Content reviewed October 2026.

CalmER · Workplace guides

Third party harassment: what UK employers must do from 30 October 2026

For employers in England, Scotland and Wales: from 30 October 2026, staff can bring a tribunal claim if a customer, client, patient or other third party harasses them at work and the employer didn't take all reasonable steps to prevent it. What the law says, who counts, what to put in place, and a free training pack for staff and managers.

Last updated 22 October 20269 min read

At a glance What the law says Two rules, side by side Who counts as a third party All reasonable steps When staff report a customer Free training pack FAQs

At a glance, as at 22 October 2026

From 30 October 2026, an employer must not permit a customer, client, patient or any other third party to harass its staff. If it happens in the course of their work and the employer didn’t take all reasonable steps to prevent it, they can bring a claim at an employment tribunal.

What	Where things stand
The rule	Employers must not permit a third party to harass their employees (Equality Act 2010, section 40, as changed by section 21 of the Employment Rights Act 2025).
From	30 October 2026, under commencement regulations made on 1 October 2026.
Who counts as a third party	Anyone other than the employer and its employees: customers, clients, patients, service users, contractors, suppliers, people at events and members of the public.
Which harassment	Sexual harassment; harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation; and treating someone worse because they rejected or gave in to sexual harassment.
The test	Whether the employer took all reasonable steps to prevent it. The law doesn’t list the steps.
Who brings a claim	The employee, at an employment tribunal. The EHRC can also act.
What it doesn’t require	In the government’s words, employers don’t have to “foresee the wholly unforeseeable or police all customers’ private conversations”.

This guide covers the rule for every protected characteristic. For the duty to prevent sexual harassment, which applies to colleagues as well as third parties, see our Worker Protection Act guide.

The law

What the third-party harassment law says

Section 21 of the Employment Rights Act 2025 adds three subsections to section 40 of the Equality Act 2010. In plain words:

The rule. An employer must not permit a third party to harass one of its employees.
When an employer permits it. The harassment happens in the course of the employee’s work, and the employer failed to take all reasonable steps to prevent the third party from doing it.
Who a third party is. Anyone other than the employer or one of its employees.

Which harassment it covers

The rule uses the Equality Act’s definition of harassment, so it covers all three forms: harassment related to a protected characteristic, sexual harassment, and treating someone worse because they rejected or gave in to sexual harassment. The protected characteristics it covers are age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. Harassment law doesn’t cover pregnancy and maternity, or marriage and civil partnership.

Why it’s new

Rules on third-party harassment applied from 2008 to 2013 under a “three strikes” condition, and Parliament then repealed them. In 2018 the Court of Appeal confirmed that nothing replaced them (Unite the Union v Nailard). The new rule has no condition about earlier harassment, and employees can bring a tribunal claim over it.

What the rule doesn’t ask of you

The Act has no exception for opinions or overheard conversations. The government’s factsheet says a tribunal judges harassment objectively and weighs freedom of expression, and that employers “will not be penalised for failing to take unworkable or impractical steps”. It also says the rule would not require employers “to foresee the wholly unforeseeable or police all customers’ private conversations”.

Regulations to come

The Act also lets ministers list steps that count as reasonable, such as assessments, policies, reporting and complaint handling. Those regulations will apply to this rule as well as to the sexual harassment duty. The government plans to make them in 2027/28, after a consultation.

Request the Free Training Pack

Two different rules

Third-party harassment and the sexual harassment duty

From 30 October 2026, two rules deal with harassment by third parties. They work differently, and employers must meet both.

	The duty to prevent sexual harassment	The third-party harassment rule
In force	Since 26 October 2024	From 30 October 2026
What it asks	All reasonable steps to prevent sexual harassment of your staff (reasonable steps before 30 October 2026)	That you don’t permit a third party to harass your staff
Whose harassment	Colleagues and third parties	Third parties
Which harassment	Sexual harassment	Harassment related to a protected characteristic, sexual harassment, and worse treatment for rejecting or giving in to it
Who acts on it	The EHRC, which can act before any harassment happens. A tribunal can add up to 25% to compensation in a successful sexual harassment claim	The employee, through a tribunal claim. The EHRC can also act

Our Worker Protection Act guide covers the sexual harassment duty in full, with free policy and risk assessment templates and a self-assessment.

Customers, clients, patients and the public

Who counts as a third party

The law says a third party is anyone other than the employer and its employees. Acas and the EHRC give examples:

customers and clients
patients, residents and other service users, such as school students
contractors, freelancers and suppliers
delegates at a conference and other people at events
members of the public, in person or online

The rule applies when the harassment happens in the course of the employee’s work, wherever they’re working, in person or online.

Where the risk is higher

The EHRC’s own examples show where harassment by third parties is more likely: a call centre and a pub, where it expects training for staff who deal with customers; a hospital, where patients are third parties; and a warehouse that ignored the risk from customers and breached the duty. In health and care, patients and residents are third parties.

In practice

What “all reasonable steps” looks like for third parties

The law doesn’t list the steps. These come from Acas’s guidance on third-party harassment and the EHRC’s guidance, with what to keep on record for each. Keep a note, too, of why you decided a step wasn’t reasonable for you.

Step	What it involves	What to keep on record
1. Assess the risk	Look at which roles deal with third parties, how often and where, and what raises the risk: lone and night working, alcohol, events and travel. Review it regularly. Health and safety law separately requires you to assess the risk of violence to staff, including from members of the public.	The risk assessment and your action plan.
2. Cover third parties in your policy	Say that harassment by customers and other third parties won’t be tolerated, encourage staff to report it, and set out what you’ll do.	The policy, and when you’ll review it.
3. Tell third parties your standards	Notices where customers see them, terms in bookings and contracts, emails or recorded messages, and what happens if they harass staff.	What you told them, and where.
4. Train staff who deal with the public	Personal safety, de-escalation and what to do when it happens. Managers learn to receive reports and act on them. Our free training pack covers both.	Who you trained, and when their refresher is due.
5. Make it easy to report	More than one way to report, by name or anonymously.	Every report and what you did about it.
6. Act on the harasser	Warn the customer, ban them, or report a crime to the police.	What you did and why.
7. Protect staff in higher-risk settings	Check where staff work alone with customers or patients, and look at staffing levels, security, personal alarms and cameras.	What you checked and what you changed.
8. Review	Look for patterns in reports, and look again when your work, your staff or your technology changes.	What each review found.

Request the Free Training Pack

When it happens

When a member of staff reports a customer

Check they’re safe, and ask what support they need.
Treat it as seriously as a complaint about a colleague. The EHRC says harassment by a customer, client, patient or supplier deserves the same response.
Act promptly, and take account of what they want to happen.
Record it: the date, where it happened, the roles of the people involved, the protected characteristic and what you did.
Deal with the third party: a warning, a ban, or a report to the police if it’s a crime.
Tell the member of staff what you did.
Check your steps. Update the risk assessment if the report shows a risk you missed.

Free training pack

Free third-party harassment training for staff and managers

Training staff who deal with the public is one of the steps Acas and the EHRC name. This free pack gives you the sessions to run it, for harassment by customers, clients, patients and the public related to any protected characteristic. You fill in your own reporting routes and examples.

File	What it covers
Staff session (PowerPoint, with speaker notes)	What changes on 30 October 2026; what harassment means, for every protected characteristic; who counts as a third party; what it can look like, in person and online; what to do if a customer, client or patient harasses you; what to do if you see it happen to a colleague; scenarios to discuss; where to go for help.
Manager briefing (PowerPoint, with speaker notes)	When a member of staff reports a customer; acting on the third party: a warning, a ban or a report to the police; recording what happened and what you did; protecting the people who report; reviewing the risk.
Quiz and training record (Word)	Questions on recognising and reporting harassment by third parties; an answer sheet for the presenter; a training record for everyone to sign.
Rollout guide (Word)	How to fit the sessions to your customers, clients or patients; how to deliver, record and refresh the training.

For sexual harassment training, see our free sexual harassment training pack.

Free training pack

Request the free training pack

Enter your work email and the team will send you the training pack: a staff session, a manager briefing, a quiz with a training record, and a rollout guide.

Or hear about harassment by customers while you can still act

Staff raise a concern about a customer, client or patient in Slack or Microsoft Teams, by name or anonymously. It goes straight to the people you choose, who can reply and ask questions, and every concern stays on record. Start free.

See how anonymous reporting works →Start free

FAQs

Common questions

What is third party harassment?

Harassment of an employee by someone other than their employer or a colleague, such as a customer, client, patient, contractor or member of the public. From 30 October 2026, employers must not permit it, and an employee can bring a tribunal claim if it happens at work and the employer didn't take all reasonable steps to prevent it.

Are employers responsible for harassment by customers?

From 30 October 2026, yes, where the harassment happens in the course of the employee's work and the employer didn't take all reasonable steps to prevent it. The employee can bring a claim at an employment tribunal.

Does third party harassment only cover sexual harassment?

No. It covers sexual harassment and harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation. It also covers treating someone worse because they rejected or gave in to sexual harassment.

Can an employee sue for third party harassment?

Yes. From 30 October 2026, an employee can take a claim of third-party harassment to an employment tribunal. The EHRC's 2024 guidance pre-dates the change, so some of its paragraphs still say they can't.

What counts as all reasonable steps for third party harassment?

The law doesn't list them, and what's reasonable depends on your organisation. Acas suggests assessing the risk, recording reports, covering third parties in your policy, training staff in personal safety and de-escalation, reviewing contracts with clients and suppliers, telling customers what happens if they harass staff and, in higher-risk settings, looking at staffing, security, alarms and cameras. The government plans regulations listing reasonable steps in 2027/28.

Does a single act of harassment count?

Yes. The new rule has no condition about earlier harassment. The third-party rules that applied from 2008 to 2013 had a “three strikes” condition, and Parliament repealed them.

Do we need a third party harassment policy?

The law doesn't name one. The EHRC says your harassment policy should deal with third parties: that harassment by customers won't be tolerated, how staff report it, and what you'll do, such as warning or banning a customer or reporting a crime to the police.

Does it cover online harassment by customers?

Yes, when it happens in the course of the employee's work. Acas includes harassment in person and online.

When does the third party harassment law come into force?

On 30 October 2026. The Employment Rights Act 2025 (Commencement No. 6) Regulations 2026 bring section 21 of the Act into force on that date.

Sources & further reading

References

General information, not legal advice. It reflects our understanding of the law and official guidance as of October 2026, so check the sources above for the current position.