The Worker Protection Act requires employers to prevent sexual harassment, but the Employment Rights Bill will go further

The Worker Protection Act 2023, requiring all UK organisations to take a proactive approach and implement reasonable steps to prevent sexual harassment is in force from 26 October 2024. Although the new law requires employers to assess the risk of sexual harassment, the legislation was weakened throughout its passage in Parliament. However the forthcoming Employment Rights Bill will see many of these omissions reintroduced, and more steps placed on employers to prevent sexual harassment.

 

The duty to protect employees from sexual harassment by third parties like clients or suppliers was removed from the Worker Protection Act. Gone too were harassment protections related to other protected characteristics. Harassment related to sex (like sexism or misogyny) is not included in the new law, only harassment that is specifically of a sexual nature. 

The House of Lords also removed the requirement on organisations to take “all reasonable steps” to prevent harassment. Only “reasonable steps” are mandated by the new legislation.

 

Despite the watering down of the Worker Protection Act from its original intent, the Labour government have committed to reintroducing much of what was taken out. In the draft Employment Rights Bill published on 10 October 2024, the government set out critical new steps to prevent sexual harassment which 

 

What will the Employment Rights Act do to prevent sexual harassment?

The Employment Rights Act will add back in the requirement on employers to take all reasonable steps to prevent sexual harassment. The current draft of the Bill also requires the government to set out what steps will be considered reasonable within regulation. This will put reasonable steps such as risk assessments, policies and training on a statutory footing.

 

Third party harassment – another withdrawal from the Worker Protection Act – is included in the Employment Rights Bill. Employers will have a duty to prevent harassment of their employees from third parties such as clients, contractors, and members of the public. Similar to ‘failure to prevent’ legislation around bribery and fraud, an employer will be liable for third party harassment if they have failed to take all reasonable steps to prevent the harassment from happening.

 

A new clause in the Bill will void any non-disclosure agreements which have in the past prevented people from discussing the harassment they received at work. Sexual harassment–related disclosures will constitute “protected disclosures” in the forthcoming Employment Rights Act. This means sexual harassment disclosures cannot be covered by a nondisclosure agreement. A dismissal for making a “protected disclosure” is also treated as automatically unfair in an employment tribunal. 

 

Other provisions of the Employment Rights Bill mean that the distinction between ordinary and automatic unfair dismissal will be less significant, given the removal of the unfair dismissal qualifying period which becomes a day one right. 

 

A new Fair Work Agency will also be established by the Bill, which will amalgamate existing employment regulators and provide new powers to investigate and fine employers who do not comply. 

 

When will the Employment Rights Act come into force?

The Employment Rights Act was one of the new Labour governments key pledges for their first hundred days in office. Running to over 150 pages and containing 28 individual reforms, this legislation contains a number of significant changes to employment law including reform of zero hours contracts, fire and rehire amendments, new trade union rights, and statutory support for menopause leave.

 

The second reading of the Bill took place on 21 October 2024, however given the scale and scope of changes, it is anticipated there will be a relatively long time to prepare. Various consultations will take place throughout 2025, and most of the provisions around sexual harassment will likely not come into force until 2026 at the earliest.

 

How should organisations prepare to prevent sexual harassment?

 

To comply with the provisions of the Worker Protection Act 2023 and prepare for the forthcoming Employment Rights Act, organisations should take the following steps:

 

Conduct risk assessments

  • Proactively assess the risk of sexual harassment in the workplace, identifying areas of concern and high-risk environments.
  • Focus on identifying situations that might expose employees to harassment from both internal and external sources, such as clients or third parties.

 

Implement anti-harassment policies

  • Develop or update policies to clearly define what constitutes sexual harassment and provide a process for employees to report it.
  • Ensure that these policies include protections from third-party harassment, as this will be a legal requirement under the forthcoming Employment Rights Act.

 

Mandated training

  • Provide regular and comprehensive training for employees and management on sexual harassment, focusing on prevention, reporting mechanisms, and proper responses.
  • Incorporate training that addresses harassment from third parties, aligning with the forthcoming Employment Rights Act’s requirements.

 

Establish clear reporting mechanisms

  • Ensure that employees know how to report harassment confidentially, and create clear channels for complaints, including options for anonymous reporting.
  • Prepare for new rules around protected disclosures by allowing open discussion of harassment cases without fear of retaliation or enforcement of non-disclosure agreements.

 

Start thinking about “all reasonable steps”

  • Under the upcoming Employment Rights Act, the standard will shift to “all reasonable steps” to prevent sexual harassment. Organisations should:
    • Regularly review their procedures and adapt them to new regulations.
    • Take action whenever harassment is reported, demonstrating an active effort to address issues.

 

Revise non-disclosure agreements

  • Review and revise any existing non-disclosure agreements to ensure they do not prevent employees from discussing sexual harassment claims.
  • Prepare for the future voiding of non-disclosure agreements related to harassment disclosures, which will be introduced by the Employment Rights Act.

 

Monitor third-party interactions

  • Begin taking proactive steps to prevent harassment by third parties, such as clients, contractors, or the public. Implement protocols that minimise risk in these interactions, which will become a legal duty under the Employment Rights Act.

 

Prepare for tribunal changes

  • Understand that sexual harassment disclosures will be treated as “protected disclosures,” and prepare for changes in employment tribunal rights, including protections against dismissal for reporting harassment.

 

Engage with consultations

  • Stay informed of government consultations in 2025 on how to meet the statutory requirements, including specific guidance on what constitutes “all reasonable steps.”

 

Anticipate more regulatory oversight

  • Prepare for the establishment of the Fair Work Agency, which will have powers to investigate and fine employers who fail to comply with the law. Regular audits and compliance checks can mitigate the risk of fines or investigations.

 

Join our free, 1-hour webinar on the Worker Protection Act and sexual harassment regulation

In this webinar, VinciWorks compliance experts will guide you through the process of complying with the Worker Protection Act and future regulations on sexual harassment. From assessing the risk of sexual harassment in the workplace to tracking incidents and customising training, this free, 1-hour webinar will make sure your office is ready to fight back against sexual harassment.

 

Register for the webinar here and sign up to receive a recording.

 

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.