Most employers understand their responsibility to prevent and respond to harassment in the workplace. But what happens when the person responsible for the behaviour is not an employee?
From 30 October 2026, new measures under the Employment Rights Act 2025 will strengthen harassment protections in Great Britain. Employers will have an obligation not to permit their employees to be harassed by third parties, such as customers, clients, contractors or members of the public, where the employer has failed to take all reasonable steps to prevent the harassment.
At the same time, the existing preventative duty around sexual harassment will be strengthened. Employers will be required to take all reasonable steps, rather than simply reasonable steps, to prevent sexual harassment of employees.
For businesses with customer-facing teams or employees who regularly interact with people outside the organisation, these changes make it important to review existing policies, risk assessments, reporting procedures and training before the new requirements take effect.
In this guide, we’ll explain what is changing, what third-party harassment means in practice and the practical steps employers can take now to strengthen their approach.
What Is Changing in October 2026?
The Employment Rights Act 2025 introduces two important changes to harassment protections.
First, the existing preventative duty for sexual harassment will be strengthened from a duty to take reasonable steps to a duty to take all reasonable steps to prevent sexual harassment of employees.
Second, employers will have a new obligation not to permit third parties to harass their employees. The legislation provides that an employer will be considered to have permitted the harassment where the third party harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it.
The third-party provision is broader than sexual harassment. It covers the three forms of harassment set out in section 26 of the Equality Act 2010, including harassment related to relevant protected characteristics, sexual harassment and less favourable treatment because someone rejected or submitted to sexual harassment.
For employers, this means looking beyond relationships between colleagues and considering the risks employees may face when dealing with people outside the organisation.
Businesses should consider:
- Where employees regularly interact with customers, clients, contractors or members of the public.
- Which roles or working environments create a higher risk of harassment.
- Whether existing harassment policies cover third-party behaviour.
- How employees can report concerns about someone outside the organisation.
- Whether managers know how to respond and escalate complaints.
- What preventative measures are appropriate for the risks identified.
The changes apply to England, Scotland and Wales. They do not apply to Northern Ireland, where employment and equality law operate under a separate legal framework.
What Is Third-Party Harassment?
Third-party harassment is harassment of an employee by someone who is not their employer or fellow employee but who they encounter through their work.
Depending on the business, a third party could include:
- Customers and clients.
- Contractors and suppliers.
- Patients and service users.
- Visitors.
- Members of the public.
For example, a customer might make sexually inappropriate comments to a retail employee, a client might make racist remarks during a meeting, or a member of the public might repeatedly make offensive comments towards an employee carrying out their duties.
Not every rude, unpleasant or difficult interaction will meet the legal definition of harassment. Under the Equality Act 2010, harassment involves unwanted conduct related to a relevant protected characteristic, sexual harassment, or certain unwanted conduct of a sexual nature, depending on the circumstances.
The important point for employers is that the person responsible does not need to work for the business. The new legislation specifically addresses situations where employees experience harassment from third parties in the course of their employment.
Which Businesses Are Most Likely to Face Third-Party Harassment Risks?
Any organisation can face third-party harassment risks, but the level of exposure will vary depending on how employees work and who they interact with.
The issue is particularly relevant to businesses where employees regularly deal with customers, patients, service users, visitors or members of the public, including:
- Retail and hospitality.
- Healthcare and social care.
- Education.
- Transport and security.
- Construction and facilities management.
- Professional services.
- Events and entertainment.
Risk is not limited to traditional customer-facing roles. Employees visiting client premises, attending events, travelling for work or working alongside external contractors may also encounter third-party harassment.
Employers should therefore assess the actual working environment rather than assuming that third-party harassment is only a concern for front-line employees.
What Does “All Reasonable Steps” Mean?
There is no single checklist that will be appropriate for every employer. What amounts to all reasonable steps will depend on the circumstances, the risks employees face and the measures that are reasonably available to the organisation.
The Employment Rights Act 2025 also gives the Government power to specify steps that employers will need to consider when meeting the preventative duty relating to sexual harassment. Further regulations and guidance are expected to provide more detail.
In practical terms, employers should consider measures such as:
- Identifying roles and situations where employees face greater exposure to third parties.
- Carrying out appropriate harassment risk assessments.
- Providing relevant training to managers and employees.
- Establishing clear reporting and escalation procedures.
- Setting expectations for acceptable behaviour from customers, clients and contractors.
- Reviewing previous incidents to identify recurring risks.
- Taking action when known risks are identified.
The key is not simply having policies in place. Employers should be able to demonstrate that they have considered the risks within their organisation and taken appropriate steps to address them.
Start With a Third-Party Harassment Risk Assessment
Before updating policies or arranging training, employers should understand where third-party harassment risks actually exist within their organisation.
A practical risk assessment can help identify the roles, locations and situations where employees may be particularly exposed.
Consider questions such as:
- Which employees have regular contact with customers, clients or service users?
- Do employees work alone, at night or away from company premises?
- Are alcohol, large groups or public events part of the working environment?
- Have employees previously reported inappropriate behaviour?
- Are there particular customers, clients or service users who have previously caused concerns?
- Can employees quickly access support if an incident occurs?
- Are managers clear about what action they can take?
Previous incidents are particularly important. If an employer is aware of a recurring problem but does nothing to address it, that history may be relevant when assessing whether reasonable preventative measures were taken.
The purpose of a risk assessment is not to predict every possible incident. It is to identify foreseeable risks and put proportionate safeguards in place.
Does Your Harassment Policy Cover Third Parties?
Many employers already have bullying, harassment or dignity-at-work policies. However, these policies may focus primarily on behaviour between employees.
Employers should review whether their policies clearly explain what happens when the person responsible is a customer, client, contractor or other third party.
Employees should understand:
- That third-party harassment is taken seriously.
- How and where to report an incident.
- Who will deal with their complaint.
- What happens after a concern is reported.
- What action the organisation may be able to take against the third party.
- How incidents will be recorded and followed up.
- Where employees can obtain support.
Employers do not necessarily need a separate third-party harassment policy. An existing harassment or dignity-at-work policy may be sufficient if it clearly addresses third-party situations and provides managers with a practical process to follow.
What if the third party is an important customer?
This is an area where businesses can face a particularly difficult commercial decision.
Employees need to know that their concerns will be taken seriously even where the person involved is a major customer or client. Commercial considerations should not result in inappropriate behaviour being ignored or an employee being expected to tolerate harassment to protect a business relationship.
Clear escalation procedures can help managers deal with these situations consistently rather than making decisions on an ad hoc basis.
Are Your Managers and Employees Prepared?
A policy is only effective if employees and managers understand how to use it.
Managers should know how to recognise potential harassment, respond appropriately when concerns are raised and escalate matters when necessary.
Training should cover:
- How to recognise and report harassment.
- How managers should respond to complaints.
- When an employee may need immediate support or protection.
- How incidents should be recorded.
- When matters should be escalated to HR.
- What action may be appropriate when the alleged harasser is a third party.
Customer-facing employees should also understand what behaviour they are not expected to tolerate and how they can access support.
Training should reflect the actual risks within the organisation rather than being treated as a generic compliance exercise.
What Can Employers Do About Customers, Clients and Contractors?
Employers cannot control every person their employees encounter. However, they can establish clear standards of acceptable behaviour and put procedures in place for responding when those standards are breached.
Depending on the organisation, measures could include:
- Customer or visitor codes of conduct.
- Behaviour clauses in client or contractor agreements.
- Warning and escalation procedures.
- Restrictions on contact with particular individuals.
- Removing individuals from the workplace where appropriate.
- Refusing service where appropriate.
- Giving employees clear authority to seek assistance or leave a situation where they feel at risk.
The appropriate response will depend on the circumstances and the nature of the organisation.
A consultancy may address unacceptable behaviour through client agreements and account-management procedures, while a hotel or retailer may need clear instructions that employees can follow immediately when dealing with an abusive customer.
The important thing is to have a response framework in place before an incident occurs.
What Should Happen When an Employee Reports Third-Party Harassment?
Preventative measures will not eliminate every incident. Employers also need a clear process for responding when an employee raises a concern.
Managers should:
- Take the concern seriously.
- Record the relevant details of the incident.
- Consider whether the employee needs immediate support or protection.
- Escalate the matter appropriately.
- Investigate where appropriate.
- Consider what action can reasonably be taken against the third party.
- Keep appropriate records of the action taken.
The response will depend on the circumstances. It might involve warning a customer, raising concerns with a client or contractor, restricting contact, changing working arrangements or refusing further service.
Employers should avoid dismissing the behaviour simply because the person responsible does not work for the organisation.
What Are the Risks of Getting It Wrong?
Failing to take appropriate preventative action can expose employers to legal and practical risks.
