TLDR: Every Ontario employer — regardless of size — must have a written workplace harassment policy and a workplace harassment program under the Occupational Health and Safety Act (OHSA). The policy is a written commitment; the program is the operational mechanism to enforce it. Since Bill 190 (2024), digital and online harassment is explicitly covered. Failing to have compliant documents exposes your business to Ministry orders, fines up to $1.5 million, and personal liability for directors and officers.
Why This Guide Matters for Ontario Employers
Workplace harassment claims have surged in Ontario since 2020. The Human Rights Tribunal of Ontario (HRTO) and the Ministry of Labour both report significant year-over-year increases in harassment-related complaints. For employers, the financial exposure is real: HRTO awards for workplace harassment range from $25,000 to over $150,000 in general damages alone, and OHSA violations can trigger Ministry orders that halt operations until deficiencies are corrected.
But the bigger risk is not a fine — it is the legal and reputational damage from an unaddressed harassment incident that escalates. An employer who has no written policy, no program, and no investigation protocol is practically defenceless when a claim is filed.
This guide walks Ontario employers through exactly what is required, what is best practice beyond the minimum, and what to avoid.
The Legal Framework: OHSA, the Human Rights Code, and Bill 190
| Law | What It Governs | Threshold | Enforcement |
|---|---|---|---|
| OHSA Part III.0.1 (Workplace Harassment) | Requires written harassment policy AND program; mandates investigation | All Ontario employers (no minimum) | Ministry of Labour — inspectors, orders, fines up to $1.5M |
| Ontario Human Rights Code | Prohibits harassment and discrimination based on 17 protected grounds | All Ontario employers (no minimum) | Human Rights Tribunal of Ontario (HRTO) — damages, remedial orders |
| Bill 190 (Working for Workers Five Act, 2024) | Expanded harassment definition to include electronic means (text, email, social media) | All Ontario employers | Ministry of Labour — same as OHSA |
| Bill 168 (2010) | Original addition of workplace violence and harassment provisions to OHSA | Historical context only — now fully incorporated into OHSA | — |
Key insight: The OHSA framework and the Human Rights Code operate in parallel and independently. An employer can violate one without violating the other — and often violates both simultaneously. A comprehensive harassment policy should address both frameworks in a single integrated document.
Who Must Comply
Under OHSA, every Ontario employer must have a written workplace harassment policy and program. There is no minimum employee count, no revenue threshold, and no industry exception. A sole proprietor with one employee is subject to the same written policy requirement as a 500-person manufacturer.
The obligation applies to:
- All private sector employers operating in Ontario
- Public sector employers (hospitals, universities, municipalities, school boards)
- Provincially regulated industries (retail, manufacturing, construction, professional services, healthcare)
- Employers with remote workers based in Ontario
Note: Federally regulated employers (banks, telecommunications companies, airlines, interprovincial trucking) are governed by the Canada Labour Code, not OHSA. Their harassment obligations differ and are set out in Part II of the CLC and the Workplace Harassment and Violence Prevention Regulations (SOR/2020-130).
Policy vs. Program: The Distinction Most Employers Miss
The single most common compliance gap is treating the policy and the program as the same document. They are not. OHSA creates two distinct obligations.
The Workplace Harassment Policy (OHSA s.32.0.1)
The policy is a written statement of values and commitment. Under OHSA, it must:
- State that every worker is entitled to work in a workplace free from harassment
- State that the employer will investigate and deal with all incidents and complaints of workplace harassment in an appropriate manner
- Be reviewed at least annually
- Be posted in a conspicuous place in the workplace
The policy is the employer’s public commitment. It sets the tone and establishes the organizational position. It need not be lengthy — a well-drafted policy can be two pages — but it must clearly state the employer’s zero-tolerance stance and the commitment to investigate.
The Workplace Harassment Program (OHSA s.32.0.2)
The program is the operational framework that gives effect to the policy. OHSA requires the program to include:
| Program Element | What It Must Address |
|---|---|
| Reporting mechanisms | Measures and procedures for workers to report incidents and complaints of workplace harassment, including to someone other than the worker’s supervisor (where the supervisor is the alleged harasser) |
| Employer response process | How the employer will investigate and deal with incidents and complaints — including timelines |
| Confidentiality | How information obtained about an incident or complaint will be kept confidential, subject to exceptions necessary for investigation, taking corrective action, or required by law |
| Communication of results | How the worker who has allegedly been harassed and the alleged harasser (if they are a worker) will be informed of investigation results and any corrective action taken or to be taken |
| Other prescribed elements | Any additional requirements set out in regulations (currently O.Reg 32/12 for domestic violence and reprisal) |
The program must also be reviewed at least annually — the same requirement as the policy — and must be developed and maintained in consultation with the Joint Health and Safety Committee (JHSC) or health and safety representative where one exists.
