Third-party harassment: what employers need to know before October 2026
From 30 October 2026, employers will face a new liability for harassment of their workers by third parties.
The Employment Rights Act 2025 changes the Equality Act 2010 so that an employer may be liable where a worker is harassed by a third party in the course of their employment and the employer has failed to take all reasonable steps to prevent it.
And importantly, harassment does not have to happen in the workplace. ACAS confirms that third-party harassment can happen online as well as in person.
Who is a third party?
Essentially, this means someone who is not the employer or another employee of that employer and so, depending on the organisation, that could include customers, clients, patients, relatives, students, contractors, consultants, suppliers, visitors or members of the public.
This means employers need to think about risk across the whole working environment – including telephone calls, email, social media, events, home visits, customer premises and shared workplaces.
Not every unpleasant interaction is Equality Act harassment
The new provisions do not mean that every angry customer, abusive patient or unpleasant member of the public automatically creates a third-party harassment claim.
The conduct still has to amount to harassment under the Equality Act 2010.
Broadly, that means unwanted conduct related to a relevant protected characteristic – such as age, disability, race, religion or belief, sex, sexual orientation or gender reassignment – which has the purpose or effect of violating someone's dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment.
Sexual harassment is also covered.
So an angry customer shouting:
"You're completely useless at your job."
may be abusive and may still require action by the employer, but it is not necessarily Equality Act harassment.
If instead they say:
"You useless old woman!"
the position is very different. The conduct is now related to sex, age and may potentially meet the statutory definition of harassment.
Of course, conduct that falls outside the Equality Act definition should not simply be ignored. Employers still have wider responsibilities for the safety and welfare of their workforce and should have mechanisms for dealing with threatening, abusive or intimidating behaviour.
What might third-party harassment look like?
Healthcare provider
A patient becomes angry after being told that no same-day appointment is available. During the conversation they repeatedly make racist remarks towards the receptionist.
The patient is a third party and the behaviour is potentially harassment related to race.
Whilst previously the focus might have been on the response following the incident, The focus now is, about whether the employer had taken all reasonable steps beforehand to prevent this type of harassment.
For example, had the practice assessed the risk of abuse towards reception staff? Did staff know how to escalate discriminatory behaviour? Were incidents recorded? Were expectations about patient behaviour communicated? Was there an established process for dealing with repeat offenders?
The employer is not expected to guarantee that no patient will ever behave badly but it must demonstrate that it had taken the reasonable preventative measures available to it.
Customer-facing business
An employee working in a hotel bar is repeatedly subjected to sexual comments by a regular customer. Other staff know that the customer behaves this way and have previously laughed it off as "just what he's like".
The employer now has a foreseeable risk.
Simply investigating the next incident after it happens may not be enough. The question will be what reasonable preventative action could have been taken once the employer knew, or should have known, about the problem.
That might include challenging the customer's behaviour, warning them about future conduct, ensuring managers know how to intervene, changing how incidents are reported and, where appropriate, considering whether the customer should continue to be served.
The new provisions therefore put much greater emphasis on prevention rather than simply reacting to complaints.
What does "all reasonable steps" actually mean?
There will not be one identical checklist for every employer because ACAS says the steps required are likely to depend on factors including the organisation's size, sector and the type of work its employees carry out. Measures may include risk assessment, incident monitoring, policies, training and reviewing contractual terms with customers, clients or suppliers.
From 30 October 2026, the strengthened standard is intended to require employers to consider all of the preventative measures that are reasonable for their organisation, rather than choosing one or two measures and assuming that is enough. ACAS also stresses that the approach should focus on prevention across the organisation rather than only reacting after a particular incident.
What should employers do now?
1. Update bullying and harassment policies
Check whether existing policies only deal with conduct between colleagues and ensure that they expressly cover harassment by third parties and explain that this could include customers, clients, patients, service users, contractors, visitors and members of the public.
They should also recognise that harassment can happen through email, telephone calls, social media and other digital channels as well as face-to-face.
2. Assess where third-party harassment is realistically likely to occur
This should be based on the organisation's actual working environment.
A receptionist dealing with distressed members of the public faces different risks from an employee working with external contractors, somebody travelling to customer premises or a member of staff attending conferences.
Employers should also look at their own incident history. Previous complaints, customer behaviour logs, grievances and informal reports may reveal patterns which a generic risk assessment will miss.
3. Tell third parties what behaviour is expected
Policies sitting on an internal HR system will do very little to influence customer or client behaviour.
Consider where expectations can reasonably be communicated externally: customer terms and conditions, contracts, websites, booking information, signage, service-user information or codes of conduct.
ACAS specifically identifies reviewing contractual terms and making expectations clear within individual customer transactions as possible preventative measures.
4. Give staff a simple way to report incidents
Employees should know:
what should be reported;
where it should be recorded;
who will review it;
when it should be escalated; and
what support will follow.
Organisations should be particularly wary of cultures where employees are simply expected to tolerate certain behaviour because difficult customers, patients or clients are seen as "part of the job".
5. Record incidents and look for patterns
A single incident may appear isolated but five similar incidents involving the same customer, client or contractor look rather different.
ACAS recommends monitoring and recording third-party harassment incidents and the action taken because employers need enough oversight to identify when individual reports are actually evidence of a recurring risk.
6. Decide how the organisation will respond
Procedures should explain what options are available, which might include warnings, restrictions on contact, changing working arrangements, escalating concerns to another organisation, ending a commercial relationship or involving the police where behaviour crosses into threats or criminal conduct.
The appropriate response will depend heavily on context. A retailer can usually refuse service more readily than a healthcare provider can withdraw access to healthcare, for example, so sector-specific obligations must still be considered.
7. Train managers and employees
Employees need enough training to understand what third-party harassment looks like and how to report it but managers need enhaced training and should be able to distinguish between general abusive behaviour and Equality Act harassment, recognise recurring risks, know when action is required and understand why simply dealing with individual incidents informally may not be sufficient.
Don't forget the data protection implications
Investigating third-party harassment can be more complicated than an ordinary internal grievance because information may need to be processed about people outside the organisation.
For example, the alleged harasser might be an employee of a supplier, contractor or partner organisation. Information may then need to be shared with that organisation so that it can investigate its own employee. That introduces another data controller and reduces the first employer's control over what subsequently happens to the information.
Work with your DPO to
Establish the lawful basis
Take care with special category data
Minimise what you collect and share
Expect subject access requests
People involved in workplace disputes frequently make subject access requests.
An ongoing investigation does not automatically suspend someone's right of access.
Employers should therefore design investigation records on the assumption that access rights may later need to be considered. Particular care may be needed around witness information, information about other identifiable people and any statutory exemptions the employer believes apply.
Review privacy information
Check that the employee privacy notice adequately explains the use of personal information for grievances, complaints, disciplinary matters and investigations.
Where information is obtained about somebody who is not an employee – including the alleged harasser – Article 14 transparency requirements should also be considered.
There may be situations where an exemption applies, including where providing information at that stage would seriously impair the objectives of the investigation, but this should be considered and documented rather than assumed.
To close then; the third-party harassment provisions come into force on 30 October 2026 and for more of our customers, compliance should not mean creating an entirely new governance framework. But they will want to understand where their employees are exposed to harassment from people outside our organisation, and whether they can demonstrate that they have taken all reasonable steps to prevent it.
Comments