California Harassment Policy Requirements for Employers

If your business has five or more employees anywhere in California, state law requires you to maintain a written policy against harassment, discrimination, and retaliation that meets eleven specific content requirements, distribute it in a way you can verify each employee received it, post the state’s workplace discrimination and transgender rights posters, hand out a sexual harassment information sheet, provide interactive prevention training on a two-year cycle, and investigate every complaint that comes in.¹ The California harassment policy requirements for employers sit in Title 2, section 11023 of the California Code of Regulations, with related duties in Government Code sections 12940, 12950, and 12950.1. The written-policy rule kicks in at five employees, but the underlying prohibition on harassment applies to any employer with even one worker.²

The Eleven Elements Your Written Policy Must Contain

Section 11023 lists eleven items every compliant policy has to address. Missing one is enough to create exposure, so treat this as a checklist.

List every protected category under the Fair Employment and Housing Act: race, color, ancestry, national origin, religion, age (40 and over), physical and mental disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, sexual orientation, reproductive health decision-making, and military or veteran status.³
State that the law prohibits harassment by coworkers, supervisors, managers, and third parties. The scope cannot be limited to supervisor conduct.
Describe a complaint process that guarantees confidentiality to the extent possible, a timely response, impartial investigations conducted by qualified personnel, documentation and tracking of progress, appropriate remedial options, and timely closure.
Offer multiple reporting channels so no employee is forced to complain to their own supervisor. Acceptable channels include a designated HR representative, an EEO officer, another supervisor, a complaint hotline, or an ombudsperson.
Identify the California Civil Rights Department (CRD) and the federal Equal Employment Opportunity Commission (EEOC) as additional places employees can file complaints.
Instruct supervisors to report every complaint they receive to a designated company representative so the employer can begin an internal investigation.
Commit to fair, thorough investigations that give all parties due process and reach conclusions based on the evidence.
Promise confidentiality to the extent possible, without claiming the investigation will be completely confidential. Overpromising here can undercut a later investigation.
State that the employer will take appropriate remedial measures if misconduct is confirmed. “Remedial measures” is broader than discipline and can include reassignment, policy changes, or additional training.
Include an anti-retaliation statement making clear that employees will not face consequences for filing a complaint or participating in a workplace investigation.
Provide a link to, or the web address of, the CRD’s free online harassment training courses.

All eleven come directly from the regulation.¹

Who the Policy Has to Protect

The policy reaches beyond regular full-time employees. FEHA extends harassment protections to applicants, unpaid interns, volunteers, and independent contractors performing services for the company.² The CRD’s official poster confirms that scope, stating the law bars harassment of all these categories of workers “by any person.”⁴

Third-party harassment is squarely within the policy’s reach. An employer can be held responsible for harassing behavior by a client, customer, vendor, or business visitor if it knew or should have known about the conduct and failed to take immediate corrective action.² This is one of the places California goes further than federal law.

The One-Employee Threshold

The written-policy requirement in section 11023 applies at five or more employees. Underlying harassment liability, however, starts at one. Section 12940(j)(4)(A) defines “employer” for harassment purposes as any person regularly employing one or more workers.² A two-person business is not required to maintain the formal written policy, but it is still liable if harassment happens and it does nothing. Individual employees who harass are personally liable as well, whether or not the employer knew.

Distribution, Translation, and Posting

A policy that no one has seen is not a policy. Section 11023 requires distribution by at least one of three methods that produce a verifiable record: hard copy with a signed acknowledgment form; email with an electronic acknowledgment; or posting on a company intranet with a tracking system that confirms each employee has read and acknowledged it.¹

Translation

If 10 percent or more of the workforce at any facility speaks a language other than English as their primary spoken language, the employer must translate the entire policy into that language. The threshold applies separately at each facility, so a multi-site company may need different translations at different locations.¹

Posters and the Information Sheet

Government Code section 12950 requires every employer to post the CRD’s workplace discrimination poster in a prominent, accessible location and to post a separate poster on transgender rights. Employers must also distribute the CRD’s sexual harassment information sheet, or an equivalent document that covers, at minimum, the illegality of sexual harassment, a definition with examples, the internal complaint process, the legal remedies and complaint process available through the CRD, contact information for the CRD, anti-retaliation protections, and a link to the CRD’s online training.⁵ Facilities where more than 10 percent of the workforce does not speak English must post the poster in the appropriate languages too.⁴