Definitions Under OHSA
Ontario’s OHSA defines two forms of workplace harassment, and understanding the precise definitions matters for investigation and policy design.
Workplace Harassment
Under OHSA s.1(1), “workplace harassment” means:
Engaging in a course of vexatious comment or conduct against a worker in a workplace that is known or ought reasonably to be known to be unwelcome; or workplace sexual harassment.
Three elements deserve attention:
- “Course of” conduct — standard workplace harassment generally requires more than a single incident (though context matters, and repeated minor incidents accumulate). Sexual harassment can be a single incident.
- “Known or ought reasonably to be known” — the test is objective. An alleged harasser cannot escape liability by claiming ignorance of the impact.
- No protected ground required — unlike Human Rights Code harassment, OHSA harassment does not need to be based on a Code-protected characteristic. Personal vendettas, general bullying, and repeated belittling all qualify.
Digital Harassment (Bill 190, 2024)
Since the Working for Workers Five Act came into force in 2024, the OHSA definition of workplace harassment explicitly includes conduct carried out by electronic means — email, text messages, social media, chat platforms, and online communications. An employer’s policy and program must now address:
- Harassment via internal communication tools (Teams, Slack)
- Harassment via personal devices targeting coworkers
- Social media harassment that affects the workplace
- Threatening or abusive online posts about or to coworkers
This change was significant because many harassment policies predating 2024 only addressed in-person conduct. All policies should be reviewed and updated to reflect the expanded digital scope.
What Is NOT Workplace Harassment Under OHSA
OHSA explicitly excludes the following from the definition of workplace harassment:
- Reasonable management actions taken for legitimate management reasons (performance management, discipline, restructuring, workload assignments)
- Single incidents that are not sexual harassment (generally — context-dependent)
- Personality conflicts or general disagreements between coworkers
This does not mean these situations are irrelevant from an employment law or Human Rights Code perspective — it means the OHSA harassment investigation trigger has not been met. Employers should still document and address workplace conflict, but through a different process.
The Human Rights Code Overlay
The Ontario Human Rights Code (OHRC) prohibits harassment in employment on 17 protected grounds. Any harassment connected to a protected characteristic creates dual liability under both OHSA and the Code.
| Protected Ground | Common Harassment Examples in the Workplace |
|---|---|
| Race | Racial slurs, racialized jokes, exclusion from meetings based on race |
| Ancestry / Place of Origin | Comments about national origin, immigration status mockery |
| Colour | Colour-based discrimination or degrading comments |
| Ethnic Origin | Ethnic stereotyping, mocking accents, cultural dismissal |
| Citizenship | Targeting workers for being non-citizens |
| Creed (Religion) | Religious mockery, prayer scheduling pressure, dietary disrespect |
| Sex | Sexist comments, gender-based stereotyping |
| Sexual Orientation | Homophobic comments, outing a worker without consent |
| Gender Identity | Deliberate misgendering, transphobic conduct |
| Gender Expression | Mocking gender non-conforming dress or presentation |
| Disability | Mocking a physical or mental health condition, pressure to disclose |
| Age | Ageist comments targeting older or younger workers |
| Marital Status | Targeting divorced or single workers with unwelcome comments |
| Family Status | Comments about parenting responsibilities or family structure |
| Receipt of Public Assistance | Denigrating workers who receive government assistance |
| Record of Offences | Stigmatizing workers for a pardoned criminal record |
| Pregnancy | Comments about pregnancy, presumed limitations, or future leave |
Why this matters for policy design: A best-practice harassment policy names the 17 protected grounds explicitly. This ensures workers can identify Code-based harassment and report it through the appropriate channel, and it signals the employer’s commitment to the full legal framework rather than a minimalist OHSA-only approach.
Workplace Sexual Harassment: Heightened Obligations
OHSA defines “workplace sexual harassment” separately, and for good reason: it includes conduct that a single incident can trigger, and it carries elevated risk of HRTO awards.
Under OHSA s.1(1), “workplace sexual harassment” means:
- Engaging in a course of vexatious comment or conduct against a worker in a workplace because of sex, sexual orientation, gender identity, or gender expression, where the course of comment or conduct is known or ought reasonably to be known to be unwelcome; OR
- Making a sexual solicitation or advance where the person making it is in a position to confer, grant, or deny a benefit or advancement to the worker, and the person knows or ought reasonably to know that the solicitation or advance is unwelcome.
