Yes: from 30 October 2026, third party harassment of your staff is your legal problem. If a customer, patient, supplier or visitor harasses one of your employees at work, you are liable unless you took all reasonable steps to prevent it. What protects you is what you did before the incident. How you respond afterwards becomes part of your defence next time.

These rules apply in England, Wales and Scotland. Northern Ireland has separate law.

If your people deal with the public, this is a real shift. Until now, an employee harassed by a customer had limited routes to a claim against you. From the end of October, a tribunal asks one question: what did you do to stop this happening?

I will cover what third party harassment is, what changed, who carries the most risk, and the steps that make up a defence.

What is third party harassment?

Third party harassment is harassment of your employee by someone who is not you and not another of your employees. That is how the law defines a third party: anyone other than the employer or one of its employees.

In practice, it means the people your staff serve, visit or work alongside without sharing an employer:

• customers and members of the public
• patients, care home residents and their families
• students and parents
• suppliers, contractors and delivery drivers
• visitors, guests and event attendees
• staff of a customer business when your people work on their site

Harassment has its legal meaning under section 26 of the Equality Act 2010. It is unwanted conduct related to a relevant protected characteristic (age, disability, gender reassignment, race, religion or belief, sex, or sexual orientation) that has the purpose or effect of violating the person's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment for them. It also includes unwanted conduct of a sexual nature.

So this is wider than sexual harassment. A customer who makes racist comments to a shop assistant, or a patient's relative who mocks a nurse's disability, is as much in scope as a customer who makes sexual remarks to a bar worker. And the comment does not have to be aimed at your employee. I once dealt with a homophobic remark made in a lift and overheard by a colleague it was never meant for. The investigation found it was harassment, because the law looks at the effect on the person who heard it. My guide to dignity at work training covers that story in full.

Third party harassment examples

These are the kinds of situations I see:

• A regular at a pub makes sexual comments to a young member of bar staff every Friday night. They laugh it off because they do not want to lose the shift.
• A care home resident's son makes remarks about a carer's accent and religion every time he visits.
• A manager at a customer business makes comments about one of your engineers' sexuality while they work on that customer's site.
• A supplier's delivery driver sends your receptionist unwanted messages after each drop-off.
• A patient at a dental practice keeps commenting on a nurse's body during appointments.

From 30 October 2026, the question in every one of these is the same. Did you take all reasonable steps to prevent it?

What changed, and when

The change comes from section 21 of the Employment Rights Act 2025 (the former Employment Rights Bill). It inserts new subsections into section 40 of the Equality Act 2010, and takes effect on 30 October 2026 under the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (S.I. 2026/1065).

The new wording says an employer must not permit a third party to harass an employee. An employer permits it only if the harassment happens in the course of the employee's employment and the employer failed to take all reasonable steps to prevent it.

The law has tried this before. The Equality Act 2010 once carried a narrow third party rule. It applied only once the employer knew the employee had already been harassed by a third party on at least two other occasions, and it was removed on 1 October 2013. The new rule has no such condition. One incident can found a claim if you had not done enough beforehand.

On the same day, section 20 of the 2025 Act raises the separate duty to prevent sexual harassment of employees from "reasonable steps" to "all reasonable steps". That duty applies whoever the harasser is, colleague or third party.

Why "all reasonable steps" is a high bar

The phrase is not new. It is the same wording as the defence employers have long had when one employee harasses another, in section 109(4) of the Equality Act 2010. Tribunals have applied it for years, and they set the bar high.

The case to know is Allay (UK) Ltd v Gehlen, decided by the Employment Appeal Tribunal in February 2021. The employer had given anti-harassment training, but some years earlier. The tribunal found the training had gone stale, and that refreshing it was a reasonable step the employer had not taken. The defence failed. The EAT agreed, and said brief and superficial training is unlikely to prevent harassment, while thorough training is more likely to work and to last.

Expect tribunals to bring the same thinking to third party harassment. A policy in a drawer and a training slide from three years ago is unlikely to be enough.

What the law does not yet say

The 2025 Act lets the government set out, in regulations, the steps that count as reasonable when preventing sexual harassment. Those steps may include risk assessments, policies, reporting arrangements and complaint handling. At the time of writing no such regulations have been made. Until they are, tribunals will judge each case on its facts, and the Equality and Human Rights Commission's technical guidance on sexual harassment and harassment at work is the most detailed reference point you have.

Which businesses are most exposed?

Every employer whose staff deal with outsiders is in scope. The risk rises with who your staff meet and how much control they have over the encounter.

In health and social care, patients, residents and their families are third parties. Staff often cannot walk away from a difficult patient, and some behaviour is linked to illness or capacity. That makes it harder to manage. It does not remove the duty.

In hospitality, leisure and retail, alcohol, late shifts, young staff on their first job and a "customer is always right" culture all push the risk up.

In education, students and parents are third parties.

In field and on-site work, your engineers, cleaners, installers and consultants are exposed to the customer's staff, with no manager of their own nearby.

And in any customer-facing service, think call centres, receptions, front desks and delivery roles.

Three risk factors cut across all of these. A young or junior workforce. Staff who fear that reporting will cost them shifts or tips. And roles where the employee cannot get away, like a nurse on a ward or a carer in someone's home. If any of those sound like your business, your steps need to be stronger.

