For many employees, the greatest risk of harassment does not necessarily come from a colleague.
It may come from a customer who makes a racist remark, a patient who uses disablist language, a client who behaves sexually towards a member of staff, or a contractor who repeatedly mocks somebody’s neurodivergence.
For too long, behaviour from customers, clients and service users has sometimes been dismissed as “part of the job.”
From 30 October 2026, that position becomes much harder to defend.
Under the Employment Rights Act 2025, employers will be obliged not to permit third parties to harass their employees.
An employer will be treated as having permitted the harassment where it occurs in the course of employment and the employer cannot demonstrate that it took all reasonable steps to prevent it.
At the same time, the existing preventative duty relating to sexual harassment will be strengthened.
Employers will have to take all reasonable steps, rather than simply “reasonable steps,” to prevent sexual harassment.
This is not simply a policy-writing exercise. It requires organisations to examine where harassment could happen, whose experiences may currently be overlooked and what they are doing in practice to prevent harm.
What forms of harassment are covered?
The new third-party provisions encompass the three forms of harassment set out in section 26 of the Equality Act 2010:
- Unwanted conduct related to a relevant protected characteristic that has the purpose or effect of violating someone’s dignity or creating an intimidating, hostile, degrading, humiliating, or offensive environment.
- Unwanted conduct of a sexual nature.
- Less favourable treatment because somebody submitted to, or rejected, sexual harassment or conduct related to sex or gender reassignment.
The relevant protected characteristics covered by the Equality Act harassment provisions are:
- Age
- Disability
- Gender reassignment
- Race
- Religion or belief
- Sex
- Sexual orientation
Harassment can be verbal, physical, written, visual or digital. It may happen:
- face to face.
- during an online meeting.
- on social media.
- through email or messaging platforms.
- at an event, while travelling for work
- or in any other work-related setting.
A serious one-off incident may be sufficient. Organisations should not wait for behaviour to become repeated or for several people to complain before acting.
Who counts as a third party?
A third party is someone other than the employer or another employee. Depending on the organisation, this could include:
- Customers and clients
- Patients, residents, and service users
- Pupils, students, and parents
- Contractors, consultants, and tradespeople
- Suppliers and delivery partners
- Conference delegates and event attendees
- Volunteers and visitors
- Passengers and members of the public
- People interacting with employees online
The breadth of this definition matters. Any organisation whose people interact with individuals outside its own workforce should be assessing the risk.
Where are the risks highest? The starting point should be a realistic, intersectional risk assessment, not a generic statement that the organisation has “zero tolerance.”
Higher-risk interactions may include:
- Lone working, home visits, and community-based work
- Night-time, hospitality, and licensed environments
- Healthcare, social care and public-facing services
- Roles involving distressed, intoxicated, or confrontational individuals
- Complaints managing and enforcement activity
- Conferences, work-related social events, and business travel
- Online customer service and social media
- Situations involving power imbalances, such as major clients, funders, or senior external stakeholders
- Environments in which employees feel expected to tolerate inappropriate behaviour to protect income or organisational reputation
Risk is not experienced equally. Younger workers, women, disabled and neurodivergent people, LGBTQ+ employees, and people from racially or religiously minoritised groups may be more exposed to particular forms of harassment. An intersectional approach also recognises that somebody may face behaviour connected to more than one aspect of their identity.
Employers should speak to the people doing the work. They are often best placed to identify when, where and from whom inappropriate behaviour is most likely to occur.
What could “all reasonable steps” look like?
There is no single checklist that will be sufficient for every organisation. What is reasonable will depend on factors such as the employer’s size, resources, sector, working environment and the risks it knows, or ought reasonably to know about.