These may include:
- Employment Tribunal claims.
- Compensation and associated legal costs.
- Increased employee relations problems.
- Reputational damage.
- Employee turnover and reduced morale.
- Disruption to customer or client relationships.
- Greater scrutiny of workplace harassment procedures.
The risk is not simply about having the right policy wording. Employers should consider whether their policies are implemented in practice and whether managers and employees know what to do when concerns arise.
A documented approach to identifying risks, preventing harassment and responding to incidents can put employers in a much stronger position.
Common Mistakes Employers Should Avoid
Preparing for the October 2026 changes is not simply a matter of adding a paragraph to an existing policy.
Common gaps include:
Assuming the existing harassment policy is enough
A policy that only addresses behaviour between employees may not provide enough guidance for third-party incidents.
Waiting for a complaint before addressing risks
Employers should identify foreseeable risks and take appropriate preventative measures rather than relying entirely on reactive processes.
Protecting the customer relationship at the employee’s expense
Commercial importance should not result in legitimate harassment concerns being minimised or ignored.
Training HR but not managers
Managers and employees who deal directly with customers, clients and service users need to understand how to recognise, report and respond to harassment.
Ignoring previous incidents
Repeated complaints involving the same person, location or situation can indicate a recurring risk that needs to be addressed.
Failing to document action taken
Employers should maintain appropriate records of complaints, investigations, preventative measures and actions taken. Good record-keeping can also help identify patterns and inform future risk assessments.
Is Your Business Ready for October 2026?
The changes take effect from 30 October 2026, but employers should not wait until October to start preparing.
Use the following checklist to review your current approach:
- Have you identified roles with regular third-party contact?
- Have you reviewed previous harassment complaints or incidents?
- Does your harassment policy clearly cover third parties?
- Do employees know how to report concerns?
- Do managers know how to respond and escalate complaints?
- Have you considered appropriate standards of behaviour for customers, clients and contractors?
- Have you assessed higher-risk working environments?
- Do you have appropriate reporting and escalation procedures?
- Are incidents and actions appropriately documented?
- Does your manager and employee training address harassment prevention?
- Do you have a process for reviewing your approach when new risks or incidents emerge?
If several of these questions cannot be answered confidently, now is a good time to review your policies and procedures.
How HR Team Can Help
The October 2026 changes give employers an important opportunity to review how they prevent and manage harassment involving people outside their organisation.
HR Team can support your business with:
- Reviewing harassment and dignity-at-work policies.
- Assessing third-party harassment risks.
- Identifying gaps in HR procedures.
- Developing reporting and escalation processes.
- Supporting managers with practical guidance.
- Providing harassment prevention training.
- Reviewing HR processes in preparation for upcoming employment law changes.
Taking action before the new requirements take effect gives your business time to identify risks, strengthen procedures and ensure managers and employees understand their responsibilities.
Need help preparing for the October 2026 changes? Contact HR Team to review your policies, procedures and training and make sure your business is prepared.
Frequently Asked Questions
What is third-party harassment?
Third-party harassment occurs when an employee is harassed by someone who is not their employer or fellow employee but who they encounter through their work. Examples can include customers, clients, contractors, suppliers, patients, service users, visitors and members of the public.
When do the new third-party harassment protections come into force?
The new third-party harassment provisions are due to come into force from 30 October 2026 in England, Scotland and Wales.
Does third-party harassment only apply to sexual harassment?
No. The new third-party harassment provision covers the three forms of harassment set out in section 26 of the Equality Act 2010, including harassment related to relevant protected characteristics and sexual harassment.
Can an employer be responsible for harassment by a customer?
The new legislation places an obligation on employers not to permit third parties to harass employees. An employer will be considered to have permitted the harassment where the third party harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it.
Do we need a separate third-party harassment policy?
Not necessarily. An existing bullying, harassment or dignity-at-work policy may be sufficient, provided it clearly addresses third-party behaviour, reporting procedures, management responsibilities and the steps the organisation may take in response.
What should employers do before October 2026?
Employers should review their existing harassment policies, assess third-party risks, review previous incidents, establish clear reporting and escalation procedures, and ensure managers and employees receive appropriate training.
Does this new duty apply to Northern Ireland?
No. The October 2026 measures discussed in this article apply to England, Scotland and Wales. Northern Ireland has a separate employment and equality law framework, so employers operating across both jurisdictions should consider their obligations separately.