The second limb — sometimes called “quid pro quo” sexual harassment — can be a single incident. A manager’s single sexual advance on a subordinate satisfies the definition even without a prior pattern.
Employer obligations specific to sexual harassment:
- Must investigate all complaints of sexual harassment — no discretion on whether to investigate
- Should have a designated reporting channel separate from the complainant’s chain of command (critical where the harasser is the supervisor)
- HRTO awards for sexual harassment are typically at the high end of the damage range — $50,000 to $150,000 and above in serious cases
Investigation Obligations
OHSA s.32.0.7 requires employers to investigate all incidents and complaints of workplace harassment. The standard is that the investigation must be “appropriate in the circumstances.” This means the depth, formality, and process will vary by complexity — but an investigation must occur.
| Complaint Type | Appropriate Investigation Level | Who Should Investigate |
|---|---|---|
| Low severity (single misunderstanding, readily resolved) | Informal: document conversation, resolution agreement | HR or direct manager (where not implicated) |
| Moderate (repeated conduct, one party unwilling to resolve informally) | Formal: written interviews, evidence review, written findings | HR Manager or neutral third-party HR consultant |
| High severity (sexual harassment, senior employee implicated, allegations of violence) | Formal: structured witness interviews, evidence preservation, written investigation report | External HR investigator or employment lawyer |
| Senior leadership implicated (CEO, owner, director) | Formal: independent external investigator with Board or ownership oversight | External investigator only — significant conflict exists for internal HR |
Key Investigation Obligations
- Confidentiality: The investigation and its findings must be kept confidential, subject only to exceptions necessary to conduct the investigation, take corrective action, or comply with a legal requirement
- Communication of results: Both the worker who made the complaint AND the alleged harasser (if a worker at the organization) must be informed of the investigation results in writing and of any corrective action taken or to be taken
- Timeliness: OHSA does not specify a deadline, but delays undermine credibility. Best practice is 30 to 45 business days for a standard investigation; complex matters may take longer with transparent communication
- No “informal resolution only” policy: Employers cannot have a policy that attempts to resolve all harassment complaints informally without an investigation. If a formal complaint is made, a formal investigation is required
Annual Review and Posting Requirements
Under OHSA, both the harassment policy and the harassment program must be reviewed at least once a year. This is not a discretionary best practice — it is a legal requirement.
What the review should cover:
- Any legislative changes in the prior 12 months (Bill 190 changes, regulation amendments)
- Incidents and patterns from the prior year that suggest program gaps
- Whether the reporting mechanisms are accessible and actually being used
- JHSC or health and safety representative input (required where applicable)
- Update of named contact roles if personnel have changed
Posting requirement: The harassment policy must be posted in a conspicuous place in the workplace where it is likely to come to the attention of workers. For remote or hybrid workforces, “conspicuous” means accessible via your intranet or HRIS — a document buried in a shared drive folder does not satisfy this requirement. Best practice is to send a policy acknowledgment to all workers at each annual review, with a signed acknowledgment on file.
Third-Party and Customer Harassment
OHSA harassment obligations are not limited to worker-on-worker harassment. Employers have an obligation to address harassment by:
- Customers and clients
- Contractors and vendors
- Members of the public interacting with workers
This is “Type 2” harassment in the workplace violence/harassment classification. An employer who knows or ought to know that workers face harassment from customers — and takes no action — can be found to have failed in its OHSA duty of care.
Practical measures for third-party harassment:
- Written procedures for workers to report client or customer harassment
- Authority for workers to end client interactions where harassment occurs (e.g., end a phone call, leave a client site)
- Management response process including escalation, client warnings, and client termination where warranted
- Zero tolerance messaging to clients in service agreements where appropriate
Penalties for Non-Compliance
| Violation | Enforcement Body | Maximum Penalty |
|---|---|---|
| No harassment policy or program | Ministry of Labour | $100,000 per individual; $1.5M per corporation; directors/officers personally liable |
| Failure to investigate | Ministry of Labour / HRTO | Ministry order to investigate + fines; HRTO compensatory damages |
| Code-based harassment (discrimination/harassment on protected grounds) | HRTO | $25,000–$150,000+ general damages; lost income; reinstatement; public interest remedies |
| Reprisal for reporting harassment | OHSA (OLRB) / HRTO | OHSA reprisal: reinstatement + lost wages; HRTO: damages + remedial orders |
Beyond fines, the reputational consequences of a public HRTO decision are increasingly significant. HRTO decisions are publicly accessible and indexed by search engines. A finding of harassment or reprisal is a permanent public record.
