know how to respond, and the business has properly thought about where the risks sit.
At JourneyHR, we help businesses get ahead of this in a practical, manageable way. We can review your policies, sense-check where you are against the current and incoming duties, design training that feels relevant to your workplace, and help build a risk assessment and third-party approach that actually fits how your business works.
We can work with you at whatever stage you are at, from a focused policy review through to a fuller risk assessment, training programme and implementation plan. If you are not sure whether your business is where it needs to be, a conversation is a good place to start.
Get in touch: enquiries@journeyhr.com or journeyhr.com
FAQs
Does my business really need an anti-sexual harassment policy, or is this only for large employers?
The duty to take reasonable steps applies to all employers, regardless of size or sector. What counts as reasonable is scaled to the resources and context of the business. A small employer found to have allowed sexual harassment will not escape liability because of its headcount. Having no policy and no risk assessment is a clear gap whatever the size of the organisation.
What exactly counts as a reasonable step to prevent sexual harassment?
There is no fixed checklist, and that is deliberate. The EHRC guidance points to measures including a tailored risk assessment, updated policies, regular training, confidential reporting channels and periodic review. The steps should be proportionate to the business's size, sector, working environment and identified risks. A step can still count as reasonable even if it did not prevent a specific incident; the duty is about the overall prevention system.
How much could a sexual harassment claim actually cost the business?
Compensation for sexual harassment is uncapped, and injury to feelings is assessed using the Vento bands. For claims from 6 April 2026, these run from £1,300 at the lower end to £62,900 at the upper end, with exceptional cases capable of exceeding that. If the tribunal finds the employer breached the preventative duty, it can add an uplift of up to 25%. Add legal costs, management time and reputational impact, and the true cost is considerably higher than the headline award.
We trained our team in 2024. Is that enough?
Not on its own. The preventative duty is ongoing, and the standard rises to all reasonable steps from October 2026 alongside renewed liability for third-party harassment. Training delivered once, or a policy that managers cannot recall, is exactly the weakness regulators have penalised in the cases above. Treat training as an annual cycle, keep records of who attended and when, and update materials to reflect the October 2026 changes.
Can the business be held liable if a client or customer harasses a member of the team?
From October 2026, yes. The Employment Rights Act 2025 reinstates direct employer liability for harassment of employees by third parties, including clients, customers, contractors and members of the public, where the employer has not taken all reasonable steps to prevent it. Even under the current rules, the EHRC's guidance already expects employers to assess and manage third-party risk. If employees interact with the public or with clients, this should be a specific, documented part of the risk assessment now.
