The Positive Duty to Prevent Sexual Harassment: An Employer Guide

Section 47C of the Sex Discrimination Act 1984 changed what the law asks of Australian employers. Inserted by the Anti-Discrimination and Human Rights Legislation Amendment (Respect at Work) Act 2022, which carried the recommendations of the Respect@Work national inquiry into legislation, it places a positive duty on every employer and every person conducting a business or undertaking: take reasonable and proportionate measures to eliminate sexual harassment and related unlawful conduct, as far as possible. And since 12 December 2023, the Australian Human Rights Commission has held the power to enforce it.

The old model was reactive: have a policy, wait for a complaint, respond to it. The positive duty inverts that. The absence of complaints is no longer evidence of compliance, because the question is not whether the business responded well, but what it did to prevent the conduct occurring at all. Brookvale HR Solutions works with small and medium businesses to turn that legal standard into a working prevention program. This guide explains what the duty covers, who it binds, what the regulator has done with its powers so far, and where a smaller business should start.

The most common starting point I walk into is the downloaded policy. Last year I sat with a 20-person business whose harassment policy still cited legislation that had been repealed years earlier, and nobody in the building had read it since the day it was saved to the shared drive. That document was not a control. It was a liability with a logo on it.

What conduct the positive duty covers

The duty is not limited to sexual harassment. Section 47C requires employers and PCBUs to eliminate, as far as possible, five categories of unlawful behaviour:

1. discrimination on the ground of sex in a work context
2. sexual harassment in connection with work
3. harassment on the ground of sex, often called sex-based harassment
4. conduct that creates a workplace environment hostile on the ground of sex
5. related acts of victimisation

Two features widen the net further. The duty extends to conduct by third parties, so harassment of workers by customers, clients or members of the public is inside scope, not outside it. And the hostile workplace environment category captures general conduct, such as demeaning jokes or sexual material in the workplace, that is not directed at any single person. A lunchroom nobody wants to sit in can breach the Act even though no individual was ever singled out.

The victimisation limb deserves its own sentence, because it is the one that catches employers after a complaint. Treating someone badly because they raised, or might raise, an allegation about any of the conduct above is itself unlawful conduct the duty requires the business to prevent. Prevention does not stop when a report is made; how the business behaves toward the person who made it is part of the same obligation.

Who must comply

Everyone who employs or engages workers. The duty applies to employers and persons conducting a business or undertaking regardless of size, from a sole trader with one casual employee to a national group, and there are no exemptions. Coverage follows the modern working relationship rather than the employment contract, so contractors, workers on labour hire and volunteers all sit within a duty holder's orbit.

For many small businesses this is the first Commonwealth discrimination obligation that applies to them proactively rather than through the complaint system, and it arrived without a size carve-out of the kind that softens parts of the Fair Work regime. The duty holder question is settled; the only live question is what compliance looks like at a given scale.

What scales with size is not whether the duty applies but what it demands, which is the point of the next section.

What "reasonable and proportionate" actually means

The duty requires reasonable and proportionate measures, and the Act itself lists the matters relevant to what that looks like for a given business:

• the size, nature and circumstances of the business or undertaking
• the duty holder's resources, financial or otherwise
• the practicability and cost of the measures
• any other relevant matter

This is what makes the same section of the same Act workable for a cafe and a mining contractor. A 20-person business is not expected to run a dedicated respect-at-work function. It is expected to do what a business of its size and means reasonably can, and to be able to show it. Doing nothing, on any reading of those factors, is never reasonable and proportionate.

The phrase "be able to show it" carries real weight. If the Commission ever asks, the answer cannot be a recollection of good intentions. Dated policies, training records, risk discussions noted in management meetings and a record of how reports were handled are what proportionate compliance looks like on paper, and assembling that record costs a fraction of producing it under compulsion later.

The seven standards, in small business terms

The Australian Human Rights Commission's guidelines for complying with the positive duty set out seven standards it uses to assess compliance. They are not legally binding, but when the Commission examines a business, this is the framework it applies, which makes them the closest thing to a compliance specification the duty has. Much of the published commentary on the standards assumes an organisation with an HR department, a board and a general counsel. The standards themselves assume no such thing. For each one, there is a version that fits a 20-person business:

1. Leadership. The owner or senior manager knows what the duty requires, says clearly and repeatedly that harassment has no place in the business, and acts consistently with that when it counts.
2. Culture. The everyday environment makes it safe to speak up. In a small team this is set by what the leader tolerates in the room, not by what the values poster says.
3. Knowledge. Everyone knows what the unlawful conduct is, what the policy says, and what happens when someone reports. Induction and periodic refreshers carry this in a small business.
4. Risk management. Sexual harassment is treated as a workplace risk like any other: identified, assessed and controlled. Late-night shifts, alcohol at work functions, isolated work and customer-facing roles are common risk factors worth honest attention.
5. Support. Workers who experience or witness harassment know where support sits, internally or through an external provider, and can reach it without lodging a formal complaint first.
6. Reporting and response. There is a clear way to report, more than one path in, and responses are consistent, proportionate and fair to everyone involved.
7. Monitoring, evaluation and transparency. The business checks whether any of this works: it collects what data it can, asks its people, and adjusts. Even a small business can review incidents annually and act on what it finds.

