Worker Protection Act: What Changes on 30 October 2026

At a glance, as at 8 October 2026

Employers must take reasonable steps to prevent sexual harassment of their staff. On 30 October 2026 that becomes “all reasonable steps”, and employers must also take all reasonable steps to stop customers, clients and other third parties harassing their staff.

What	Where things stand
The duty now	Since 26 October 2024, employers must take reasonable steps to prevent sexual harassment of employees in the course of their employment (Equality Act 2010, section 40A).
From 30 October 2026	“All reasonable steps”, and a new duty not to permit third parties to harass staff (Employment Rights Act 2025, sections 20 and 21).
Who it protects	Employees, workers and self-employed people hired to do the work personally.
Who enforces it	The EHRC, which can act before any harassment happens. A tribunal can add up to 25% to compensation in a successful sexual harassment claim.
What’s reasonable	No fixed list. It depends on your size, resources, sector, working environment and contact with the public. The government expects regulations setting out steps in 2027/28.
Where to start	A sexual harassment risk assessment. The EHRC says an employer is unlikely to comply without one. Our free template gives you the structure.

Most harassment never reaches a formal complaint. In the government’s 2020 survey, 29% of people in work had experienced workplace sexual harassment in the previous year, and only 15% of them reported it formally. The duty looks at what you did before anything happened. For why so many people stay quiet, see why people don’t speak up at work, and our guide to psychological safety at work for what helps them speak.

The new law

What changes on 30 October 2026

Three changes in the Employment Rights Act 2025 come into force on 30 October 2026, under commencement regulations made on 1 October.

“All reasonable steps”. Section 20 adds one word to the duty: employers must take all reasonable steps to prevent sexual harassment. Acas describes this as taking all the steps that are reasonable for your organisation, focusing on prevention, across the whole organisation. It expects larger or more complex organisations to need more steps.
Harassment by third parties. Section 21 says an employer must not permit a third party to harass an employee. An employer permits it when the harassment happens in the course of the employee’s work and the employer failed to take all reasonable steps to prevent it. A third party is anyone other than the employer and its employees. The rule covers sexual harassment and harassment related to a protected characteristic such as race, sex or disability, and employees can bring a tribunal claim over it.
Regulations on reasonable steps. Section 22 lets ministers set out steps that count as reasonable, such as assessments, policies, reporting and complaint handling. The government expects to make them in 2027/28, after consultation.

The EHRC says it’s updating its guidance for these changes but hasn’t given a date, so its September 2024 guidance remains the main reference. Some of its paragraphs say an employee can’t bring a claim over third-party harassment on its own. From 30 October, they can.

Run the Free Self-Assessment

Scope

Who the duty protects

Employees and workers.
Self-employed people hired to do the work personally. Whether someone counts is a question of fact in each case.
Agency workers. The EHRC expects the agency and the business using the worker to agree in writing who handles any complaint.
Not volunteers. The work provisions of the Equality Act don’t protect them.

The EHRC is clear that no employer is exempt. What’s reasonable for a ten-person practice differs from what’s reasonable for a national chain, and the duty allows for that.

Employing people in Australia too? Our guide to the Australian positive duty covers what section 47C of the Sex Discrimination Act requires, with its own free self-assessment.

The test

What “all reasonable steps” means

The law doesn’t list the steps an employer must take. It’s an objective test: a tribunal or the EHRC looks at the facts of your situation. The EHRC suggests working through it in four moves:

Consider the risks of sexual harassment in your workplace.
Consider the steps that could reduce them.
Decide which of those steps are reasonable for you.
Put the reasonable steps in place.

What “reasonable” depends on

The EHRC lists factors that may matter: your size and resources, the working environment and sector, the risks present, how often and in what setting staff deal with third parties, whether a step would work or something else would work better, the time, cost and disruption against the benefit, whether concerns have been raised before, regulatory standards that apply to you, such as the FCA’s or the GMC’s, and whether steps you’ve already taken worked.

A step can be reasonable even if it wouldn’t have prevented a particular incident. And a step that would achieve nothing isn’t reasonable, however cheap it is.

Keep it going, and keep a record

The EHRC says this isn’t a one-off exercise. Look again when your workplace, your workforce or your technology changes. Acas advises recording why you decided a step wasn’t reasonable for you, so you can explain the decision later.

The EHRC’s own example shows how size counts. It describes a very small theatre company that was likely compliant without paid training, given its limited resources, because it took other steps: it told freelancers and audiences its standards, put up notices and set a way to handle reports.

In practice

The eight steps the EHRC recommends

From the EHRC’s employer guide and technical guidance, with what to keep on record for each. The EHRC says the list isn’t exhaustive.

