Third-Party Harassment: UK Employers' New Legal Duty from 30 October 2026

From 30 October 2026, UK employers have a legal duty to take "all reasonable steps" to protect their workers from harassment by customers, clients, contractors, and anyone else who isn't an employee. If a staff member is harassed by a member of the public and you can't show you took all reasonable steps to prevent it, you are liable — and the Equality and Human Rights Commission can act directly against your business, without waiting for a tribunal claim.

This is one of the most significant shifts in employment law this year. Most UK employers have no harassment policy that covers third parties. Most have done no staff training on it. And most don't know the EHRC can walk in without a complaint being filed first.

You have 44 days from today. Here's exactly what the law requires and what you need to put in place.

What the Law Actually Says

The Employment Rights Act 2025 introduces two connected duties that both take effect on 30 October 2026:

1. Third-party harassment duty
Employers must take "all reasonable steps" to prevent harassment of workers by third parties — anyone who isn't a fellow employee. This means customers, clients, suppliers, contractors, delivery drivers, visitors, or members of the public who interact with your staff.

2. Sexual harassment "all reasonable steps" upgrade
The existing sexual harassment duty — which required employers to take "reasonable steps" — is upgraded to require "all reasonable steps." This is a materially higher bar. It removes discretion. "We did something" is no longer enough. You must show you did everything proportionate to your size and sector.

Both duties apply from 30 October 2026. The phrase "all reasonable steps" is the same standard in both — and courts and the EHRC will interpret it consistently.

Who Enforces This — and How

This is where the new law differs from most employment protections.

The Equality and Human Rights Commission (EHRC) has been given direct enforcement powers. They do not need to wait for a worker to file a tribunal claim. They can investigate your business proactively, issue unlawful act notices, and require changes — without an individual employee bringing a case.

In sectors with known harassment risks — retail, hospitality, healthcare — EHRC is expected to use these powers actively. A single complaint to the EHRC from a worker, or a pattern of incidents flagged via social media or industry bodies, can trigger an investigation.

If a worker does bring a tribunal claim and wins, compensation is uplifted by 25% where the employer has breached the duty. That uplift is not discretionary — it applies automatically once the breach is found.

Which Sectors Are Most Exposed

Retail — 3 Million Workers, Daily Customer Contact

Retail has the highest exposure of any sector. Shop floor staff, till operators, fitting room attendants — every customer interaction is a potential incident. The British Retail Consortium has documented years of verbal abuse, threatening behaviour, and sexual harassment directed at retail workers.

From 30 October, if a customer harasses a member of your staff and you have no written policy, no training records, and no reporting process, you are in breach. Trading Standards and EHRC are both expected to take an interest in retail compliance.

Hospitality — Late-Night, Alcohol, and Lone Working

Pubs, restaurants, hotels, and event venues face specific risks: alcohol-fuelled environments, late-night shifts, lone working, and customers who may feel entitled to treat staff badly. Staff complaints about regulars, unwanted touching at bars, and verbal abuse from difficult guests are well-documented.

The "all reasonable steps" duty requires you to address these risks in your policy — not just acknowledge they exist. How do staff report incidents? What happens when a regular customer crosses the line? Who makes the decision to ask someone to leave?

Healthcare — Patients, Relatives, and Contractors

Patient-on-staff harassment — including verbal abuse, threatening behaviour, and physical assault — is endemic in health and social care. Care home staff, GP receptionists, dental nurses, and pharmacy assistants all face regular third-party harassment.

Under the new duty, healthcare employers must have a documented approach to this risk. "Patients can be difficult" is not a reasonable step. "We have a zero-tolerance policy, staff training records, and an incident log" is.

All Employers — Not Just These Sectors

The duty applies to every UK employer with workers. Professional services, construction, manufacturing — if your staff interact with anyone external to the business, third-party harassment is in scope. Contractors on site, clients at meetings, delivery personnel — all count as third parties.

What "All Reasonable Steps" Actually Means

The EHRC guidance makes clear that "all reasonable steps" is not a tick-box exercise. Here is the minimum standard any employer of any size should have in place by 30 October:

1. Written third-party harassment policy
A standalone policy (or an updated general harassment policy) that explicitly covers third-party harassment — customers, clients, contractors. It must be accessible to all workers, not buried in a staff handbook nobody reads.

2. Worker training
All staff must know what the policy says, what they should do if they experience harassment, and who to report it to. Training records must be kept. A verbal briefing with no record is worthless in an enforcement action.

3. Clear reporting process
Workers must have a named person (or process) to report harassment to. Anonymous reporting options are recommended for sectors with high turnover where workers fear management retaliation.

