Sexual harassment law in Great Britain is in a period of transition. The Worker Protection Act 2023 introduced a new proactive duty on employers from October 2024. The Employment Rights Act 2025 has now built on that framework, with different provisions coming into force in phases during 2026 and 2027.
This means employers are operating in a moving legal environment. The current law already requires employers to take reasonable steps to prevent sexual harassment. From 1 October 2026, that standard rises to all reasonable steps. At the same time, employers will face expanded liability for harassment by third parties, including clients, customers, service users, suppliers and members of the public.
This quick transition in sexual harassment regulation in just the last few years can leave many employers wondering what to do. The most important shift is in mindset: think of sexual harassment as requiring a more active, risk-based and evidence-led approach.
For what the ‘all reasonable steps’ standard means in practice, join our webinar on Wednesday, 8 July at midday UK time.
How has sexual harassment law evolved?
Sexual harassment law in Great Britain has developed over several decades. The main thrust of that change has been from reacting to individual incidents towards requiring employers to prevent harassment before it happens.
The Sex Discrimination Act 1975 was the starting point for modern sex discrimination protection in employment. It prohibited discrimination on grounds of sex and marital status, and sexual harassment claims were historically brought through the framework of sex discrimination. The law did not originally contain the more developed statutory language we now use for harassment, but it laid the foundations for workplace equality protection.
The Protection from Harassment Act 1997 then created a broader civil and criminal framework for harassment. It was not specifically a workplace sexual harassment statute, and it is separate from the equality law framework. However, it remained relevant where behaviour caused alarm or distress and may amount to a course of conduct, including stalking or serious harassment that is not necessarily linked to a protected characteristic under the Equality Act.
A major shift came in the 2000s, when express harassment protections were developed in sex discrimination law. The Employment Equality (Sex Discrimination) Regulations 2005 introduced more explicit harassment language into the sex discrimination regime, reflecting European equality law developments. This helped move sexual harassment away from being treated only as a form of less favourable treatment and towards being recognised as a distinct legal wrong.
The Equality Act 2010 consolidated much of Great Britain’s discrimination law into one statute. It remains the central piece of legislation for sexual harassment at work. It defines sexual harassment, prohibits harassment in employment, makes employers liable for harassment by their employees in the course of employment, and provides the “all reasonable steps” defence to vicarious liability.
The Equality Act also originally contained provisions on third-party harassment. Those provisions were removed in 2013 by the Enterprise and Regulatory Reform Act. For more than a decade after that repeal, there was no general standalone Equality Act claim for third-party harassment in Great Britain in the way that had previously existed.
The Worker Protection Act 2023 marked another significant step. From 26 October 2024, it inserted a new preventative duty into the Equality Act requiring employers to take reasonable steps to prevent sexual harassment of employees. This was important because it created a proactive duty where none had before existed. Employers could no longer treat sexual harassment prevention only as a defence to be raised after a tribunal claim. They had to take preventive action before an incident occurred.
The Employment Rights Act 2025 now strengthens that framework. It raises the preventative duty from reasonable steps to all reasonable steps, introduces explicit liability for third-party harassment, adds sexual harassment to the whistleblowing framework, and creates powers for regulations to specify what reasonable steps may involve. By 2027, all of these provisions will be in force. The timeline between implementation is months, not years. Therefore employers should consider the Employment Rights Act in totality when assessing and developing their compliance response.
What is the law on sexual harassment today?
The legal framework in Great Britain now involves several connected statutes. We will take the Employment Rights Act 2025 in totality.
Equality Act 2010
The Equality Act 2010 is still the core statute. It defines sexual harassment as unwanted conduct of a sexual nature that has the purpose or effect of violating a person’s dignity, or creating an intimidating, hostile, degrading, humiliating or offensive environment.
The Equality Act also prohibits harassment related to protected characteristics, including sex, sexual orientation, gender reassignment, race, disability, religion or belief and age. Sexual harassment is distinct because it does not have to be related to the person’s own protected characteristic. The issue is whether the conduct was unwanted, sexual in nature, and had the prohibited purpose or effect.
Employers can be vicariously liable (legally responsible for acts of another person) for harassment carried out by their employees in the course of employment. This liability can arise even if senior management did not know about the conduct or approve it. The employer’s defence is to show that it took all reasonable steps to prevent the employee from doing the discriminatory or harassing act.
Worker Protection Act 2023
The Worker Protection Act amended the Equality Act by creating the new preventative duty. Since 26 October 2024, employers in Great Britain have had a positive obligation to take reasonable steps to prevent sexual harassment.
