Third-party harassment: what employers must do from 30 October 2026

Third-party harassment is harassment of your employees by people you don’t employ, such as customers, clients, patients, contractors or members of the public. From 30 October 2026, the Employment Rights Act 2025 makes employers liable for it unless they took all reasonable steps to prevent it. One incident is enough.

Harassment from the public isn’t new for customer-facing teams. What’s changed is the legal test. This guide covers the law, sector examples and a practical checklist. For the wider picture, start with our guide to sexual harassment at work.

In this article:

• What is third-party harassment?
• What does UK law say about third-party harassment from 30 October 2026?
• What does third-party harassment look like in different sectors?
• What are all reasonable steps to prevent third-party harassment?
• What should you do if a customer harasses an employee?
• What are the limits of an employer’s duty?
• FAQs

What is third-party harassment?

Third-party harassment is harassment of an employee, in the course of their work, by someone who is neither the employer nor one of its employees. Section 21 of the Employment Rights Act 2025 defines a third party as any person other than the employer or an employee of the employer. That includes:

• Customers, guests and diners
• Clients and their staff
• Patients, residents, service users and their relatives
• Pupils, students and parents
• Contractors and suppliers’ staff
• Visitors, tenants and members of the public

Harassment has the same meaning as in section 26 of the Equality Act 2010: unwanted conduct related to a relevant protected characteristic, or of a sexual nature. It must have the purpose or effect of violating someone’s dignity, or creating an intimidating, hostile, degrading, humiliating or offensive environment for them.

What does UK law say about third-party harassment from 30 October 2026?

From 30 October 2026, employers must not permit a third party to harass their employees. Section 21 inserts this duty into section 40 of the Equality Act 2010. An employer is liable if both of these are true:

• The third party harassed the employee in the course of their employment
• The employer failed to take all reasonable steps to prevent it

There’s no need for a previous incident. A first incident can create liability, so you can’t wait for a pattern before you act.

The duty covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. Pregnancy and maternity, and marriage and civil partnership, aren’t covered by the Equality Act’s harassment provisions. The duty applies in England, Wales and Scotland, not Northern Ireland, according to government guidance for employers.

This isn’t new. The original Equality Act 2010 made employers liable only after they knew of two previous incidents. This ‘three strikes rule’ was repealed in 2013 by the Enterprise and Regulatory Reform Act. Then the Worker Protection (Amendment of Equality Act 2010) Act 2023 (WPA) came into force in 2023. The WPA didn't resurrect a standalone right to sue for third-party harassment, but it did introduce a new proactive duty for employers to take reasonable steps to protect employees, and the EHRC updated its technical guidance to support this.

If a third-party sexual harassment claim succeeds, the tribunal must consider whether you breached the preventative duty in section 40A. Where you did, it can increase compensation by up to 25%.

What does third-party harassment look like in different sectors?

Third-party harassment looks different in every sector, but risk tends to rise with lone working, late shifts, alcohol and distress. Use these scenarios to start your own sexual harassment risk assessment.

The same applies to anyone whose job puts them in front of the public.

What are all reasonable steps to prevent third-party harassment?

‘All reasonable steps’ means you did everything you reasonably could to prevent the harassment, leaving nothing further you could reasonably have done. There’s no fixed list yet. Section 22 lets the government set out steps for preventing sexual harassment, but regulations aren’t expected before 2027.

Until then, the EHRC’s eight-step guide is the practical standard. Step seven covers harassment by third parties. Acas also sets out steps for employers. This checklist turns that guidance into actions:

1. Risk assess customer-facing roles. Map where staff meet third parties, when and in what conditions: lone working, night shifts, alcohol, home visits and past incidents. Our risk assessment guide shows how.

2. Publish a customer code of conduct. Tell customers and service users what behaviour you won’t accept and what happens if they cross the line. Use signage, your website and booking confirmations.

3. Put conduct terms in contracts. Where staff work with clients or on their premises, require respectful behaviour and keep the right to withdraw your staff.

4. Update your policy wording. Name third parties, cover all relevant protected characteristics and explain what happens when the harasser is a customer. Our sexual harassment policy guide includes wording to adapt.

5. Agree reporting routes and a response protocol. Offer more than one way to report, including anonymously. Write down who acts, how quickly and with what powers (including refusing service, ending calls, removing people and banning them).

6. Plan staffing, lone working and rotas. Avoid leaving people alone in high-risk settings. Pair staff for known risks, use check-ins for field staff and move people away from customers who’ve targeted them.

7. Train customer-facing staff and managers. Staff need to recognise harassment, know they needn’t tolerate it, and know how to report it. Managers need the confidence to challenge customers. See our guide to sexual harassment prevention training, and add a bullying and harassment course to your LMS because every relevant protected characteristic is covered.

8. Support affected staff. Check in quickly, offer time out and counselling, and adjust duties if they want. Don’t make them fix the problem.

9. Keep records and monitor. Log every incident, even when the employee doesn’t want formal action. Look for patterns, update your risk assessment and keep evidence of what you did.

Training alone won’t meet the standard, but it’s hard to show all reasonable steps without it. Ciphr’s 20-minute sexual harassment course covers the 30 October 2026 change, including a third-party harassment scenario.

What should you do if a customer harasses an employee?

If a customer harasses an employee, make the employee safe first, then deal with the customer. Record what happened and review your controls:

a) Make the employee safe. Remove them from the situation or end the call. Don’t ask them to keep serving the person

b) Deal with the third party. Warn them, refuse service, ask them to leave or involve security. Call the police if there’s a crime or a threat to safety

c) Listen and support. Speak to the employee privately, take their account seriously and offer support

d) Record the incident. Note what happened, when, who was involved, any witnesses or recordings, and what you did

e) Follow up. Consider a ban, a warning letter, or raising it with the client or contractor’s employer

f) Review your controls. Ask whether a gap in your risk assessment, rota, contracts or training allowed it, and fix it

g) Keep the employee informed. Tell them what you’ve done and check in again later

Since 6 April 2026, reporting sexual harassment has been a protected disclosure under section 23. Make sure nobody is treated badly for raising a concern.

What are the limits of an employer’s duty?

The duty is demanding, but it isn’t unlimited. The government said the steps employers can take regarding third parties “will be more limited than in respect of their employees”, Farrer & Co reports. It also said employers won’t be penalised for unworkable or impractical steps.

• Freedom of expression. The government said the provision already protects freedom of expression, and tribunals already weigh competing rights. Context will matter

• Overheard conversations. The government declined to exempt opinions staff overhear. A conversation between customers could still amount to harassment of an employee who hears it

Tribunals will look at what you did before the incident took place, so act now. For all the ERA changes, see our Employment Rights Act 2025 guide.

Give customer-facing teams the knowledge to recognise and report harassment, and managers the confidence to act on it.

FAQs: third party harassment

This article is not legal advice. If you need legal advice, consult a qualified employment law expert.