Third-party harassment at work: an employer’s guide

What changes on 30 October 2026?

Acas says employers will be liable for third-party harassment if they fail to take all reasonable steps to prevent it. The sexual-harassment prevention duty also changes from reasonable steps to all reasonable steps. These changes apply in Great Britain; Northern Ireland has separate legislation.

Who counts as a third party?

A third party is someone other than the employer or its employee who a worker encounters through work. Depending on the organisation, this could include customers, clients, patients, service users, contractors, suppliers, people at events or members of the public. Harassment may happen in person or online.

Under the Equality Act 2010, harassment generally means unwanted conduct related to a protected characteristic, or unwanted conduct of a sexual nature, that has the purpose or effect of violating dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment. Not every rude interaction meets that legal test. Your policy can still prohibit broader abusive conduct, and threats or unsafe behaviour may need a separate health and safety response. The new Employment Rights Act changes apply in Great Britain; Northern Ireland has separate employment and equality legislation, so check the rules for your workplace.

What should employers do before 30 October?

1. Map the exposure. Identify roles and locations where staff deal with the public, clients, patients, contractors or suppliers. Consider lone working, travel, events, online contact and any previous incidents.
2. Assess the risks and act on them. Consider how likely harassment is, who may be affected and what practical controls are available. Depending on the work, this could include staffing arrangements, security, safe ways to end an interaction or escalation to a supervisor.
3. Make reporting straightforward. Explain who staff can tell, how to report an incident and what support is available. Provide an alternative contact if the usual manager is involved or unavailable.
4. Train managers and front-line teams. Use realistic scenarios to practise responding, recording what happened, supporting the worker and deciding when to challenge or end contact with a third party.
5. Review policies and business relationships. Make sure harassment procedures cover third parties and consider whether client, supplier or venue arrangements need clear conduct expectations and escalation routes.
6. Keep records and review incidents. Record reports, risk assessments, decisions and follow-up. Look for patterns by role, location, customer or time of day and update controls when the evidence changes.

What does ‘all reasonable steps’ mean?

There is no single checklist that suits every employer. Acas says relevant steps are likely to depend on factors such as the organisation’s size, sector and the work employees do. Its examples include regular risk assessment, monitoring incidents, a suitable policy, staff training and reviewing relevant contracts or terms. The employer should be able to explain why its steps fit the risks it faces.

A policy on its own is unlikely to be enough if managers ignore reports or known risks. Put the procedure into practice, act on concerns consistently and check whether the steps are working. The law also gives the government power to set out specified evidence-based steps in future regulations, so employers should keep implementation guidance under review.

How should a manager respond to a report?

• Listen, take the report seriously and check immediate safety needs.
• Ask what support the employee wants and explain the available options.
• Record the facts promptly, including any witnesses or digital evidence.
• Take proportionate steps to stop repeat contact or reduce further risk.
• Follow up with the employee and review whether additional controls are needed.

A practical preparation checklist

• Complete and document a third-party harassment risk assessment.
• Update reporting routes, policies and manager guidance.
• Train staff who handle public, customer or client contact.
• Set clear incident recording and escalation responsibilities.
• Review known risks and incident patterns on a regular schedule.

Read the latest Acas’s third-party harassment guidance and its sexual-harassment update for the two duties.

Do not assume someone must tolerate harassment because the person responsible is an important customer. Adept HR can help review your workplace policies and manager response so the process is usable in practice.