Third-party harassment: what employers must do from 30 October 2026

Law checked: 23 October 2026. This article covers England, Wales and Scotland. The measures do not apply to Northern Ireland.

Customers, clients, contractors and members of the public can all harass your staff. From 30 October 2026, the law on what employers must do about that changes.

Are you responsible when someone you don't employ harasses your staff?

From 30 October 2026, employers can be liable when a third party harasses an employee in the course of their work, unless they took all reasonable steps to prevent it (Equality Act 2010 s.40(1A) to (1C), added by the Employment Rights Act 2025 s.21). This covers harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation, as well as sexual harassment. Separately, the duty to prevent sexual harassment that has applied since 26 October 2024 already includes sexual harassment by third parties (Equality Act 2010 s.40A).

So there are three separate things to keep apart:

• The existing duty to prevent sexual harassment (since 26 October 2024), which already covers customers and other third parties. It is enforced by the Equality and Human Rights Commission. A worker cannot bring a standalone tribunal claim just because the duty was breached.
• The strengthening of that duty from "reasonable steps" to "all reasonable steps" (from 30 October 2026).
• A new right to bring a claim against the employer for third-party harassment of any kind covered by the Act, sexual or not (from 30 October 2026).

Law: Employment Rights Act 2025, s.21; SI 2026/1065, reg 3 (commencement on 30 October 2026); Equality Act 2010, s.40A; Equality Act 2010, s.124A

Our all reasonable steps briefing explains the two changes taking effect on 30 October. This piece is about the hardest part in practice: the people you don't employ and can't discipline.

Who counts as a third party?

The Act defines a third party by exclusion. It is anyone other than you, the employer, or one of your employees (Equality Act 2010 s.40(1C)). Acas lists customers, clients, service users such as patients or students, self-employed consultants, contractors and tradespeople, people at conferences and events, and members of the public in shared spaces, and makes the point that harassment can happen online as well as in person (Acas).

The duty bites where the harassment happens "in the course of" your employee's work. That is wider than your own premises. It includes a client's office, a customer's home, an event, and messages that arrive through work.

Why is this different from harassment by a colleague?

With your own staff you can investigate, warn, discipline and dismiss. With a customer you have far fewer levers, and the government accepts that. Its factsheet says the steps an employer can reasonably take about third parties are "clearly more limited" than for employees, that tribunals will take this into account, and that employers should consider the type of third party, how often contact happens and the environment. It also says employers will not be penalised for unworkable steps, and are not expected to foresee the wholly unforeseeable or police customers' private conversations (gov.uk factsheet).

That is not a let-off. It means the question is whether you used the levers you do have.

What levers do you actually have?

Think in three stages.

Before anyone arrives. Put a short line in your booking terms, client engagement letters, supplier and contractor terms, and on signs or your website, saying that harassment of staff will not be tolerated and what will happen if it occurs. Acas suggests exactly this, including reviewing contracts and terms and telling customers the consequences, for example on posters or in emails (Acas). Look at rotas: who works alone, late, or in a customer's home?

While it is happening. Tell staff, in writing, that they may end a conversation, step away, refuse service or call a manager, and that they will be backed when they do. Make sure there is someone to call. The EHRC's own examples include letting staff choose whether to attend a client site alone or with a colleague (EHRC technical guidance).

Afterwards. Record what happened and what you did. Speak to the customer or client. Decide what action is appropriate, which may include a warning, restrictions or an immediate ban, and follow through. The EHRC's guidance gives examples of investigating, speaking to the customer and barring them. For a contractor, raise it with their employer and, if needed, end the arrangement. Then update your risk assessment.

The earlier law had a "three strikes" rule, under which an employer had to know of two previous incidents before it could be liable. That was repealed in 2013 (gov.uk factsheet). The new duty has no such threshold. It is about prevention, so the "before" stage matters most.

Does every offensive remark amount to harassment?

No. Harassment has a legal meaning. The conduct must be unwanted, related to a protected characteristic or of a sexual nature, and have the purpose or effect of violating the person's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment. Where it is the effect that is complained of, a tribunal must ask whether it was reasonable for the conduct to have that effect (Equality Act 2010 s.26). The government's factsheet says trivial conduct or minor offence will not meet the test, and that tribunals must still balance freedom of expression. There is no separate exemption in the Act for overheard opinions or debate, so the protection comes from that definition and from the reasonableness of the steps expected of you.

Worked example: a café owner and a regular customer

Invented for illustration. Not a real case or client.

Priya runs a café with six staff. A regular customer keeps commenting on a young barista's appearance and asks when she finishes her shift. These comments may amount to sexual harassment, depending on their nature and context. The barista mentions it to the shift lead, who laughs it off because "he's harmless and he spends a lot".

Before 30 October 2026, Priya already has a duty to take reasonable steps to prevent sexual harassment by customers. The EHRC can take enforcement action if she breaches that duty, but the barista cannot bring a standalone employment tribunal claim against Priya merely because the customer sexually harassed her.

From 30 October 2026, the barista can bring a third-party harassment claim against Priya if the harassment happens in the course of her work and Priya failed to take all reasonable steps to prevent it. If that claim succeeds and compensation is awarded, the tribunal must also consider whether Priya breached the separate duty to prevent sexual harassment. A breach can increase compensation by up to 25 per cent (Equality Act 2010 s.124A).

Clear reporting arrangements, a briefing for shift leads, permission to stop serving the customer and appropriate action against him are practical steps Priya should consider. A sign by the till is not a substitute for acting when someone reports a problem.

Worked example: a plumbing firm and a hostile client

Invented for illustration. Not a real case or client.

A small plumbing firm sends an engineer, who is a practising Sikh, to a landlord's rented flat. The landlord makes repeated mocking remarks about his turban and religion. This is harassment related to religion or belief, not sexual harassment, so it falls under the new s.40(1A) duty from 30 October rather than s.40A. Steps the firm should consider include a line in the firm's terms of business, a clear instruction that engineers can leave a job and phone the office, a note on the client's file, and a decision, recorded with reasons, about whether to keep working for that landlord.

What employers should do now

• Complete or update your harassment risk assessment, listing every type of outsider your staff deal with.
• Add a short anti-harassment statement to booking terms, client letters and contractor or supplier terms.
• Put up a notice where customers can see it, and on your website if people book online.
• Tell staff in writing that they may step away, refuse service or call for help, and name who to call.
• Brief managers and shift leads that "part of the job" is not an answer.
• Start an incident log and record what you did about each entry.
• Where you decide a step is not reasonable for your business, write down why. Acas recommends this.
• Put a review date in the diary.

Every business is different, and what counts as all reasonable steps depends on yours. If you are unsure what that means for your staff, take advice on your own situation before an incident happens, not after.

---

Sources

• Equality Act 2010, ss.26, 40, 40A and 124A
• Employment Rights Act 2025, ss.20 to 22
• The Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, reg 3
• Acas: third party harassment
• EHRC: sexual harassment and harassment at work, technical guidance
• business.gov.uk: workplace sexual harassment and third-party harassment

Related reading