Third-party harassment at work: what the law says since 30 October 2026

What the law says

Section 21 of the Employment Rights Act 2025 added three subsections to section 40 of the Equality Act 2010. It came into force on 30 October 2026 under SI 2026/1065. In plain English:

• an employer must not permit a third party to harass one of its employees;
• the employer permits it only if the harassment happens in the course of the employee's work and the employer failed to take all reasonable steps to prevent it;
• a third party is anyone other than the employer or its employees.

The rule is not only about sexual harassment. It covers harassment as section 26 of the Equality Act 2010 defines it: harassment related to age, disability, gender reassignment, race, religion or belief, sex or sexual orientation, and sexual harassment. On the same day, the separate duty to prevent sexual harassment became a duty to take all reasonable steps, not just reasonable steps.

Who counts as a third party

Anyone your employer does not employ. In practice that includes customers and shoppers, clients, patients and service users, guests at hotels and venues, pupils' parents, suppliers and delivery drivers, contractors' staff working on your site, and members of the public you deal with at work, in person, by phone or online.

Harassment by a colleague is covered by the employer's existing liability for its own staff, not by the third-party rule.

What employers must do: all reasonable steps

The law does not yet list the steps; the Act gives ministers a power to set some out in regulations. The Equality and Human Rights Commission's employer 8-step guide, updated on 30 October 2026, says harassment by a customer, client, patient or supplier should be treated as seriously as harassment by a colleague. The steps it suggests for third parties include:

1. Reporting routes. A clear way for staff to report harassment by people outside the organisation.
2. Practical training. How to de-escalate confrontational or abusive behaviour and what to do if third-party harassment happens.
3. Clear signage. Notices in public areas saying harassment of staff will not be tolerated.
4. Less lone working. Avoiding lone or isolated working where possible.

The same guide expects employers to assess where harassment is likely, including from third parties, act on complaints and review what they do. Our employer checklist for all reasonable steps sets out all eight steps.

If a customer or client harasses you

• Get to a safe place and tell your manager or the person on shift as soon as you can.
• Write down what happened, when, who was there and any messages, so the report can be acted on.
• Use your employer's reporting route. Your employer should act on it, protect you while it does and tell you what it has done.
• If it is not resolved, Acas gives free, confidential advice. If the harassment may be a crime, you can also report it to the police.

Training staff and managers on third-party harassment

Lift College's Sexual Harassment Training is 2 hours of learning in 5 short modules. Module 3 covers customers, clients and third parties, and module 5 covers responding to a report as a manager. Your certificate shows the course, the hours, your completion date and a refresh date, which gives your employer a record of the training step. Training a team? An organisation account is free to open, with team prices and one place to see who has passed.

Because the rule covers all harassment, many employers pair it with Bullying and Harassment Training and, for customer-facing staff, Conflict Resolution and De-escalation Training.