Harassment Prevention Training

Every employer with five or more employees must provide interactive harassment prevention training. Supervisory employees get at least two hours; non-supervisory employees get at least one hour. After the initial session, everyone must be retrained once every two years.⁶

Training can be delivered live, online, or through any other effective interactive format, and can be broken into shorter segments so long as the total time is met.⁷ Content must cover practical examples of harassment based on protected characteristics, prevention of abusive conduct, harassment based on gender identity and sexual orientation, and the remedies available to victims. Trainers must have knowledge and expertise in prevention of harassment, discrimination, and retaliation.⁶

One boundary worth flagging: independent contractors, volunteers, and unpaid interns are not required to complete the training, even though they are protected by the harassment policy itself.⁷

Deadlines for New Hires and Short-Term Workers

New non-supervisory employees must be trained within six months of hire. New supervisors must be trained within six months of assuming a supervisory role.⁸ This is the deadline most employers miss. If someone is promoted in July, waiting for the next annual session in the following February is out of compliance.

Seasonal, temporary, or other employees hired for less than six months must be trained within 30 calendar days of hire or within 100 hours worked, whichever comes first.⁶

Tracking the Two-Year Cycle

Employers can track the retraining cycle two ways. Individual tracking measures two years from each employee’s last completion date. Training-year tracking designates a training year and requires everyone to complete training by the end of the next designated year, two years later. Either method works; pick one and apply it consistently.

Complaint Investigations and Employer Liability

Liability turns on who did the harassing and what the employer did about it. When a supervisor’s harassment produces a tangible job consequence for the victim, such as firing, demotion, or reassignment to significantly different duties, the employer is automatically liable. When a supervisor creates a hostile work environment without a tangible job action, the employer can defend itself by showing it took reasonable steps to prevent and correct harassment and that the employee unreasonably failed to use the complaint procedures available.⁹ A distributed policy with working complaint channels is the backbone of that defense.

When a non-supervisory coworker harasses, the employer is liable if it knew or should have known and failed to take immediate corrective action. The same standard applies to nonemployee harassers like customers and vendors, with the additional consideration of how much control the employer had.² The law asks whether reasonable steps were actually taken, not whether they were written down.

Retaliation and Employee Filing Windows

Retaliation against anyone who reports harassment or participates in an investigation is a separate FEHA violation. Protected activities include speaking out against conduct the employee reasonably believes is illegal, cooperating with an internal investigation, and filing a complaint with the CRD or EEOC. Employees do not need to use legal terminology to be protected; they just need to make clear they believe the employer may have broken the law.¹⁰

Employees have three years from the last unlawful act to file a complaint with the CRD.¹¹ That window is long enough that an employer may face a claim about conduct that occurred years earlier, which drives the recordkeeping approach below. FEHA also imposes no cap on damages, unlike federal Title VII.¹²

Recordkeeping

Section 11023 does not set a standalone retention period for policy acknowledgments and training records, but the three-year CRD filing window makes long retention practical necessity. Documentation that every employee received the policy, completed training on schedule, and signed acknowledgments is the single most important piece of evidence in defending a failure-to-prevent claim. Most employment attorneys recommend keeping harassment-related records for at least four years after separation. Federal EEOC rules independently require employers to retain personnel records for at least one year, and longer if a charge has been filed.¹³

1
Legal Information Institute. California Code of Regulations Title 2 Section 11023 – Harassment and Discrimination Prevention and Correction
2
California Legislative Information. California Government Code Section 12940
3
California Civil Rights Department. Employment Discrimination
4
California Civil Rights Department. Workplace Discrimination and Harassment Poster
5
California Legislative Information. California Government Code Section 12950
6
California Legislative Information. California Government Code Section 12950.1
7
California Civil Rights Department. Sexual Harassment Prevention Training For Employees FAQ
8
California Civil Rights Department. Sexual Harassment Prevention Training For Employers FAQ
9
California Civil Rights Department. Harassment Prevention Guide for California Employers
10
California Civil Rights Department. Workplace Retaliation Fact Sheet
11
California Legislative Information. California Government Code Section 12960
12
U.S. Equal Employment Opportunity Commission. Remedies For Employment Discrimination
13
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements