A manager rings. Someone has complained about who they saw going into the women’s toilets. The manager wants to know what they are supposed to do — and underneath the question is an assumption that has hardened into common sense over the past year:
that failing to check is the thing that will get the organisation into trouble.
The EHRC’s Code of Practice for services, public functions and associations came into force on 5 August 2026, revoking the 2011 Code. And on this question it says close to the opposite of what most organisations have assumed.
What the Code actually says
Four paragraphs, in Chapter 13, under the heading Asking about sex.
13.160 — there are limited circumstances in which asking an individual about a protected characteristic in the provision of services may be warranted.
13.161 — information about a person’s sex is personal data, and may be protected under Article 8 of the European Convention on Human Rights. Some people, “including some trans or gender non-conforming people, may wish to keep such information private as far as possible and may find it distressing to be asked about their sex.”
13.162 — the one nobody quotes:
To comply with Article 8 of the ECHR, a service provider must be able to objectively justify asking an individual about their sex. A request for information about sex should only be made where it is a proportionate means of achieving a legitimate aim. Furthermore, a request for information about sex which is not a proportionate means of achieving a legitimate aim could also amount to unlawful indirect gender reassignment discrimination.
13.163 — legitimate aims include diversity monitoring, operational reasons, and lawful single- or separate-sex provision under the Equality Act 2010.
The risk runs the other way
Read those together and the position is not ambiguous. Asking is the act that requires justification. The default is not asking. And an unjustified question is not a neutral fallback — it is a route to a discrimination claim, brought by the person who was asked.
For an organisation that wants to be inclusive and has been quietly worried that its instinct not to interrogate people is a risk it is carrying: it isn’t. Under 13.162 it is the safer position, and the Code says so.
Two things follow that are worth saying to a nervous manager directly.
A complaint does not create a duty to interrogate. It creates a duty to consider whether asking is objectively justified on these facts. In a corridor, in response to a complaint about someone’s appearance, it very rarely will be.
The justification has to exist before the question is asked. “We asked because someone complained” is not a legitimate aim. It is a description of the trigger, not a justification of the intrusion.
What the Code does not say
It does not say you may never ask. Lawful single- or separate-sex provision is expressly a legitimate aim under 13.163, and there are settings — some healthcare, some accommodation, some services with a genuine operational need — where a question about sex is both justified and appropriate.
The requirement is that you can articulate the aim, and show the question was a proportionate way of achieving it, before you ask. Organisations that have thought this through in advance, and written it down, are in a completely different position from those improvising at a doorway.
Who door-checking actually catches
There is no document people routinely carry that settles the question, and no reliable way to resolve it by looking. So a challenge at the door is, in practice, a challenge based on appearance.
The Government’s own equality impact assessment of the Code is blunt about where that lands:
Women who are considered masculine may face greater scrutiny about their sex as a result of the changes.
This is the part that gets missed. A door-checking culture does not reliably find the person whoever complained had in mind. It finds whoever looks unexpected — which includes a great many women who have never given their own sex a moment’s thought, and who will not enjoy being asked about it in front of a queue.
What to do instead
Deal with conduct, and leave identity alone.
- Establish what was done. Was there behaviour you would act on regardless of who was involved — filming, harassment, refusing to leave, damage?
- If yes, apply your ordinary standards of behaviour, exactly as you would to any customer or member of staff. Identity neither raises nor lowers the threshold.
- If no, there is nothing to action. Discomfort that someone was present is not, by itself, a breach of anything.
- Do not ask about sex, request proof, or debate the person’s identity — and do not escalate simply because an identity claim was made.
- Record what was done and what was decided, not what anyone believed about anybody. Complaint records are disclosable, and a note attributing conduct to someone’s identity is evidence of stereotyping in any claim that follows.
Most of what presents as a behaviour problem in facilities is a design problem. Clear single-sex provision alongside genuinely available self-contained options removes the need for anyone to be challenged at all — which is a far more reliable protection than a policy about who may ask what. Our toilets and signage playbook covers the design side, and the manager’s decision framework covers the moment a query arrives.
The line to take away
If you can objectively justify asking, in advance, proportionately — you may ask.
If you cannot, the Code’s answer is not to guess. It is not to ask.
This is a practical governance note, not legal advice. Contested matters or advice on a specific incident should go to a solicitor. Contains public sector information licensed under the Open Government Licence v3.0.