Third-party harassment at work: what UK employers need to do

A customer makes sexual comments to a receptionist. A patient threatens a care worker. A client repeatedly sends offensive messages to a member of a project team. These situations can put employers under pressure to protect staff while maintaining important business relationships.

From 30 October 2026, the Employment Rights Act 2025 will make employers liable if they permit a third party to harass an employee in the course of their employment because they have failed to take all reasonable steps to prevent it. The change makes it important to understand where these risks arise and what managers should do when they do.

Who counts as a third party?

A third party is someone other than the employer or its employee who a worker encounters through work. Depending on the organisation, this could include customers, clients, patients, service users, contractors, suppliers, people at events or members of the public. Harassment may happen in person or online.

The preventive duty already requires employers to take reasonable steps to prevent sexual harassment, including considering third-party risks. From 30 October, that becomes all reasonable steps. The new provision also makes an employer liable for third-party harassment in the course of employment if the employer failed to take all reasonable steps to prevent it.

Under the Equality Act 2010, harassment generally means unwanted conduct related to a protected characteristic, or unwanted conduct of a sexual nature, that has the purpose or effect of violating dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment. Not every rude interaction meets that legal test. Your policy can still prohibit broader abusive conduct, and threats or unsafe behaviour may need a separate health and safety response. The new Employment Rights Act changes apply in Great Britain; Northern Ireland has separate employment and equality legislation, so check the rules for your workplace.

What should employers do before 30 October?

1. Map the exposure. Identify roles and locations where staff deal with the public, clients, patients, contractors or suppliers. Consider lone working, travel, events, online contact and any previous incidents.
2. Assess the risks and act on them. Consider how likely harassment is, who may be affected and what practical controls are available. Depending on the work, this could include staffing arrangements, security, safe ways to end an interaction or escalation to a supervisor.
3. Make reporting straightforward. Explain who staff can tell, how to report an incident and what support is available. Provide an alternative contact if the usual manager is involved or unavailable.
4. Train managers and front-line teams. Use realistic scenarios to practise responding, recording what happened, supporting the worker and deciding when to challenge or end contact with a third party.
5. Review policies and business relationships. Make sure harassment procedures cover third parties and consider whether client, supplier or venue arrangements need clear conduct expectations and escalation routes.
6. Keep records and review incidents. Record reports, risk assessments, decisions and follow-up. Look for patterns by role, location, customer or time of day and update controls when the evidence changes.

What does ‘all reasonable steps’ mean?

There is no single checklist that suits every employer. Acas says relevant steps are likely to depend on factors such as the organisation’s size, sector and the work employees do. Its examples include regular risk assessment, monitoring incidents, a suitable policy, staff training and reviewing relevant contracts or terms. The employer should be able to explain why its steps fit the risks it faces.

A policy on its own is unlikely to be enough if managers ignore reports or known risks. Put the procedure into practice, act on concerns consistently and check whether the steps are working. The law also gives the government power to set out specified evidence-based steps in future regulations, so employers should keep implementation guidance under review.

How should a manager respond to a report?

• Listen, take the report seriously and check immediate safety needs.
• Ask what support the employee wants and explain the available options.
• Record the facts promptly, including any witnesses or digital evidence.
• Take proportionate steps to stop repeat contact or reduce further risk.
• Follow up with the employee and review whether additional controls are needed.

Do not assume that a worker must tolerate harassment because the person responsible is a customer or important client. Decisions should prioritise staff safety and be consistent with the organisation’s policy and legal duties.

A practical preparation checklist

• Complete and document a third-party harassment risk assessment.
• Update reporting routes, policies and manager guidance.
• Train staff who handle public, customer or client contact.
• Set clear incident recording and escalation responsibilities.
• Review known risks and incident patterns on a regular schedule.

Read the latest Acas guidance on third-party harassment and the government’s Employment Rights Act implementation timeline. Need help reviewing a policy, manager process or workplace risk assessment? Talk to our HR team using the consultation form below.