However, reasonable preventative measures may include:
- Regularly assessing the risk of third-party harassment by role, location, shift, and type of interaction
- Consulting employees, staff networks, trade unions and health and safety representatives
- Reviewing previous complaints, informal concerns, exit feedback and incident patterns
- Updating dignity at work, harassment, safeguarding, lone-working and health and safety policies
- Providing accessible and confidential reporting routes
- Ensuring managers know how to respond without blaming, minimising, or silencing the person reporting
- Including behavioural standards and consequences in customer information, event materials, and booking terms
- Adding appropriate conduct clauses to client, contractor, and supplier agreements
- Giving employees authority to end a call, leave an unsafe situation or refuse service without being penalised
- Using suitable staffing levels, security measures, alarms, code words, or escalation arrangements where risks are higher
- Providing practical, role-specific training rather than relying on a short, generic e-learning module
- Recording decisions, action taken and the reasons why any identified measure was/or was not, considered reasonable
- Monitoring whether controls are working and reviewing them following incidents or changes in working arrangements
A policy may be part of the evidence, but a policy that employees have not seen, managers cannot apply and leaders do not enforce is unlikely to demonstrate that all reasonable steps were taken.
Disability and neurodiversity harassment: Disability-related harassment can include:
- mocking somebody’s movements
- communication
- sensory needs
- mental health
- medical condition
- or use of assistive equipment.
It may also include mimicking a person’s speech, making intrusive comments about their diagnosis, or describing reasonable adjustments as “special treatment.”
Neurodiversity is not a separate protected characteristic under the Equality Act. However, a neurodivergent condition may meet the legal definition of disability where it has a substantial and long-term adverse effect on the individual’s ability to conduct normal day-to-day activities.
Harassment protection may also apply where inappropriate conduct is related to:
- A disability the person has
- A disability somebody is perceived to have
- The disability of somebody with whom they are associated
- The disability or neurodivergence of an employee or a third party
For example, a customer repeatedly mocking an autistic employee’s communication style could constitute disability-related harassment. An employee may also experience harassment because they support a disabled family member or because somebody incorrectly assumes they are disabled.
Organisations should avoid requiring employees to disclose a diagnosis before their concerns are taken seriously. The immediate questions should be about the behaviour, its impact and the steps required to prevent further harm.
What if the alleged harasser is disabled or neurodivergent?
This is where organisations may face one of their most difficult, but necessary conversations.
An alleged harasser’s disability or neurodivergence should neither be ignored nor used automatically to excuse harmful behaviour.
Employers should avoid two equally problematic assumptions: that disability inevitably causes inappropriate behaviour, or that conduct must be accepted because the person may have a disability.
A fair and inclusive response should:
- Establish the facts without stereotyping either person
- Consider what was said or done, the context, its impact and whether it was reasonable for the conduct to have that effect
- Consider whether the alleged harasser’s disability affected communication, understanding, impulse control or behaviour
- Make reasonable adjustments to the investigation, communication and complaint-handling process where required
- Seek appropriate specialist input where necessary, while protecting confidentiality
- Put proportionate measures in place to prevent recurrence
- Continue to protect and support the employee who experienced the behaviour
Reasonable adjustments may change how a conversation or investigation is conducted. They do not require an organisation to leave another person exposed to harassment or an unsafe working environment.
Where the alleged harasser is a patient, service user, pupil or member of the public, the organisation may also owe them duties under the Equality Act.
Those duties must be considered alongside, not instead of, the duty to protect employees. The response might involve changing how services are delivered, adding staffing support, providing clearer communication, setting boundaries, or restricting particular forms of contact.
The aim should be a proportionate, evidence-based response that respects the dignity, rights, and safety of everyone involved.
The courageous questions organisations must now ask
Preparation for 30 October should involve more than asking whether the harassment policy has been updated.
Leaders should be prepared to ask:
- Where have employees been expected to tolerate inappropriate behaviour because the person responsible was a customer, patient, or important client?
- Whose complaints are most likely to be described as oversensitivity, misunderstanding or “banter”?
- Do employees genuinely feel able to end an unsafe interaction?
- Would a manager challenge a high-value client, or protect the commercial relationship?
- Are disabled and neurodivergent employees involved in assessing the risks that affect them?
- Can the organisation show what action it took before an incident, rather than only what it did afterwards?
- When disability is relevant to an incident, can managers balance reasonable adjustments with the need to prevent further harm?
These are not comfortable questions. That is precisely why they need to be asked.