Step	What it involves	What to keep on record
1. A clear policy	A policy for sexual harassment, on its own or clearly separated from other harassment, written with your union or worker representatives. It says sexual harassment won’t be tolerated, gives examples that fit your workplace, covers social events and online behaviour, sets out how to complain, and deals with third parties. Our free policy template gives you the structure.	The current version, who agreed it and when you’ll review it.
2. Engage your staff	One-to-ones, surveys and exit interviews. Everyone can read the policy without asking a manager, hears about it at induction, and gets a reminder at least once a year and before higher-risk events.	How and when you shared the policy.
3. Assess and reduce risk	A written risk assessment for sexual harassment: power imbalances, lone and night working, alcohol, events and travel, customer-facing roles, insecure work. A control for each risk, an action plan, and ideally a named lead. Our free risk assessment template follows this structure.	The risk assessment and the action plan.
4. Reporting	More than one way to report, named or anonymous, so nobody has to report to the person harassing them.	One confidential log of every concern, formal and informal.
5. Training	Everyone learns what sexual harassment is and what to do. Managers learn to receive and investigate complaints. Staff who deal with the public learn to handle harassment from customers or patients. Our free training pack covers all three.	Who was trained, on what, and when the refresher is due.
6. Handling complaints	Act promptly and take account of what the complainant wants. Offer informal and formal routes, set no time limit for raising a concern, use independent and trained investigators, protect complainant and witnesses, and explain the outcome and how to appeal.	Each complaint and your decisions, including where someone asked you to take no action.
7. Third parties	Treat harassment by a customer, client or patient as seriously as harassment by a colleague. Tell third parties your standards, decide how you’ll respond, and check where staff are left alone with customers or patients.	Incidents involving third parties and what you did.
8. Monitor and review	Look for trends in your log, run an anonymous survey, compare what’s reported with what the survey shows, hold lessons-learned sessions, and review policies at least once a year.	What each review found and what you changed.

Run the Free Self-Assessment Request the Free Templates

Free templates

Free sexual harassment policy and risk assessment templates

Steps 1 and 3 ask for a written policy and a written risk assessment. These two editable templates give you both, sent to your inbox. Each marks the parts to fill in with your own names, reporting routes, settings and third parties.

Template	What it covers
1. Sexual harassment policy (Word)	Our commitment: sexual harassment won't be tolerated, from anyone; Who the policy covers, including harassment by customers, clients or patients and other third parties; What sexual harassment is, with examples that fit your workplace, including at social events, while travelling and online; How to report it: more than one route, named or anonymous; What happens after a report: informal and formal routes and timescales; Support for anyone affected; Protection from victimisation, and whistleblowing; Training, and how we share this policy; Third parties: what we tell customers, clients or patients and how we respond; Monitoring and review, at least once a year.
2. Sexual harassment risk assessment (Word)	Who completed it, and when; Where risk arises: power imbalances, lone and night working, alcohol, events and travel, customer-facing roles, messages and online contact, insecure work; For each risk: who could be harmed, how likely it is and how serious; The controls you have now; Actions, each with an owner and a date; Harassment by third parties; When you'll review it.

Template

What it covers

1. Sexual harassment policy (Word)

Our commitment: sexual harassment won't be tolerated, from anyone; Who the policy covers, including harassment by customers, clients or patients and other third parties; What sexual harassment is, with examples that fit your workplace, including at social events, while travelling and online; How to report it: more than one route, named or anonymous; What happens after a report: informal and formal routes and timescales; Support for anyone affected; Protection from victimisation, and whistleblowing; Training, and how we share this policy; Third parties: what we tell customers, clients or patients and how we respond; Monitoring and review, at least once a year.

2. Sexual harassment risk assessment (Word)

Who completed it, and when; Where risk arises: power imbalances, lone and night working, alcohol, events and travel, customer-facing roles, messages and online contact, insecure work; For each risk: who could be harmed, how likely it is and how serious; The controls you have now; Actions, each with an owner and a date; Harassment by third parties; When you'll review it.

Free templates

Request the free templates

Enter your work email and the team will send you both templates: the sexual harassment policy and the sexual harassment risk assessment (Word).

Customers, patients and the public

Harassment by third parties

From 30 October 2026, an employee can bring a tribunal claim if a third party harasses them at work and you failed to take all reasonable steps to prevent it. Acas lists who counts: customers, clients, service users such as school students or healthcare patients, contractors, people at events and members of the public, in person or online.

Steps Acas suggests

Assess the risk of third-party harassment regularly.
Monitor and record incidents and what you did about them.
Cover third parties in your policy.
Train staff in personal safety and de-escalation.
Review your contracts and terms with clients, customers and suppliers.
Tell customers what happens if they harass staff, for example on posters or in emails.
In higher-risk settings, look at staffing levels, security, personal alarms and cameras.

For health and care providers, patients and residents are third parties, and the EHRC’s own examples include a hospital. NHS England’s voluntary sexual safety charter covers similar ground for NHS organisations.

