A sexual harassment policy is a written statement of what sexual harassment is, that you won’t tolerate it, and how people can report it. From 30 October 2026, employers must take 'all reasonable steps' to prevent sexual harassment. Your policy is likely to be the first thing the Equality and Human Rights Commission (EHRC) or a tribunal asks to see. At the time of publication, there has been no official guidance about what constitutes ‘all reasonable steps’, so this information is based on advice available from the EHRC and Acas, among others.
This guide covers what to include, section by section, then how to roll out your policy and keep it current. For the wider picture of the legal duty, read our guide to sexual harassment at work.
In this article
- Why does your sexual harassment policy matter more from 30 October 2026?
- What should a sexual harassment policy include?
- How should you roll out and communicate your policy?
- How often should you review your sexual harassment policy?
- What gaps leave employers exposed to risk?
- How Ciphr can help you put your policy into practice
- FAQs: sexual harassment policy
Why does your sexual harassment policy matter more after 30 October 2026?
As of 30 October 2026, employers must take all reasonable steps to prevent sexual harassment of their employees, not just reasonable steps. That means being able to show there was nothing further you could reasonably have done.
The Worker Protection (Amendment of Equality Act 2010) Act 2023 introduced the original duty on 26 October 2024. That duty required “reasonable steps”. The Employment Rights Act 2025 added the word “all” from 30 October 2026, and extends protection to harassment by third parties.
Official guidance about what constitutes ‘all reasonable steps’ is not available at the time of writing this guide. The law does not explicitly state that every employer must have a written sexual harassment policy. But, in practice, it’s very hard to show you took all reasonable steps without one. After all, the Equality and Human Rights Commission’s (EHRC) eight-step guide lists developing an effective anti-harassment policy as step one.
|
Date |
What changed |
What it means for your policy |
|
26 October 2024 |
Duty to take reasonable steps to prevent sexual harassment (Equality Act 2010 s.40A). Tribunals can uplift compensation by up to 25% (s.124A). The EHRC can enforce the duty. |
You should already have a policy in place and in use. |
|
6 April 2026 |
Disclosing sexual harassment can be a protected whistleblowing disclosure (s.23). |
Cross-reference your whistleblowing policy. |
|
1 October 2026 |
Tribunal time limit for most claims extended from three months to six months (SI 2026/954). |
Keep clear records of how you handled every complaint. HR software with in-built case management functionality – like Ciphr’s – can help you maintain such records. |
|
30 October 2026 |
Duty becomes “all reasonable steps” (s.20). Employers must not permit third parties to harass employees (s.21). |
Update your wording and add a third-party harassment section. Reissue your policy and record employee acceptance; HR software (like Ciphr’s) with in-built policy acceptance functionality can help you evidence that employees have read your updated policy. |
|
2027 onwards (expected) |
Regulations may specify steps that count as reasonable, including publishing policies (s.22). Rules on confidentiality clauses (NDAs) are expected in 2027. |
Review your policy again when the regulations are published. |
What should a sexual harassment policy include?
A sexual harassment policy should set out what you expect, who it covers, how to report incidents and what happens after an incident is reported. Use this table as a checklist template for each section.
|
Policy section |
What to include |
Why it matters |
|
Statement of commitment |
Zero tolerance of sexual harassment, a commitment to take all reasonable steps to prevent it, and sign-off by a senior leader. |
Shows prevention is owned at the top, not only by HR. |
|
Scope: who |
Employees, workers, contractors, agency staff and volunteers. |
People who aren’t employees can still harass, or be harassed by, your staff. |
|
Scope: where |
Work events, work travel, client sites, online and remote working, messaging apps and work-related social media. |
The duty covers harassment in the course of employment, which reaches beyond the office. |
|
Definitions and examples |
The Equality Act 2010 s.26 definition in plain English, with examples (see below). |
People can’t report, or avoid, behaviour they don’t recognise. |
|
Third-party harassment |
Who counts (customers, clients, contractors, patients, service users, the public) and what you’ll do, such as warnings, bans or ending contracts. |
From 30 October 2026, employers can be liable for third-party harassment. |
|
How to report |
Named contacts, several routes including someone outside line management, an anonymous option, and how to raise concerns informally. |
The person harassing may be the line manager. EHRC step four recommends multiple reporting routes. |
|
How complaints are handled |
Timescales, who investigates, confidentiality and its limits, interim measures, updates, outcomes and appeals. |
A clear process shows people that reporting is worthwhile. |
|
Protection from victimisation |
A promise that nobody will be treated badly for reporting an incident, supporting a complaint or giving evidence. |
Victimisation is unlawful, and fear of it stops people speaking up. |
|
Whistleblowing |
Explain that, since 6 April 2026, disclosures about sexual harassment can be protected. Link to your whistleblowing policy. |
Keeps your policies consistent with the law. |
|
Sanctions |
Harassment is a disciplinary matter, up to and including dismissal for gross misconduct. Complaints made in good faith won’t lead to action, even if not upheld. |
Clear consequences deter harassment. Good-faith wording stops the policy deterring people from reporting incidents. |
|
Support |
Employee assistance programme (EAP), counselling, specialist organisations, changes to working arrangements, and support for witnesses. |
Support helps people come forward and recover. |
|
Manager responsibilities |
Model good behaviour, act on what they see without waiting for a complaint, respond to reports and escalate. |
Managers are often the first person told. |
|
Training commitment |
Who gets which training, when, and how often it’s refreshed. Extra training for managers and complaint handlers. |
Training is EHRC step five. A policy alone changes little. |
|
Monitoring and review |
A named owner, how you’ll monitor reports and themes, the next review date and what triggers an earlier review. |
Shows prevention is ongoing, not a one-off. |
Your policy should also reflect the specific risks in your workplace. A sexual harassment risk assessment tells you which roles, locations and situations need extra measures.