9 Common Mistakes Ontario Employers Make
| # | Mistake | Risk Level | What to Do Instead |
|---|---|---|---|
| 1 | Having a policy but no program — treating the policy as the complete compliance document | High | Create a separate harassment program with all five required elements under OHSA s.32.0.2 |
| 2 | No alternate reporting channel — requiring all complaints to go to the direct supervisor | High | Name an alternate contact (HR, senior manager, owner) for situations where the supervisor is the alleged harasser |
| 3 | Policy not updated after Bill 190 (2024) — digital harassment not covered | Medium-High | Explicitly add electronic means (email, text, social media, chat platforms) to the harassment definition in your policy |
| 4 | No annual review documented — policy last revised three or more years ago | Medium | Set a calendar reminder for the same date each year; document the review with sign-off from senior management |
| 5 | Promising complete confidentiality — investigators tell complainants nothing will be shared | High | Disclose to all workers that confidentiality applies “to the extent reasonably possible” — not absolutely — as OHSA requires communicating results to both parties |
| 6 | Manager investigating their own team — the respondent’s supervisor leads the investigation | High | Appoint an impartial investigator; where internal HR has a conflict, engage external HR counsel or a workplace investigator |
| 7 | No policy for remote/hybrid workers — policy only addresses in-person workplace | Medium | Update policy to explicitly cover remote work environments, home offices, and virtual communication platforms |
| 8 | Conflating harassment with conflict — treating every interpersonal dispute as a harassment complaint | Medium | Train HR and managers on the difference: harassment requires vexatious conduct known to be unwelcome; a personality clash is managed differently |
| 9 | No follow-up after investigation — findings communicated but corrective action never implemented | High | Document corrective action, set implementation timelines, and schedule follow-up with both parties within 30 days of investigation conclusion |
Frequently Asked Questions
Is a workplace harassment policy required for all Ontario employers?
Yes. Under OHSA s.32.0.1, every Ontario employer — regardless of size, industry, or number of employees — must have a written workplace harassment policy. There is no minimum employee threshold. Even a single-employee business is legally required to maintain a written harassment policy and program.
What is the difference between a harassment policy and a harassment program in Ontario?
The policy is a written statement of commitment — it declares that the employer will not tolerate harassment and will investigate complaints. The program is the operational mechanism: it specifies how workers report harassment, how the employer will investigate, how confidentiality is maintained, and how results will be communicated to the parties. Both are required under OHSA and both must be reviewed annually.
Does digital harassment count as workplace harassment in Ontario?
Yes, since Bill 190 (Working for Workers Five Act, 2024) came into force, the OHSA definition of workplace harassment explicitly includes conduct carried out by electronic means. This covers harassment via email, text message, social media, and any other electronic communication platform — even if the communication occurs outside of work hours or on personal devices, as long as it affects the workplace.
Does an Ontario employer have to investigate every harassment complaint?
Yes. OHSA s.32.0.7 requires employers to investigate all incidents and complaints of workplace harassment. The standard is “appropriate in the circumstances,” which means the depth and formality of the investigation should match the severity and complexity of the complaint — but an investigation must occur. Employers cannot resolve harassment complaints solely through informal mediation without any investigative process.
What are the penalties for not having a workplace harassment policy in Ontario?
Under OHSA, failing to have a compliant harassment policy or program can result in fines of up to $100,000 for individuals (including managers and supervisors) and up to $1.5 million for corporations. Directors and officers can be held personally liable. Beyond OHSA penalties, failing to properly address harassment can result in HRTO awards ranging from $25,000 to over $150,000 in general damages.
How often must an Ontario employer review its harassment policy?
Both the workplace harassment policy and the harassment program must be reviewed at least once a year under OHSA. The review must be documented and any changes must be incorporated. Where a JHSC or health and safety representative exists, they must be consulted. The updated policy must be re-posted in the workplace (or re-distributed electronically for remote workers).
How HRXconnect Can Help
Drafting or auditing a workplace harassment policy and program is not a one-time exercise. It requires ongoing review, training, and an investigation capability — all of which small and mid-sized Ontario employers often lack internally.
HRXconnect provides Ontario employers with compliant harassment policies, harassment programs, investigation support, and annual review services. Our team of CHRP-certified HR professionals understands Ontario’s OHSA framework and Human Rights Code obligations in depth.
Contact us to discuss your workplace harassment compliance needs, or learn more about our HR consulting services and fractional HR support for Ontario businesses.
External references: