In recent years, the workplace harassment protocol has become one of the documents most frequently reviewed by the Labour Inspectorate.
However, in practice, many of the protocols in place within companies do not pass even a basic review: they are generic, incomplete, not applied, or simply do not comply with current legal requirements.
Having “a protocol stored in a drawer” is no longer enough. Regulations require it to be real, operational, known by the workforce, and aligned with current legislation. When this is not the case, the consequences may include financial penalties, labour disputes, and a serious loss of internal credibility.
In this article, we analyse why so many workplace harassment protocols fail an inspection, the most common mistakes, and what the law currently requires for them to be considered valid.
Is it mandatory to have a workplace harassment protocol?
Yes. In Spain, all companies and self-employed individuals with employees are required to prevent harassment in the workplace.
This obligation mainly arises from:
- Ley Orgánica 3/2007, which requires specific measures against sexual harassment and harassment based on sex.
- Ley de Prevención de Riesgos Laborales, which includes psychosocial risks within the employer’s duty of protection.
- Real Decreto 901/2020, which integrates the protocol into the Equality Plan for companies with more than 50 employees.
- More recent regulations such as Ley 10/2022, Ley LGTBI 4/2023, and Ley 2/2023 de protección del informante, which have raised compliance standards.
Not having an adequate workplace harassment protocol is considered an administrative offence, regardless of whether or not there are ongoing complaints.
The most common mistake: confusing documentation with compliance
One of the main reasons why protocols fail an inspection is that they exist only at a formal level.
It is common to find protocols that:
- Have been downloaded from the internet and barely adapted.
- Have not been negotiated with employee representatives.
- Have not been communicated or explained to the workforce.
- Have never been applied in practice.
From the Labour Inspectorate’s perspective, a protocol is not just a document, but a living system for prevention, detection, and action. If its real use cannot be demonstrated, it is considered non-compliance.
Types of harassment the protocol must cover
Another frequent reason for invalidity is that the protocol does not properly define harassment behaviours.
A valid workplace harassment protocol must, at a minimum, identify the following types:
Sexual harassment
Any verbal, non-verbal, or physical conduct of a sexual nature that violates a person’s dignity. It may occur through a single serious act, without the need for repetition.
Harassment based on sex
Conduct based on gender, pregnancy, maternity, or gender stereotypes, even when there is no sexual intent.
Moral or workplace harassment (mobbing)
Systematic and prolonged psychological violence aimed at undermining self-esteem or forcing the employee out of the organisation.
Discriminatory harassment
Harassment based on sexual orientation, gender identity, age, disability, racial origin, or religion.
Workplace cyber-harassment
Harassment carried out through email, WhatsApp, social media, or other digital means, even outside working hours, provided it is linked to the employment relationship.
When a protocol is limited to vague or incomplete definitions, it fails to fulfil its preventive function.
Why many protocols are not legally valid
From a legal standpoint, there are three key aspects that determine whether a protocol is valid:
1. Lack of negotiation or participation
In companies with employee representation, the protocol must be negotiated or consulted. Protocols imposed unilaterally by the company are often challenged during inspections.
2. Lack of impartiality in investigations
If the investigator lacks specific training or has a direct relationship with the parties involved, the procedure loses credibility.
3. Absence of procedural guarantees
Without confidentiality, prompt handling, and protection against retaliation, the protocol becomes meaningless.
Common shortcomings identified by the Labour Inspectorate
Among the most frequent errors that cause a protocol to fail an inspection are:
- Not distinguishing between informal and formal procedures.
- Failing to establish clear response timelines.
- Not providing precautionary measures to protect the alleged victim.
- Not regulating recusal or abstention of the investigator.
- Not addressing the restoration of working conditions.
- Not training employees or line managers.
- Not integrating the protocol with the internal reporting channel.
These shortcomings are interpreted as a lack of due diligence on the part of the company.
The role of the reporting channel and Law 2/2023
Law 2/2023 on whistleblower protection has radically changed how harassment complaints must be handled.
Today, the workplace harassment protocol must be integrated into the Internal Information System, guaranteeing:
- The possibility of anonymous reports.
- Absolute confidentiality.
- Protection against retaliation.
- Periodic communication to employees about the existence of the system.
Protocols that do not meet these requirements are automatically considered outdated.
Risks and sanctions for the company
Failure to properly comply with the workplace harassment protocol may result in:
- Financial penalties of up to €225,018 under the LISOS.
- Loss of Social Security contribution bonuses.
- Exclusion from public procurement.
- Nullification of dismissals or disciplinary actions.
- Reputational damage and deterioration of the workplace climate.
The Inspectorate no longer assesses only whether a protocol exists, but whether it actually works.
What distinguishes a valid protocol from a sanctionable one
| Situation | Valid protocol? | Risk of sanction |
| Generic protocol not applied | ❌ No | 🔴 High |
| Protocol without negotiation | ❌ No | 🔴 High |
| Protocol without anonymous reporting channel | ❌ No | 🔴 High |
| Updated and operational protocol | ✅ Yes | 🟢 Low |
An effective workplace harassment protocol is not only a legal obligation, but also a clear indicator of an organisation’s level of maturity. When well designed and properly implemented, it protects employees and the organisation itself from legal, financial, and reputational risks.
How GM Integra RRHH can help
At GM Integra, we help companies comply with equality-related obligations in a practical and straightforward way.
For companies with fewer than 50 employees, we implement equality awareness training and the mandatory protocol against sexual harassment and harassment based on sex.
And for companies with more than 50 employees, we support the development of the Equality Plan, the LGTBI Plan, and protocols for dealing with discrimination or harassment.
Frequently asked questions about workplace harassment protocols
- Are all companies required to have a workplace harassment protocol?
Yes. All companies and self-employed individuals with employees must have specific measures to prevent and address workplace harassment, regardless of size. - Is a protocol downloaded from the internet sufficient?
No. Generic protocols that are not adapted to the company or negotiated when required are usually considered insufficient during an inspection. - Is it mandatory for the reporting channel to allow anonymous complaints?
Yes. Since the entry into force of Law 2/2023, the internal information system must allow anonymous reporting and guarantee confidentiality. - What happens if the company has a protocol but does not apply it?
From a legal standpoint, this is considered non-compliance. The Inspectorate assesses real application, not just formal existence. - Can a company be sanctioned even if there are no harassment complaints?
Yes. The absence of a valid and operational workplace harassment protocol may be sanctioned even if there are no active complaints.