This duty is proactive. It is not enough to wait for a complaint and then respond. Employers are expected to assess the risk of sexual harassment, take reasonable steps to reduce that risk, and keep those steps under review.
The duty can be enforced by the Equality and Human Rights Commission. In tribunal proceedings, if an employee succeeds in a sexual harassment claim and the employer has also breached the preventative duty, compensation can be uplifted by up to 25%.
Employment Rights Act 2025
The Employment Rights Act 2025 is now law. However, like many major employment statutes, it is being implemented in phases.
From 6 April 2026, sexual harassment became an express qualifying disclosure for whistleblowing purposes. That means a worker who discloses that sexual harassment has occurred, is occurring, or is likely to occur may receive whistleblowing protection if the legal tests are met. For employers, this means harassment complaints may also create whistleblowing risk, particularly where the complainant fears senior involvement, cover-up, victimisation or institutional failure.
From 1 October 2026, two major harassment changes take effect. First, the duty to prevent sexual harassment will rise from reasonable steps to all reasonable steps. Second, employers will face explicit liability for third-party harassment where a third party harasses an employee in the course of employment and the employer failed to take all reasonable steps to prevent it.
This third-party harassment provision is not limited to sexual harassment. It applies to unlawful harassment more broadly. That makes it highly relevant for employers whose staff interact with clients, customers, service users, patients, suppliers, contractors, guests, event attendees or members of the public.
The Employment Rights Act also contains powers for regulations to specify steps that may count as reasonable. These may include carrying out assessments, publishing plans or policies, reporting arrangements and complaint-handling steps. Further rules on confidentiality clauses and harassment or discrimination disclosures are also expected as part of the phased implementation. But this does not change the underlying law which is now on the statute books.
EHRC and Acas guidance
The Equality and Human Rights Commission’s technical guidance remains central for employers in Great Britain. It explains the legal framework under the Equality Act and the preventative duty. The EHRC has said it is updating its guidance to reflect the April and October 2026 changes. This may take some time to publish, but it does not affect the operation of the law. Employers must comply with their legal obligations with or without updated EHRC guidance.
Acas guidance also makes clear that employers should assess risks, consider what steps could reduce those risks, decide which steps are reasonable, and then take those steps. It also gives practical examples such as training, policies, reporting routes, anonymous surveys, manager responsibilities, standards for social events, and action to address risks from third parties.
Is the Worker Protection Act obsolete?
The Worker Protection Act is not obsolete in a technical sense. It amended the Equality Act and created the current preventative duty. That duty is already in force and remains the legal basis for today’s obligation to take reasonable steps to prevent sexual harassment.
However, the Worker Protection Act has been superseded in practice by the Employment Rights Act. The reason is simple: the Employment Rights Act takes the same framework and raises the standard which has essentially raised the compliance benchmark.
The Worker Protection Act introduced the concept of a proactive preventative duty. The Employment Rights Act strengthens it. From 1 October 2026, employers will not only need to show that they took reasonable steps. They will need to show that they took all reasonable steps. In essence this means reflecting on the list of steps that were reasonable for you to take as an employer, and then implementing all of those, not just some. If steps were identified but not implemented, that needs a strong explanation of why it was not reasonable to do so. That’s the kind of evidence a tribunal or regulator will look at.
Under a reasonable steps standard, an employer may be able to argue that it took some reasonable preventive measures. Under an all reasonable steps standard, the question becomes more exacting. Were there further steps the employer could reasonably have been expected to take? If so, why were they not taken?
The Worker Protection Act also left third-party harassment largely unresolved. The original proposals included stronger third-party provisions, but these were removed during the legislative process. The Employment Rights Act brings that issue back into the framework and does so in a broader way.
So the Worker Protection Act should be understood as the bridge between the old reactive model and the new proactive model. It is still part of the legal architecture, but the compliance conversation has moved on. Employers preparing for October 2026 should be working towards the Employment Rights Act standard, not treating the Worker Protection Act as the final destination.
What about Northern Ireland?
Northern Ireland has a different equality and employment law framework. The Equality Act 2010 does not generally apply in Northern Ireland, and the Worker Protection Act does not extend there. The Employment Rights Act 2025 provisions also only apply to Great Britain, meaning England, Wales and Scotland, not Northern Ireland.
In Northern Ireland, workplace sexual harassment is principally addressed through the Sex Discrimination (Northern Ireland) Order 1976, as amended. That regime prohibits sexual harassment and sex-related harassment in employment. Employers can be liable for harassment in the workplace, and Northern Ireland also retains a form of third-party harassment protection that differs from the position in Great Britain.