What behaviours should your policy name?
Sexual harassment is unwanted conduct of a sexual nature that violates someone’s dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment for them. It’s also harassment to treat someone less favourably because they rejected or submitted to that conduct. Examples to include in your policy:
- Unwelcome comments, messages or emails of a sexual nature, including about someone’s body, appearance or sex life
- Sexual jokes, innuendo or ‘banter'
- Sexual images, graffiti or content, shown or shared in person or online
- Suggestive looks, gestures or facial expressions
- Unwanted touching, or standing uncomfortably close
- Repeated requests for dates or sexual favours
- Pranks or mimicry that target someone’s sex or undermine their dignity
Make three points clear:
- A single incident can be sexual harassment
- People of any gender or sexual orientation can be harassed
- Calling something ‘banter’ doesn’t make it acceptable
How should you roll out and communicate your policy?
Roll out your policy so every person in scope has read it, understands it and knows how to report an incident. A policy sitting unread in a handbook won’t count for much as a reasonable step.
- Get it read and acknowledged. Put it in your employee handbook or the policies section of your HR software. Ask new and existing staff to confirm they’ve read it and monitor compliance. Make sure you get to 100% acceptance
- Build it into induction. New starters should hear about the policy and reporting routes in their first week
- Communicate it regularly. Recap the key points in team meetings and briefings. Informal conversations between managers and teams help people feel able to come forward
- Make reporting routes visible. Put contacts on your intranet, in staff areas and in remote working guidance
- Tell third parties. Use signage, terms of business and contractor inductions to set expectations for customers, clients and visitors
“Policy acceptance is the first step in a connected learning journey,” says Eliseo Pithey-Street, people relations manager at Ciphr. “Here at Ciphr, when a new or updated policy is published in Amplify (our HR system), we track policy acceptance using the built-in reports, and these help us follow up and also check our compliance.
“But acceptance isn't a tick box. It's part of a clear record at each stage: issued acceptance, trained, and applied, all within our Ciphr product suite.”
Training is the best way to make the policy stick. A 2025 study by TUC Cymru found that 36% of workers in Wales had received no training on recognising or reporting sexual harassment.
Make training mandatory for everyone in scope, then follow it with discussion. Invite questions about the policy so people feel confident they know what to do. Give managers and complaint handlers deeper training on responding to reports. Our guide to sexual harassment prevention training explains what good training covers. Where harassment overlaps with wider bullying concerns, pair sexual harassment eLearning with a bullying and harassment course to cover the broader picture.
How often should you review your sexual harassment policy?
Review your sexual harassment policy at least once a year, and sooner when the law, guidance or your risks change. Each review should have a named owner and a recorded date.
Triggers for an earlier review include:
- The 30 October 2026 changes, if your policy still says “reasonable steps” or doesn’t mention third parties
- Updated EHRC technical guidance, which (when this article was published) the government says is coming
- Regulations under s.22 on reasonable steps, and the expected NDA rules, neither due before 2027
- A complaint, investigation or tribunal claim, or themes from staff surveys and exit interviews
- New risks, such as new sites, hybrid working or new customer-facing roles, or when you acquire a new company
What gaps leave employers exposed to risk?
The most common gaps are out-of-date legal wording, missing third-party cover and reporting routes that only run through line managers. Check your policy for these:
- It describes the Worker Protection Act 2023 duty but not the “all reasonable steps” duty from 30 October 2026
- It’s silent on customers, clients and other third parties
- The only way to report is through a line manager
- There are no timescales for handling complaints
- It covers the office but not events, travel, remote working or online behaviour
- Confidentiality wording could be read as stopping people speaking up
- There’s no owner, no review date and no training to back it up
How Ciphr can help you put your policy into practice
A policy only works if people understand it. Ciphr’s sexual harassment eLearning course helps staff recognise sexual harassment, understand the law and know what to do if they experience or witness it.
It takes around 20 minutes, is CPD certified and covers the 30 October 2026 change, including a third-party harassment scenario. It’s available off the shelf or tailored to your own policy and reporting routes.
FAQs: sexual harassment policy
No UK law explicitly requires a written sexual harassment policy. But from 30 October 2026 employers must take all reasonable steps to prevent sexual harassment. At the time of writing, there is no official guidance about what will be considered ‘all reasonable steps’. But the EHRC lists an effective policy as step one. Future regulations under the Employment Rights Act 2025 may also specify publishing policies.
Yes, as long as sexual harassment has its own clearly signposted section. That section needs its own definition, examples, third-party wording and reporting routes, so it shows the specific steps you take.
Review it at least once a year. Review it sooner after a change in the law or EHRC guidance, a complaint or investigation, or a risk assessment that finds new risks.
Usually not. Make sure your policy covers online and remote working, video calls, messaging apps and work-related social media. Check every reporting route works for people who aren’t on site.
Use the section-by-section table in this guide as your template. Then check your draft against the EHRC checklist and action plan for employers.
This article is not legal advice. If you need legal advice, consult a qualified employment law expert.