Labor law update
Law 2365 of 2024: the workplace sexual harassment protocol, two years on
Law 2365 of 2024 requires every employer in Colombia to adopt a protocol to prevent sexual harassment at work. The obligation has been enforceable since the law took effect, with no transition period. Two years later, the State remains overdue on the cross-government plan the same law ordered it to issue, and the law is explicit that the State’s delay does not excuse the employer from its own obligation.
Schedule a consultationIn force from day one, even though the State has not done its part
Law 2365 gave employers no transition period to adopt the protocol: the obligation arises with the law itself. Colombia’s Procuraduria General de la Nacion and Constitutional Court have documented that the Ministry of Labor is more than fifteen months overdue in issuing the cross-government prevention plan the law assigned to it. The law itself states that the State’s delay in issuing its own regulations does not suspend or excuse the employer’s obligation to have its protocol ready. This is the point most companies miss: they wait for a decree to fill in the detail before acting, and the law already requires them to have acted.
What the law does require, and what it is distinct from
Law 2365 has a precise scope: sexual harassment in the workplace. It is not the same law that governs workplace harassment in general.
The law’s scope: sexual harassment, not workplace harassment
Law 1010 of 2006 governs workplace harassment: persistent conduct of hostility, mistreatment, or exclusion intended to instill fear or push someone to resign, with no sexual component. Law 2365 of 2024 governs a different conduct: sexual harassment, meaning unwanted requests or conduct of a sexual nature within an employment relationship. A protocol written to satisfy Law 2365 does not replace the mechanism required by Law 1010, and the reverse is also true: a company needs both, each with its own scope, and merging them into a single document is the first mistake that undermines both.
The core obligation: the protocol must exist and be implemented
The law requires the employer to adopt a sexual harassment prevention protocol and put it into practice, not merely draft it and file it away. It must be known to employees, provide a channel to receive complaints, and connect with the company’s other occupational health and safety obligations. The law does not distinguish by company size: the duty to have the protocol applies to every employer, without the size threshold that does apply to other labor law figures.
What the law leaves open, and the risk of copying someone else’s model
Law 2365 creates the obligation but leaves the operational detail open. That is why so much of the material published online offers such different versions of the same protocol.
The law does not set a mandatory minimum content for the protocol, does not require a set number of stages for the internal investigation, and does not require creating a specific committee to handle it. A company that adopts, unchanged, a model published by a trade association or an insurer may end up with clauses that do not fit its own structure, or missing a point its own sector actually needs.
A draft decree is under consideration that proposes a detailed eleven-stage procedure for investigating sexual harassment cases internally. That draft is not current law: it may be changed before being issued, or never issued in the form proposed. A company may treat it as a reference for good practice, never as an obligation enforceable today.
The Law 2365 protocol does not stand alone: it is incorporated into the company’s internal work regulations, the same document that Law 2466 of 2025 also requires companies to update. A company already reviewing its internal work regulations for Law 2466 has the natural moment to incorporate the Law 2365 protocol too, instead of treating them as two separate procedures.
Two years in force without complete State regulations do not shrink the employer’s obligation: they shrink it down to whatever the company itself decides to document and put into practice. The protocol that actually holds up under inspection is not the one closest to a model downloaded from the internet. It is the one that answers, in writing, what happens the first day someone files a complaint.