The government says the duty doesn’t require employers to foresee the wholly unforeseeable or police customers’ private conversations. The test is whether you took all the steps that were reasonable for your workplace.

Related changes

Whistleblowing and confidentiality agreements

Whistleblowing. Since 6 April 2026, telling your employer or a prescribed body that sexual harassment has happened, is happening or is likely to happen counts as a protected disclosure. The worker still needs to reasonably believe the disclosure is in the public interest. The EHRC is one of the prescribed bodies. Our UK whistleblowing policy guide has a free model policy that covers it.

Confidentiality agreements. Employers must only use confidentiality agreements where it’s lawful, and never to stop someone whistleblowing, reporting a crime or meeting a regulatory duty (EHRC technical guidance, paragraph 4.48). New rules in section 24 of the 2025 Act will void agreements that stop workers speaking about harassment or discrimination. The consultation closed in July 2026, and the government expects the regulations in 2027.

Enforcement

How the duty is enforced

The EHRC can investigate, issue an unlawful act notice that requires an action plan, agree a binding agreement with you, or seek an injunction. It doesn’t need an incident of harassment to act.
Employment tribunals can’t hear a claim for a breach of the duty on its own. When a tribunal upholds a sexual harassment claim and awards compensation, it must consider whether you breached the duty, and can add up to 25% to the award. Discrimination compensation has no upper limit.
Third-party harassment claims can go to a tribunal from 30 October 2026.

Or show you took all reasonable steps

CalmER gives your staff more than one way to report, named or anonymous, through a hotline, app, web, Slack or Teams. Every case follows the same guided investigation steps, and CalmER keeps the audit evidence current as cases move. Trends across teams and sites show up in your board pack. When the EHRC or a tribunal asks what you did, the record shows it.

See CalmER →See CalmER pricing

Last reviewed: 8 October 2026. General information, not legal advice. We review this guide every month until the EHRC publishes its updated guidance and the government makes the reasonable-steps regulations. Where ours differs from the law or the EHRC’s guidance, theirs is correct.

FAQs

Common questions

What is the Worker Protection Act?

The Worker Protection (Amendment of Equality Act 2010) Act 2023 added section 40A to the Equality Act 2010. Since 26 October 2024, it has required employers to take reasonable steps to prevent sexual harassment of their employees in the course of their employment.

What changes on 30 October 2026?

The Employment Rights Act 2025 changes the duty to “all reasonable steps”. It also adds a new rule that employers must not permit a third party, such as a customer, client or patient, to harass their employees. Employees can bring a tribunal claim over third-party harassment from that date.

What counts as all reasonable steps?

The law doesn't list them. It's an objective test that depends on your size, resources, sector, working environment and contact with the public. Acas describes it as taking all the steps that are reasonable for your organisation, focusing on prevention, across the whole organisation. The government expects regulations setting out steps in 2027/28.

Do small employers have to comply?

Yes. The EHRC says no employer is exempt. What's reasonable depends on your size and resources, so a small employer is unlikely to need everything a large one does. The EHRC gives the example of a very small theatre company that was likely compliant without paid training.

Do we need a sexual harassment risk assessment?

The law doesn't name one, but the EHRC says an employer is unlikely to comply with the duty without carrying out a risk assessment. It should look specifically at sexual harassment, including harassment by customers, patients and other third parties.

Can an employee sue for a breach of the duty?

Not for the duty on its own. The EHRC enforces it. If a tribunal upholds a sexual harassment claim and awards compensation, it must consider whether the employer breached the duty, and can increase the compensation by up to 25%. From 30 October 2026, employees can also bring a claim over harassment by a third party.

Are employers responsible for harassment by customers?

From 30 October 2026, yes, where the harassment happens in the course of the employee's work and the employer failed to take all reasonable steps to prevent it. A third party is anyone other than the employer and its employees, such as customers, clients, patients, contractors and members of the public.

Who does the duty protect?

Employees, workers and self-employed people hired to do the work personally. Volunteers aren't covered by the work provisions of the Equality Act.

Is there a free sexual harassment policy template?

Yes. Request it on this page with your work email and the team sends two Word templates within one working day: a sexual harassment policy and a sexual harassment risk assessment. Each marks the parts to fill in with your own names, reporting routes, settings and third parties.

Do we need a separate sexual harassment policy?

The EHRC says you can have a separate policy or one harassment policy that clearly separates sexual harassment from other kinds. Acas suggests considering a standalone policy. Either way, it should say sexual harassment won't be tolerated and cover third parties.

Sources & further reading

References

General information, not legal advice. It reflects our understanding of the law and of EHRC and Acas guidance as of October 2026, so check legislation.gov.uk and equalityhumanrights.com for the current position.

The duty to prevent sexual harassment: what employers must do, and what changes on 30 October 2026