How to prevent third party harassment: the employer's steps

No single list guarantees the defence. A tribunal looks at what you did, whether it was likely to work, and whether there was anything else you could reasonably have done. The steps below reflect the case law and the EHRC technical guidance. Together they form a defence you can show.

1. Assess the risk

Go through each customer-facing role. Where could harassment happen, who from, and what makes it more likely? Late finishes, lone working, alcohol, home visits and young staff all belong on the list. Write it down, decide what you will do about each risk, and review it at least once a year or after any incident.

2. Put it in your contracts

If you supply or serve other businesses, add a clause to your terms that names harassment of your staff. A general promise to "comply with the law" gives you nothing to point to. A specific clause lets you raise it with the customer business, and shows you thought about the risk before it arose.

3. Make your position visible

Third parties should know where you stand before anything happens. A short notice at reception, on the website, in booking confirmations or behind the bar. Something like: "We do not tolerate harassment of our staff. We will ask anyone who harasses our team to leave." It costs almost nothing, and it is evidence.

4. Give staff a script and a way out

Your staff need to know what they can say and what they can do. Agree a few short phrases that stop the behaviour, when they can step away, and who they call. Make it clear you will back them if they refuse to serve someone who is harassing them.

5. Make reporting easy, and not only through the line manager

People will not report what they think will be ignored or held against them. Give them more than one route, including one that bypasses the line manager. Name third party incidents in your reporting process, so nobody decides "that customer is always like that" is not worth raising.

6. Keep a log

Record every incident involving a third party, even the minor ones, and what you did about it. A log shows patterns, like one customer or one shift. It is also the evidence you will need if a claim arrives.

7. Train people, and keep the training fresh

Train on third party harassment specifically, not only on how colleagues treat each other. Face-to-face sessions built on scenarios from your own workplace change behaviour. They also persuade a tribunal far better than a ten-minute online module. Refresh the training regularly. Allay shows what happens when you let it go stale.

8. Name a senior lead

One senior person owns the risk assessment, the log and the follow-up. If it belongs to everyone, it belongs to no one.

What to do when it happens

Even with good steps in place, incidents happen. How you respond matters to your employee, and a tribunal will look at whether your steps were real or only on paper.

Start with the employee. Check they are safe, take them out of the situation if needed, and listen. Do not play it down.

Record it the same day: what happened, who was involved, any witnesses, and what you did.

Then act on the third party. Depending on what happened, that could be a warning, asking them to leave, refusing future service or bookings, raising it formally with their employer, using your contract clause, or calling the police where the conduct is criminal.

Review your steps. Does the risk assessment, training or reporting route need to change? An incident is a signal, and Allay makes clear that ignoring the signal weakens your defence.

A week later, go back to the employee. How are they, and has anything happened since?

When the harasser is a valued customer

This is the hardest case. The person harassing your employee is your biggest account, or a long-standing customer whose spend keeps the lights on.

The temptation is to handle it quietly. The legal position is now plain. If you did not take all reasonable steps to prevent it, you are exposed to a claim. Compensation for harassment has no cap, and where the harassment is sexual and you breached the preventive duty, a tribunal can increase the award by up to 25%.

Reasonable steps here can include raising it with a senior contact at the customer, using your contract clause, moving your employee off the account if they want that, and recording every step. Keeping a valuable customer is a legitimate aim. Keeping them at the cost of your employee's safety is a risk the law now prices in.

Where your business stands

Ask yourself honestly. Would your risk assessment, policy, reporting routes and training stand up to the question, "What did you do to prevent this?" If you are not sure, that is the gap to close now.

The free HR Health Check takes under a minute and lets you know where your people practices are solid and where the gaps are, including the policy and training basics in this article.

Frequently asked questions

What is third party harassment at work?

Third party harassment is harassment of an employee by someone who is not the employer or a colleague, such as a customer, patient, supplier or visitor. It covers unwanted conduct related to a relevant protected characteristic, such as race, sex or disability, and unwanted conduct of a sexual nature, that happens while the employee is at work.

Is an employer responsible if a customer harasses an employee?

From 30 October 2026, yes, unless the employer took all reasonable steps to prevent it. The Employment Rights Act 2025 makes employers liable for harassment of their employees by third parties. The defence depends on what the employer did before the incident, such as risk assessment, clear policies, reporting routes and training.

Does third party harassment cover more than sexual harassment?

Yes. The new liability covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation, as well as sexual harassment. A customer making racist or homophobic remarks to a member of staff is covered in the same way as a customer making sexual comments.

What should an employee do if a customer harasses them?

They should move away from the situation if they can, report it to a manager or through the employer's reporting route as soon as possible, and keep a note of what happened, when and who saw it. The employer should record the incident, support the employee and act on the customer's behaviour.

Can an employer ban a customer for harassing staff?

Yes. A business can refuse service, ask someone to leave or end a commercial relationship where a customer harasses its staff, subject to its own contract terms. Making that position visible in advance, through notices and contract clauses, is itself one of the steps that helps show the employer took all reasonable steps.

What evidence shows an employer took all reasonable steps?

A written risk assessment for customer-facing roles, a policy that covers third parties, contract clauses that name harassment, visible notices, a reporting route outside the line manager, an incident log, up-to-date training records and a named senior lead. Tribunals look at whether these were real and likely to work, not only whether they existed.