An employee is subjected to repeated offensive comments by a customer. A client behaves inappropriately during meetings. A contractor engages in conduct that crosses professional boundaries while working alongside your workforce.
Although the individual responsible may not be employed by your organisation, employers should not assume that such conduct falls outside their responsibilities.
From 30 October 2026, changes introduced by the Employment Rights Act 2025 will strengthen protections for employees who experience harassment by third parties in the course of their employment. Employers may be liable where a third party harasses an employee and the employer has failed to take all reasonable steps to prevent that harassment.
For employers, the key consideration is not simply how a complaint is handled once an incident has occurred. The new provisions place significant emphasis on prevention and whether appropriate measures were already in place to protect employees from foreseeable risks.
What Is Third-Party Harassment?
Third-party harassment refers to harassment carried out by an individual who is neither the employer nor a fellow employee.
In practice, this may include customers, clients, contractors, visitors or other individuals with whom employees interact as part of their role.
The issue is particularly relevant in customer-facing sectors, where employees regularly engage with people outside their organisation. Retail workers, hospitality staff, healthcare professionals and client-facing teams may all encounter inappropriate behaviour from third parties during the course of their work.
Importantly, the fact that the individual responsible is external to the organisation does not automatically remove the employer’s responsibilities.
What Changes from 30 October 2026?
Section 21 of the Employment Rights Act 2025 amends the Equality Act 2010 by introducing liability where:
- A third party harasses an employee in the course of their employment; and
- The employer has failed to take all reasonable steps to prevent that harassment.
The requirement to take “all reasonable steps” is a significant aspect of the new provisions.
Employers will not automatically be liable every time a customer, client or other third party behaves inappropriately. However, consideration will be given to whether the employer had taken reasonable preventative measures and whether foreseeable risks had been appropriately addressed.
As a result, employers should review their policies, procedures and workplace practices before the new provisions take effect, rather than waiting until a complaint is raised.
What Types of Harassment Are Covered?
The new provisions are not limited to sexual harassment.
The explanatory notes accompanying the Employment Rights Act 2025 confirm that the protection extends to the forms of harassment covered by section 26 of the Equality Act 2010.
This includes:
- Harassment related to age;
- Disability-related harassment;
- Harassment related to gender reassignment;
- Race-related harassment;
- Harassment related to religion or belief;
- Sex-related harassment;
- Harassment related to sexual orientation; and
- Sexual harassment.
The provisions may also apply where an individual receives less favourable treatment because they rejected or submitted to unlawful harassment.
Employers should therefore avoid focusing solely on sexual misconduct when assessing risks. A broader approach is required to address the full range of conduct covered by the Equality Act 2010.
What Does Taking “All Reasonable Steps” Mean?
There is no single checklist capable of meeting the needs of every organisation.
The measures that may be considered reasonable for a small office environment could differ significantly from those expected in retail, hospitality, healthcare or other customer-facing sectors.
Employers should begin by identifying where employees interact with third parties and assessing the risks arising from those interactions.
Reasonable steps may include:
- Reviewing harassment, equality and dignity at work policies;
- Assessing workplace risks;
- Providing appropriate training to managers and employees;
- Establishing clear reporting procedures;
- Ensuring complaints are investigated and addressed consistently; and
- Introducing additional safeguards where employees have regular contact with customers, clients or members of the public.
Most importantly, preventative measures should reflect the organisation’s actual working environment and the risks employees are likely to encounter.
How Employers Should Prepare
Employers should not wait until an incident occurs before reviewing their arrangements.
A sensible starting point is to identify roles that involve regular interaction with customers, clients, contractors or other third parties and assess the risks associated with those roles.
Existing policies should then be reviewed to ensure they address harassment by third parties as well as conduct occurring between colleagues.
Reporting procedures should also be examined. Employees should understand how concerns can be raised, whilst managers should be clear about their responsibilities when a complaint is received.
Training should reflect the realities of the organisation’s working environment. For example, managers in customer-facing businesses may require guidance on responding appropriately when an employee reports harassment by a customer or client.
Employers should also consider whether preventative measures ought to be reflected within customer codes of conduct, contractual arrangements, visitor procedures or other workplace processes.
Maintaining records of policy reviews, training activity and risk assessments may also assist in demonstrating the preventative measures the organisation has considered and implemented.
Responding to Reports of Third-Party Harassment
Although prevention sits at the centre of the new framework, employers must also have effective procedures for dealing with incidents when they occur.
Complaints should be taken seriously regardless of whether the alleged harasser is employed by the organisation.
When an incident is reported, employers should:
- Record the complaint promptly;
- Gather and preserve relevant information;
- Conduct an appropriate investigation;
- Consider the employee’s wellbeing and safety; and
- Assess whether further interaction with the third party should be restricted or managed differently.
Employers should also consider whether the incident exposes wider issues within the organisation, such as deficiencies in training, weaknesses in reporting arrangements or workplace risks that have not previously been identified.
Whilst a prompt response remains important, the strengthened legal framework is likely to focus significant attention on the preventative measures that were in place before the incident occurred.
Third-Party Harassment and Sexual Harassment: Understanding the Difference
Employers should note that two related, but distinct, changes take effect on 30 October 2026.
Section 20 of the Employment Rights Act 2025 strengthens the existing duty relating to sexual harassment by increasing the requirement from taking “reasonable steps” to taking “all reasonable steps” to prevent sexual harassment.
Section 21 introduces protections relating to harassment by third parties.
Whilst third-party harassment may include sexual harassment, the protection extends more broadly to the forms of harassment covered by section 26 of the Equality Act 2010.
Employers should therefore ensure their preparations address both changes rather than treating them as a single legal obligation.
How The Infinity Group Can Help
Employment law reforms continue to be introduced in stages, making it important for employers to stay informed about changes that may affect their workplace policies and procedures.
The Infinity Group regularly publishes helpful updates and insights on employment law, payroll and compliance developments, helping businesses understand the practical impact of legislative and regulatory change.
Subscribe to our newsletter for the latest updates and insights.