One important difference is that Northern Ireland has not followed the same Worker Protection Act and Employment Rights Act pathway. In Northern Ireland, there is no equivalent GB-style preventative duty moving from reasonable steps to all reasonable steps in October 2026. There is also no automatic read-across from the GB Employment Rights Act changes into Northern Ireland.
For employers operating across the UK, this creates a practical challenge. A single UK-wide policy may be desirable for consistency, but the legal basis is not identical. GB employers need to prepare for the October 2026 Employment Rights Act changes. Northern Ireland employers should continue to comply with the Northern Ireland framework and monitor whether local reforms follow.
In practice, many of the same preventive measures will still be sensible in Northern Ireland: clear policies, training, reporting channels, manager guidance, risk assessment, action on complaints, and protection against victimisation. The legal route is different, but the compliance objective is broadly aligned.
What do employers in Great Britain have to do now?
Employers in Great Britain should not wait until October 2026 to act. The Employment Rights Act is already law, and the current Worker Protection Act duty is already in force. The safest approach is to prepare now for the higher “all reasonable steps” standard.
The central question is whether the employer can show a reasoned, documented and risk-based approach to preventing sexual harassment. A tribunal or regulator will not only ask whether a policy existed or whether training was delivered. They will want to see whether the employer understood its own risk profile, selected appropriate controls, communicated them, trained people properly, responded to concerns, reviewed incidents and improved the system where needed.
The starting point should be a sexual harassment risk assessment. This should identify where sexual harassment could occur, who may be exposed, what situations increase the risk, and what controls are already in place. It should consider different work environments, including offices, hybrid work, remote work, work-related social events, business travel, customer-facing roles, lone working, night work, senior-junior dynamics and third-party contact.
Employers should then review their policies. A standalone sexual harassment policy is advisable. It should define sexual harassment, explain reporting routes, address online and out-of-hours conduct where connected to work, cover third-party harassment, explain confidentiality limits, and make clear that victimisation or retaliation will not be tolerated.
Training also needs to be reviewed. Generic annual training may not be enough for every organisation. Employees need to understand what sexual harassment is, how to report it, and what to do if they witness it. Managers need more specific training on receiving disclosures, escalating concerns, preserving evidence, avoiding victimisation, and supporting fair investigations. Higher-risk teams may need scenario-based training linked to their actual working environment.
Reporting routes should be clear, trusted and accessible. Staff should not be forced to report only to a line manager, especially where the line manager may be involved or too close to the issue. Employers should consider alternative routes such as HR, senior leaders, union representatives, anonymous reporting tools or external reporting channels.
Whistleblowing procedures should also be updated. Since 6 April 2026, disclosures about sexual harassment can fall within the whistleblowing framework. Policies should make clear that sexual harassment concerns may be raised as protected disclosures, and managers should understand that poor handling of a disclosure can create overlapping harassment, victimisation and whistleblowing risk.
Third-party harassment should be treated as a foreseeable risk where employees deal with people outside the organisation. Depending on the business, reasonable controls might include customer or client notices, contract clauses, supplier codes of conduct, visitor rules, escalation scripts, lone-working procedures, alarms, security arrangements, buddy systems, public-facing signage, and clear authority for managers to warn, remove or ban third parties where appropriate.
Finally, employers need an evidence trail. Training records matter, but they are only one part of the picture. Employers should retain risk assessments, action plans, policy updates, communications, training records, manager guidance, reporting data, investigation records, staff surveys, third-party controls, review notes and board or senior leadership oversight.
Employer checklist
- Conduct or update a sexual harassment risk assessment.
- Identify high-risk roles, locations, events, work patterns and third-party interactions.
- Review and update your sexual harassment policy.
- Make sure the policy covers third-party harassment, online conduct, social events and business travel.
- Update whistleblowing policies to include sexual harassment disclosures.
- Train all staff on sexual harassment, reporting and bystander responsibilities.
- Train managers separately on disclosures, escalation, confidentiality and investigations.
- Check that reporting routes are clear, trusted and accessible.
- Consider anonymous or alternative reporting channels.
- Review how complaints are investigated and documented.
- Put controls in place for clients, customers, suppliers, contractors and other third parties.
- Review relevant contracts, visitor rules, supplier codes and public-facing communications.
- Keep records of decisions, actions, communications and reviews.
- Review the programme after incidents, organisational change or at least annually.
- Make sexual harassment prevention a senior leadership and governance issue, not just an HR policy update.
