Work Health and Safety (Sexual and Gender-based Harassment) Code of Practice 2025

The Work Health and Safety (Sexual and Gender-based Harassment) Code of Practice 2025 is an approved code of practice made under section 274 of the Work Health and Safety Act 2011. It provides practical guidance on how to achieve the standards of work health and safety required under the Act and the Work Health and Safety Regulations 2011, and on effective ways to identify and manage risks.

Its subject matter is sexual and gender-based harassment at work. The Code is directed to a person conducting a business or undertaking, usually called a PCBU, and explains how a PCBU should manage health and safety risks arising from this kind of conduct. The practical point for business owners is that the Code treats sexual and gender-based harassment as a WHS risk that can affect psychological and physical health and safety.

The foreword also explains the legal status of an approved code. Courts may regard a code of practice as evidence of what is known about a hazard, risk, risk assessment or risk control, and may rely on it in determining what is reasonably practicable in the circumstances. Inspectors may also refer to an approved code when issuing an improvement or prohibition notice.

The Code is guidance, but it is not optional in any casual sense. A business may comply by using another method only if that method provides an equivalent or higher standard of WHS than the Code. If your business chooses a different approach, you should be able to show how it reaches at least the same safety standard in practice.

The Code applies to the performance of work and to all workplaces covered by the Commonwealth WHS Act. That scope point is important. This is not a code for every Australian workplace automatically. It is a Commonwealth code, so the first practical check is jurisdiction. If your business is regulated mainly under a state or territory WHS regime, this Code may still be useful background reading, but it is not the operative Commonwealth code for you unless your workplace is covered by the Commonwealth Act.

The Code is intended to be read by PCBUs, but it also refers to the duties of officers, workers and other persons at the workplace. Officers, such as company directors, must exercise due diligence to ensure the business or undertaking complies with its WHS duties. Workers and other persons also have duties to take reasonable care and comply with reasonable instructions so far as they are reasonably able.

The Code also says it may be a useful reference for other persons interested in duties under the WHS Act and Regulations. In practice, that means owners, directors, managers, supervisors, HR staff, WHS staff and anyone responsible for workplace systems should understand it.

The Code expressly says it is intended to be read and applied in conjunction with the Work Health and Safety (Managing Psychosocial Hazards at Work) Code of Practice 2024 (Cth). That is not a minor cross-reference. It tells businesses that sexual and gender-based harassment should be managed within the broader psychosocial risk framework used under Commonwealth WHS law.

The Code also says sexual and gender-based harassment often occurs in conjunction with other psychosocial hazards, and that a PCBU must consider the interaction between these hazards when managing risks to the health and safety of workers and others. So if your business is reviewing only a harassment policy, but not looking at workload, supervision, isolation, reporting culture, other forms of harassment or discrimination, or the way work is organised, you may be looking too narrowly at the problem.

This matters especially where a workplace has overlapping issues such as bullying, racism, poor supervision, insecure work arrangements or a culture of disrespect. The Code indicates that these issues can interact and increase both the likelihood of harm and the severity of harm.

The Code addresses a range of harassment and behaviours based on gender and sex that create a risk of harm at work. It says Appendix A provides definitions and descriptions of some of these behaviours, including sexual harassment, sex- or gender-based harassment and discrimination, hostile working environments on the grounds of sex, and gendered violence.

Importantly, the Code also says WHS laws require PCBUs to manage all WHS risks even where the behaviour is not specifically described in the Code or may not meet definitions or thresholds set by other legal frameworks. For business owners, that means you should not assume there is no WHS issue simply because conduct may not fit neatly into one legal label or another.

The Code gives a wide range of examples. It says sexual and gender-based harassment can be a one-off incident or repeated behaviour. It can be obvious or subtle. The most serious acts, such as sexual assault, may constitute criminal offences. More subtle forms, such as sexist remarks, crude language and a degrading or intimidating workplace culture, can also create a risk to health and safety.

The Code also makes clear that conduct does not have to be directed at one person to create risk. Behaviour can affect someone who is exposed to it or witnesses it, such as overhearing a conversation, hearing rumours or seeing sexually explicit posters in the workplace.

The Code adopts the broad WHS concept of a workplace. A workplace is a place where work is carried out for a business or undertaking and includes any place where a worker goes, or is likely to be, while at work. That means the risk is not confined to your main premises.