4. Management authority to act
Front-line managers must have explicit authority to remove a customer, terminate a contractor relationship, or escalate a supplier issue where harassment has occurred. "I can't do anything, they're a customer" is a breach.

5. Incident recording
Every incident should be logged — date, description, who was involved, what action was taken. This creates the evidence trail that shows you took incidents seriously and acted consistently.

6. Proportionate response to known risks
If you're a late-night venue, a lone-working environment, or a sector with documented harassment patterns, "all reasonable steps" includes taking sector-specific preventive measures. CCTV in high-risk areas, body-worn cameras for lone workers, strict policies on alcohol-related incidents — proportionate to your context.

The 25% Compensation Uplift — What It Means in Practice

If a worker brings a successful harassment claim at tribunal and the employer is found to have breached the "all reasonable steps" duty, compensation is uplifted by 25%.

On a £30,000 award, that's £7,500 extra — automatic, not discretionary. On a £100,000 award (possible where psychiatric injury, loss of career, and aggravated damages are in play), that's £25,000 extra.

And because unfair dismissal compensation is uncapped from 1 January 2027 — meaning any worker hired since July 1 who is dismissed unfairly after their six-month mark faces no ceiling on their award — the combination of these two changes creates serious financial exposure for any employer who hasn't prepared.

What You Need to Do Before 30 October 2026

Here is a practical checklist. This is the minimum. Larger employers, higher-risk sectors, and businesses with prior incidents should go further.

• Write or update your harassment policy — explicitly include third-party harassment, define who counts as a third party, and set out worker rights clearly
• Hold a staff briefing before 30 October — all workers must know the policy exists and what to do with it
• Keep training records — name, date, format of training. Digital records are easiest to produce in an enforcement action
• Create or update your incident reporting process — every workplace should have a named person to report to and a log to record in
• Review your high-risk scenarios — does your policy cover what happens when a regular customer is the harasser? When a senior client makes unwanted comments? When a contractor's behaviour is reported?
• Empower your managers — confirm in writing that managers have authority to act on harassment reports, including removing a third party from the premises
• Check your sexual harassment policy — if it refers to "reasonable steps," update it to "all reasonable steps" now

How ComplianceAlert Helps With Third-Party Harassment Compliance

ComplianceAlert monitors changes like the October 30 duty and alerts your business the moment something applies to your sector. But alerts alone don't make you compliant.

The Action Centre includes a pre-built third-party harassment policy template and compliance checklist. Activate it, work through the steps, and every action you take is logged automatically. You don't need to remember what you did — ComplianceAlert does it for you.

Every training record, policy sign-off, and incident report goes into your Evidence Vault. If the EHRC contacts your business, or a tribunal claim arrives months later, you export your Inspection Pack in one click — your complete evidence trail, ready to hand over.

Not sure what "all reasonable steps" means for your specific business? Ask Alice. Alice is ComplianceAlert's AI compliance assistant with full knowledge of your current compliance status. Ask "what do I need to do about third-party harassment before October 30?" and she'll check your specific actions, evidence, and outstanding gaps — not a generic answer.

Start free at compliancealert.co.uk — no card required. Free forever plan includes alerts and the Action Centre. Pro plan includes the Inspection Pack and Evidence Vault export.

Need professional help drafting your harassment policy? Find a verified employment lawyer or HR consultant at compliancemarket.co.uk/hr-consultants.

Frequently Asked Questions

Does the third-party harassment duty apply to small businesses?

Yes. The duty applies to all UK employers regardless of size. What counts as "all reasonable steps" is proportionate — a 5-person business cannot be expected to take the same measures as a 500-person one. But all businesses must have something: a written policy, a reporting process, and trained staff.

What if a customer or client has always behaved this way?

The duty requires you to act on known risks. If you know a customer or client regularly behaves in a harassing way towards staff, failing to act is a breach of the duty. That may mean warning them, changing who serves them, or ending the relationship.

When does the EHRC enforcement start?

The EHRC can use its direct enforcement powers from 30 October 2026 — the date the duty comes into force. There is no grace period. EHRC has confirmed it will be active in enforcing both the third-party harassment duty and the upgraded sexual harassment duty from day one.

What if we already have a harassment policy?

Check whether it explicitly covers third-party harassment. Most existing policies cover colleague-on-colleague harassment only. If your policy doesn't name customers, clients, contractors, and other third parties as potential sources of harassment, update it before 30 October. Also check whether your sexual harassment section still says "reasonable steps" — it must now say "all reasonable steps."

What counts as an incident report for the evidence trail?

A written record of: date and time, description of what happened, who the third party was (if known), which worker was affected, what action was taken, and who made the decision. