Third-Party Harassment at Work: An Employer Checklist for 2026

From 30 October 2026, employers in Great Britain face strengthened duties when workers are harassed by customers, clients and other third parties. A policy is one part of preparation; employers also need to understand where incidents could occur, how staff can report them and what the organisation will do.

This guide covers England, Wales and Scotland. Northern Ireland has a separate equality-law framework. The legal changes come from the Employment Rights Act 2025 and are described in current Acas and GOV.UK guidance. This is general information, not legal advice for a particular workplace.

What changes on 30 October 2026?

Acas says an employer could be liable for harassment by a third party unless it has taken all reasonable steps to prevent it. A third party is someone a worker comes into contact with through work who does not work for the employer. Examples include customers, patients, service users, suppliers, contractors, conference attendees and members of the public. Harassment can happen online or in person.

The Act also strengthens the existing duty to take all reasonable steps to prevent sexual harassment of employees. The steps that are reasonable depend on the organisation, its work, the risks and its available resources. There is no single checklist that automatically proves compliance.

Start with the work, not a generic policy

Map where staff encounter people outside the organisation. Think about reception desks, late shifts, home visits, healthcare, retail, hospitality, public-facing services, work events, online channels and lone working. Ask workers and managers which situations feel unsafe, whether there have been earlier incidents and whether the current reporting route is trusted.

Record the risks you identify, the steps you choose and why those steps fit the work. If a measure is not reasonable or practical in a particular setting, note the reason and consider another way to reduce the risk. Review the assessment when work changes or an incident reveals a gap.

What should a third-party harassment policy explain?

• What behaviour is unacceptable: explain that the standard applies when workers are dealing with customers, clients, patients, service users, contractors and the public, including online contact related to work.
• How to get help quickly: give more than one reporting route, including someone other than the worker’s direct manager. Explain how to raise an incident or a near miss.
• What managers must do: set out who makes the worker safe, who records the incident, who escalates it and who checks for repeated behaviour.
• What the organisation can do: explain possible responses such as setting boundaries with a customer, escalating concerns to a client or supplier, changing service arrangements, refusing service where appropriate, or involving security or the police when circumstances warrant it.
• Support and follow-up: explain how the worker can access support, how updates will be given and how the employer will check whether the response has reduced the risk.

Acas advises that a policy should explain how third-party harassment will be handled. The ordinary disciplinary procedure cannot be used against a customer who is not employed by the organisation, so the policy needs a separate practical response.

When a worker reports an incident

1. Deal first with immediate safety. Ask what support the worker needs and whether they can safely continue the interaction or shift.
2. Listen without dismissing the behaviour as “part of the job”. Record the date, location or channel, people involved, what was reported, witnesses and any relevant earlier incidents.
3. Explain what happens next, who will see the information and when the worker can expect an update. Keep records factual and access limited to those who need them.
4. Choose a response that addresses the risk. Depending on the circumstances, that may involve a manager speaking to the customer, notifying a client, changing contact arrangements or taking a safety measure.
5. Check whether the response worked and whether similar incidents point to a wider risk. Update the assessment, policy, training or arrangements if needed.

Do not treat every report as identical. A complaint may require a formal investigation, but an immediate safety concern may need action before that process is complete. Handle each situation fairly and protect confidentiality as far as practicable.

Choose controls that fit the risk

Acas gives examples such as risk reviews, incident monitoring, staff safety and de-escalation training, clear customer-facing terms, sufficient staffing, alarms or cameras in higher-risk settings. These are examples, not universal requirements. Consider the actual risk, privacy and data-protection implications, the views of workers and whether a measure is proportionate.

Managers need to know how to respond, not just where the policy is stored. Explain how to report an incident, how to get urgent help and how to avoid placing the burden of a customer’s behaviour on the affected worker. Include online abuse and work-related social media where relevant.

Review the handbook and policy documents

Check that the harassment policy, grievance route, customer-service rules, lone-working arrangements, social media guidance and manager instructions fit together. Tell workers where the latest version is and train managers on their responsibilities.

Our Employee Handbook Template UK can provide a starting point for documenting workplace policies. The site also has a Prevention of Sexual Harassment Policy Template. A template alone cannot establish that an employer has taken all reasonable steps.

For the wider October changes, see our Employment Rights Act October 2026 employer guide. Acas also explains what to include in a sexual harassment policy.

Frequently asked questions

Does the law only cover customer-facing businesses?

No. Acas says a third party can be anyone a worker contacts through work, including people met at events or in shared spaces. The risks and reasonable steps will vary by role and setting.

Does a written policy prove that the employer took all reasonable steps?

No. A policy can be part of prevention, but employers should also consider risks, communicate the rules, train staff, respond to reports and review whether their steps are working.

Should employers ban every customer accused of harassment?

There is no single response for every incident. Consider the reported behaviour, safety, evidence, recurrence and available options. Take proportionate steps and explain how the decision reduces risk.

Sources checked on 18 October 2026

• Acas: third-party harassment law changes
• Acas: steps employers can take to prevent sexual harassment
• Acas: creating a sexual harassment policy
• GOV.UK: Employment Rights Act implementation timeline
• Employment Rights Act 2025

Illustrative featured photograph: two café colleagues working together at a laptop. Photo by Ketut Subiyanto on Pexels, used under the Pexels licence. The people shown are not connected with an actual complaint.