The Code expressly says sexual and gender-based harassment at work can happen at a worker's usual workplace, where a worker is working remotely including from home, at another location such as a client's home, during work-related activities such as conferences, training, work trips and work-related events, by phone, email, camera or online, through misuse of shared workplace technologies such as shared calendars, and at worker accommodation.

For many businesses, this is one of the most important practical points. If your controls only cover conduct inside the office during ordinary hours, they are likely to miss common risk settings such as travel, after-hours events, online channels, isolated work and accommodation linked to work.

The Code says anyone can experience sexual or gender-based harassment, but some groups are more likely to experience it. It specifically lists workers who are new to the workforce, workers under 30 years of age, LGBTQIA+ workers, workers who do not conform to traditional gender stereotypes, Aboriginal or Torres Strait Islander workers, workers with disability, workers from culturally and linguistically diverse backgrounds, migrant workers, workers holding temporary visas, and people in insecure working arrangements such as casual or labour hire workers.

The Code also explains the intersectional nature of harassment. It says gender inequality is a key driver, and that other forms of disadvantage based on age, sex, gender, sexuality, migration status, race and disability can combine and increase a person's exposure to hazards and vulnerability. It gives the example of a migrant worker with disability being more likely to experience harassment and also less likely to have the same supports, confidence or awareness to report it quickly.

For businesses, this means consultation and reporting systems should be designed for the workers you actually have, not for an idealised workforce. A process that is technically available may still be ineffective if workers fear repercussions, do not understand the process, or do not trust that concerns will be handled properly.

The Code gives special attention to workers who are minors, meaning under 18. It says they may be particularly vulnerable to sexual and gender-based harassment because harassment is driven by power imbalance, minors are likely to perceive they have less power than older workers, they may have less experience recognising harassing behaviour, and they may be learning workplace norms in their first jobs.

The Code also says sexual behaviour directed at workers under 18 may constitute child-based sexual offences, and that children often see grooming behaviours as friendship and may not identify the risks. If you have workers under 18, the Code says you must ensure you have identified the hazards they may be exposed to at work and implemented all reasonably practicable control measures.

The Code gives examples of control measures. These include not assigning minors to certain tasks, vetting other workers they will work closely with, providing additional supervision, and providing training on acceptable behaviours in the workplace. It also says that if you suspect sexual behaviour directed at a worker under 18, you should contact child welfare authorities or police, and that you or your workers may also have mandatory reporting obligations.

The Code states that a PCBU must ensure, so far as is reasonably practicable, that workers and other persons are not exposed to risks to their psychological or physical health and safety, including risks from psychosocial hazards such as sexual and gender-based harassment. It also states that a PCBU must eliminate health and safety risks at work, or if that is not reasonably practicable, minimise those risks so far as is reasonably practicable.

That means a business should not wait for a formal complaint, a serious incident or police involvement before acting. The duty is about managing risk proactively. The Code also says a range of other duties apply, including consultation duties and duties of officers, workers and other persons at the workplace. If you have management or control of a workplace, you have additional duties under WHS laws.

For officers, the Code says due diligence includes taking reasonable steps to ensure the PCBU has and uses appropriate resources and processes to eliminate or minimise risks of sexual and gender-based harassment. The example given is ensuring the PCBU has safe systems of work and safe work environments to eliminate or minimise the risk.

For workers, the Code says they must take reasonable care for their own psychological and physical health and safety, take reasonable care not to adversely affect others, comply with reasonable health and safety instructions, and cooperate with reasonable health and safety policies or procedures that have been notified to them. For other persons at the workplace, such as customers, the Code says they also must take reasonable care and comply with reasonable instructions so far as they are reasonably able.

The available text confirms that the Code contains a dedicated risk management structure. Its table of contents includes chapters on the risk management process, consulting throughout the risk management process, identifying sexual and gender-based harassment, assessing the risks, controlling the risk, maintaining and reviewing controls, investigating and responding to reports, and leadership and culture.

Even without reproducing the full later chapters, the structure itself is useful for businesses. It shows that this topic should be managed like other WHS hazards: consult, identify, assess, control, maintain, review, and respond. It also shows that response systems and workplace culture are part of risk management, not separate side issues.

The table of contents also identifies the control areas the Code deals with. These include duration, frequency and severity, interaction of psychosocial hazards, design of work including job demands and tasks, systems of work including how work is managed, organised and supported, design and layout and environmental conditions of the workplace, worker accommodation, plant substances and structures at the workplace, workplace interactions or behaviours, and the information, training, instruction and supervision provided to workers.