None of that requires an enterprise budget. It requires deliberateness, and a record that the thinking happened.

What the AHRC has done with its powers so far

Since December 2023 the Commission can conduct inquiries into suspected non-compliance on its own initiative, compel the production of information and documents, issue compliance notices, accept enforceable undertakings, and apply to the federal courts to enforce its notices. It no longer needs to wait for an individual complaint, and that shift matters more than any single power on the list.

The first inquiries

The powers are being used. In 2024-25 the Commission commenced four formal inquiries into businesses in retail, hospitality, finance and transport, collectively covering around 7,500 workers. The businesses have not been named publicly, which is its own lesson: an inquiry is not a press release, it is a regulator inside the business, examining policies, records and culture against the seven standards, with the power to compel what is not offered voluntarily.

The forward program is just as clear. For 2025-26 the Commission has named retail and hospitality as proactive compliance priorities. No compliance notice or enforceable undertaking has yet been announced publicly, but the trajectory from education to enforcement is explicit. The regulator that once published guidance is now knocking on doors.

The direction of travel

The connected reform is worth a sentence here too: restrictions on non-disclosure agreements in sexual harassment matters have begun arriving at state level, and the transparency expectations of the positive duty pull in the same direction.

Where Queensland stands

Queensland legislated its own broader positive duty in 2024, but those provisions have not commenced; they were deferred indefinitely in 2025 and are now part of a formal review due to report by 31 March 2027. Queensland employers should not read anything into that pause. The federal duty under s 47C applies to every Queensland business and PCBU right now, with the AHRC enforcing it, and nothing in the state review changes that by a day. If anything, the state uncertainty is an argument for building the prevention program to the federal standard immediately, since that work will carry over whatever Queensland ultimately commences.

One risk, two regimes

Sexual harassment is also a work health and safety issue. Under the model WHS framework it is recognised as a psychosocial hazard, with a Commonwealth code of practice on sexual and gender-based harassment (approved for the Commonwealth jurisdiction; in Queensland it is guidance only) sitting alongside the broader psychosocial code, and PCBUs must eliminate or minimise the risk so far as is reasonably practicable. That means one risk answers to two proactive regimes: the Sex Discrimination Act duty enforced by the AHRC, and the WHS duty enforced by state regulators. In Queensland the WHS side is already concrete: since 1 March 2025, the state's WHS Regulation has required businesses to prepare and implement a written sexual harassment prevention plan for identified risks.

The tests differ in wording. The discrimination duty asks for reasonable and proportionate measures to eliminate the conduct as far as possible; the WHS duty asks for elimination or minimisation so far as is reasonably practicable. Compliance with one does not automatically satisfy the other, and each regulator assesses against its own standard, though in practice a genuine prevention program does much of the work for both. How the psychosocial side of that equation operates is covered in the Brookvale HR Solutions article on managing psychosocial hazards at work.

Where a small business should start

The duty rewards a sequence, not a scramble. Businesses that try to do everything at once usually produce a folder of documents and no change in behaviour, and the standards are explicitly about behaviour. A right-sized starting order for an SME looks like this:

1. A clear statement from the top that prevention is owned by leadership, not delegated to a policy document.
2. An honest risk conversation: where in this business, on which shifts, in which roles, could this conduct plausibly occur, and what controls exist today? Write the answers down, because that note is the beginning of the risk-management record.
3. A policy refresh that covers all five categories of conduct, in language the workforce actually uses, with the third-party dimension included so customer conduct is not treated as a separate, lesser problem.
4. Training that goes beyond definitions to behaviour: what to do as a bystander, how to report, what happens next, and what the business promises about how reporters will be treated.
5. More than one reporting path, and named support options.
6. A calendar entry: review what happened, what was reported and what changed, at least annually.

Sequenced that way, each step produces evidence of the one before it, which matters because the duty is assessed on what a business can show, not what it intended. It is also a different exercise from pulling a harassment policy off the internet and circulating it, which is the compliance reflex the positive duty was designed to end. A policy nobody trained on, covering conduct nobody defined, reviewed by nobody since it was downloaded, satisfies none of the seven standards and would not survive the first hour of an inquiry. A structured version of this work is what businesses engage Brookvale HR Solutions to build through a positive duty compliance program, sized to what reasonable and proportionate means for your business.