The Mandatory Sexual Anti-Harassment Protocol: Compliance and the Employer's Criminal Liability in Spain

Implementing a sexual harassment prevention protocol is not an optional best practice or a reputational ornament: it is a legal obligation for every Spanish company. And failing to comply does not stop at an administrative fine. When harassment occurs in an organisation that had no protocol —or had one only on paper— the employer or director can end up charged through commission by omission, and the company itself can have its criminal liability triggered. As a criminal compliance and employer defence firm, we explain what the law requires, what criminal risks its omission opens up and how to build a protocol that truly protects.

A Legal Obligation, Not a Recommendation

The starting point is clear: Article 48 of Organic Act 3/2007, on effective equality between women and men, requires all companies —whatever their size— to promote working conditions that prevent sexual harassment and harassment on grounds of sex, and to establish specific procedures for prevention and for channelling any complaints victims may bring.

That requirement has been reinforced by Organic Act 10/2022 on the comprehensive guarantee of sexual freedom, and by Act 15/2022 on equal treatment. To this is added, for the handling of complaints, the internal reporting system regulated by Act 2/2023 on the protection of whistleblowers. The legislative message is unequivocal: harassment prevention has ceased to be a voluntary commitment and has become an enforceable legal duty, with no minimum headcount threshold.

What an Effective Protocol Must Contain

Downloading a template and filing it away is not enough. A protocol that fulfils its preventive function and carries weight for an eventual defence must set out, as a minimum:

• A zero-tolerance statement approved by management and communicated to the entire workforce.
• A clear definition of sexual harassment and harassment on grounds of sex, with understandable examples.
• An accessible, confidential reporting channel compliant with Act 2/2023, designating the person or committee in charge of the inquiry.
• A swift, rights-respecting internal investigation procedure that upholds the presumption of innocence of the reported person and the confidentiality of the victim.
• Precautionary and protective measures for the complainant while the matter is processed.
• Periodic training of staff and managers, and a coherent disciplinary regime.
• Oversight and review mechanisms that evidence that the protocol is genuinely applied.

The difference between a real protocol and a façade one is decisive: only the former prevents conduct and, where needed, serves as evidence of the company's diligence.

The Employer's Criminal Liability by Omission

This is the risk few directors anticipate. Article 11 of the Criminal Code (CP) governs commission by omission: a person in a position of guarantor —that is, with a specific legal duty to prevent a result— is liable for that result as if they had actively caused it when they fail to prevent it, being under a duty to do so and able to do so.

The employer, the administrator or the director with real organisational power occupies that position of guarantor over the safety and integrity of their workers. If sexual harassment occurs in the company and it is established that the person in charge knew of, or could not ignore, the risk, lacked a protocol or had an inoperative one, and failed to adopt the measures incumbent upon them, art. 11 CP allows the offence to be imputed to them by omission. The penalty is not a penalty "of art. 11": it is that of the underlying offence that was left unprevented.

The Company's Criminal Liability (Art. 31 bis CP)

Alongside the natural person, the legal person itself may be liable. Article 31 bis CP establishes the company's autonomous criminal liability for offences committed in its name or on its behalf, for its direct or indirect benefit, by its representatives and directors, or by those who, being under their authority, were able to commit the offence because the duties of supervision, monitoring and control were seriously breached.

The consequences are far from minor: the catalogue of penalties in art. 33.7 CP includes fines, suspension of activities, closure of premises, disqualification from contracting with the public sector or receiving subsidies and even the dissolution of the company. For a business, the opening of criminal proceedings over such facts is also a reputational blow that is hard to reverse.

What matters for the defence is that art. 31 bis CP provides for an exemption or mitigation where a suitable crime-prevention model was adopted and effectively implemented before the events. The anti-harassment protocol, integrated into that compliance model and genuinely operational, is precisely one of the elements that can tip the balance towards exemption or mitigation.

The Underlying Offence: Sexual Harassment Under Art. 184 CP

It is worth keeping in mind that the liability of the company and the director revolves around an offence actually committed by another person: the harasser. That offence is sexual harassment under Article 184 CP.

• Basic offence (184.1 CP): requesting favours of a sexual nature within an employment, teaching or service-provision relationship, causing the victim an objectively and seriously intimidating, hostile or humiliating situation. Penalty of six to twelve months' imprisonment or a fine of ten to fifteen months, and special disqualification of twelve to fifteen months.
• Abuse of superiority (184.2 CP): where the harassment is committed by taking advantage of a position of employment, teaching or hierarchical superiority, the penalty rises to one to two years' imprisonment.
• Special vulnerability (184.4 CP): if the victim is in a situation of special vulnerability on grounds of age, illness or disability, the penalty is imposed in its upper half.

The existence and application of the protocol do not eliminate the harasser's criminal liability, but they directly condition the position of the company and its directors regarding that same conduct. Anyone who wishes to look deeper into the offence can consult the firm's page on the anti-harassment protocol and employer defence.

A Threefold Route: Administrative, Labour and Criminal

A single harassment episode can unfold consequences on three simultaneous planes, and the employer's defence has to think about them together:

• Administrative-labour route: the lack of a protocol, its non-application or tolerance of harassment is a very serious infringement under the Act on Infringements and Penalties in the Social Order (LISOS), with substantial financial penalties and possible loss of benefits and of access to public contracting.
• Labour route: the harassed worker may seek compensated termination of the contract and claim damages; the internal disciplinary regime must be triggered against the harasser.
• Criminal route: liability of the harasser (art. 184 CP), of the director in a position of guarantor (art. 11 CP) and of the legal person (art. 31 bis CP).

These planes are not mutually exclusive: they can be pursued in parallel, with their own rules and different timeframes. This is why the strategy cannot be limited to just one of them.

How the Defence Approaches These Cases

When a company or a director is implicated, the defence works in several directions. On the criminal front, it analyses whether a genuine position of guarantor existed and whether the delegation of functions was effective; it examines whether the director knew or could have known of the risk; and it assesses the suitability and real application of the protocol and the compliance model in order to invoke the exemption or mitigation of art. 31 bis CP.

In parallel, it reviews the internal investigation already carried out —because a rights-respecting internal inquiry strengthens the company's position, while a botched one weakens it— coordinates the response with the administrative and labour fronts, and ensures that no action on one plane harms the others. On the evidentiary side, the documentation of the reporting channel, training records, minutes and the traceability of the decisions taken all carry weight. The settled case law of the Supreme Court on commission by omission and on the liability of legal persons sets the technical terrain on which that defence is built.

Criminal Compliance and Employer Defence in Madrid and Throughout Spain

The criminal law firm Alonso Sala, based at Calle Velázquez 27 in Madrid and with coverage throughout Spain, advises companies and directors on designing and reviewing anti-harassment protocols integrated into their compliance model, and takes on the criminal defence when the liability of the natural or the legal person comes into play. We work on prevention before the problem and on a coordinated strategy across the criminal, administrative and labour fronts once the problem has already arisen.