Third-party harassment: what employers need to do now

From 30th October 2026, employers will have a new duty to take all reasonable steps to prevent employees being harassed by third parties in the course of their employment.

A third party could be a customer, client, patient, service user, supplier, contractor or member of the public. The protection will cover harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.

This is a significant change in the employment law landscape. An affected employee will also be able to bring a claim directly against their employer where a third party harasses them and the employer cannot show that it took all reasonable steps to prevent it. There will be no requirement for a member of staff to have been harassed on more than one occasion, or for the employer to have known about previous harassment.

Employers are not expected to guarantee that harassment will never happen. They have less control over third parties than over their own employees and will not be required to take unworkable or impractical measures. The steps required will depend on the organisation’s size, resources, sector and operating environment. However, doing nothing until a complaint arises will be difficult to justify.

The practical starting point is a focused risk assessment. Employers should identify where staff interact with third parties, which roles carry the greatest exposure and what types of behaviour may arise. This should cover more than the obvious customer-facing environment. For example, relevant interactions may take place at client premises, conferences, external meetings, work-related social events, online or over the telephone.

The next step is to translate that assessment into proportionate action. This may include updating policies, providing clear reporting channels, training managers to respond properly and telling customers and contractors what standards of behaviour are expected. Contractual terms can require suppliers and commercial partners to co-operate with investigations and comply with anti-harassment standards. Notices, booking confirmations and recorded telephone messages may be appropriate where staff deal with the public.

Employers should also decide in advance what managers can do when an incident occurs. Depending on the circumstances, that may include ending a meeting or call, removing someone from the premises, refusing service, warning or banning a customer, or escalating matters to the third party’s employer.

The commercial message is simple but important: employers do not need elaborate paperwork for its own sake. They do need evidence that they identified the real risks in their business, took practical steps to reduce them and responded properly when concerns arose. It is also important that the policy and any third party risk assessment form(s) are routinely reviewed. A policy sitting unread on the intranet is unlikely, by itself, to demonstrate that an employer has taken all reasonable steps.