Third-party harassment at work: practical steps for employers

Employers must now take “all reasonable steps” to prevent sexual harassment. Since 30 October 2026, employees also have a new right to bring claims against their employer for harassment by customers, clients and other third parties.

Third-party harassment is a workplace risk

A customer repeatedly makes sexual comments to a retail assistant. The manager knows, but the customer is a regular, so the employee is told to ignore it and carry on. The manager has avoided an awkward conversation. The employee still has to deal with the customer.

Similar situations can arise when a patient harasses a healthcare worker, a passenger abuses transport staff, or a client targets someone providing a service. Employees should not be expected to tolerate harassment because the person responsible is a customer, service user or commercial contact.

What “all reasonable steps” means for employers

Since October 2024, employers have been required to take reasonable steps to prevent sexual harassment, including by third parties. On 30 October 2026, that duty became a duty to take “all reasonable steps”.

The new third-party protection gives employees a separate right to claim against their employer where they are harassed in the course of employment and the employer failed to take all reasonable steps to prevent it. A claim does not depend on an earlier incident or the employer knowing about the harassment.

For these purposes, “employee” has a broad meaning and can include people working under contracts to provide services personally, not just those with a contract of employment.

Third parties can include customers, clients, patients, service users, contractors, suppliers, visitors and members of the public. Harassment can happen in person or online. The new protection covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation.

This does not mean automatic liability whenever someone behaves badly, or require employers to eliminate every possible risk. There is no universal checklist. What is reasonable depends on the organisation’s size and resources, the work it does, the people employees encounter and the risks they face. The changes apply in England, Wales and Scotland, but not Northern Ireland.

Where are your staff most exposed?

Start with the work people actually do. A healthcare worker making home visits faces different risks from an office-based colleague. Someone attending a client event or working alone at a customer’s premises may need different support again.

Look at when staff work alone, who they meet and whether help is available. Late shifts, travel and online contact may need particular attention. Consider, too, whether someone on insecure hours would feel able to complain about a customer who has influence over their work.

Can managers act when they need to?

A manager may have completed the training and read the policy, yet still be unsure whether they can refuse service or ask a visitor to leave. Those decisions need to be settled before an incident, with clear routes to security or senior management where help is needed.

Staff also need to know that they will be backed when they raise a concern, even if it involves a valuable client or a longstanding customer.

Five practical steps to prevent third-party harassment

Assess the risks

Ask staff where they have felt unsafe and review complaints and near misses. Make sure younger, temporary and agency workers are heard, including those who may be reluctant to complain. Record what needs to change, who will do it and how you will check whether it has helped. Review the assessment when jobs or working arrangements change.

Make it easy to raise a concern

Employees should have someone to approach outside their immediate management line. They should be able to flag a worrying interaction without committing to a formal complaint. Include agency and temporary staff in these arrangements, and explain what happens after a report, what support is available and how confidentiality will be handled. Be explicit that retaliation will not be tolerated.

Give managers authority to act

Who can warn a customer, end a meeting or ask someone to leave? When should security or the police be involved? Managers need clear answers and training in how to respond. Any intervention must be proportionate and take account of relevant rights, including freedom of religion and expression. If an employee needs to be moved away from immediate risk, they should not lose out as a result. They should not be left to confront an influential client or repeat customer alone.

Tell third parties what is expected

Choose a way of communicating that fits the relationship. For a supplier, that may mean contract terms; for a customer, a notice at the premises or information sent before a visit. Explain the consequences of harassment, such as a warning, removal or refusal of service. Only promise measures that managers can put into effect.

Keep records and look for patterns

Record what happened, who was involved, the response and any support offered. Include informal concerns and near misses, even where no formal complaint follows. Check for repeat behaviour across teams and sites: several apparently isolated reports may concern the same customer or contractor. Use what you learn to decide whether further measures are needed.

What to do now

Start with the situations in which staff are most exposed. HR and the managers responsible for that work should agree what needs to change and who will take it forward. Check back with staff to find out whether the changes are helping.