For a business owner, that means practical controls may need to go well beyond a written policy. They may involve changing supervision arrangements, redesigning tasks, changing event settings, improving reporting pathways, reviewing accommodation arrangements, setting standards for online channels, or changing who works with whom and in what conditions.

Because the Code links sexual and gender-based harassment to systems of work, workplace interactions, supervision and leadership, businesses should review both documents and day-to-day conduct. A policy alone is unlikely to be enough if the real work environment tolerates sexist jokes, poor supervision, unsafe travel arrangements, misuse of technology or customer behaviour that staff are expected to absorb.

Start with the places where work is actually done and the ways people actually interact. Review induction materials, behavioural standards, complaint and reporting pathways, supervision arrangements, event planning, travel protocols, accommodation arrangements, online communication channels and any shared technology that could be misused. Then compare those documents with what really happens in practice.

The Code also says workers may be exposed through verbal communications, written words, pictures or other imagery, in person or through emails, text messages, social media, posters and other publications. That means businesses should not limit their review to face-to-face conduct. Digital channels and informal communication spaces matter too.

The Code's table of contents includes a full chapter on investigating and responding to reports, with subtopics on the nature of investigation, selecting an investigator, trauma informed approach and confidentiality. The available text also gives some direct guidance on supporting workers.

It says that when dealing with a report of sexual or gender-based harassment and discussing options, it is important to respect the affected worker's desired outcome and preferred way of managing the incident. This should include consideration of how disclosure of the complaint may impact the worker. It also says workers may need assistance to access support services, and should be provided with a range of options and allowed to seek the support that best suits their needs.

The Code further states that even where a matter is being investigated by police, the WHS risks must be addressed. That is a practical point many businesses miss. External processes do not remove the need to manage immediate and ongoing workplace risk.

The Code says WHS laws do not operate in isolation and that other laws may also apply, including workplace relations, criminal, anti-discrimination, privacy and workers' compensation laws. It also notes that specific statutory codes of conduct may apply in some settings, including the Australian Public Service Code of Conduct, the Parliamentary Service Code of Conduct and the Australian Federal Police Code of Conduct.

The Code then specifically addresses the positive duty in the Sex Discrimination Act 1984. It says that duty operates concurrently with WHS duties. PCBUs must take reasonable and proportionate measures to eliminate, as far as possible, certain discriminatory conduct that is unlawful under the Sex Discrimination Act, including sex discrimination in a workplace context, sexual harassment in connection with work, sex-based harassment in connection with work, conduct amounting to a hostile work environment on the grounds of sex, and certain acts of victimisation.

The Code also says the PCBU must eliminate, as far as possible, unlawful conduct in the workplace carried out by the PCBU, workers, the PCBU's agents and, in some circumstances, third parties such as customers, clients, patients, service users, patrons, suppliers, students, parents, carers and visitors. Crucially, it says your obligations under the Sex Discrimination Act are in addition to your existing WHS duties, and that complying with the Sex Discrimination Act alone will not necessarily ensure that you are meeting your WHS duties.

The instrument is titled the Work Health and Safety (Sexual and Gender-based Harassment) Code of Practice 2025. It was approved by the Minister for Employment and Workplace Relations on 5 March 2025 and registered on the Federal Register of Legislation on 7 March 2025. The instrument states that it commences on the day after registration, so commencement was 8 March 2025.

The Federal Register entry identifies the instrument as in force. Businesses should still check the current register entry before relying on any compliance page, especially if they are reviewing obligations some time after publication.

Before using this page as a compliance guide, there are three practical checks to make. First, confirm jurisdiction. This Code applies to workplaces covered by the Commonwealth WHS Act, not automatically to every Australian business. Second, read it together with the Commonwealth Managing Psychosocial Hazards at Work Code of Practice 2024, because this Code expressly says they should be applied together. Third, check the full current instrument on the Federal Register if you need detailed guidance on the later chapters dealing with risk management steps, controls, review, investigations and leadership, because the publicly available text extract used here is truncated before the full wording of those chapters.

If your business is in scope, the safest practical approach is to treat sexual and gender-based harassment as part of your ordinary WHS system. That means looking at where the work happens, who interacts with whom, what power imbalances exist, what technology is used, how concerns are reported, and whether your controls work in practice for the workers you actually have.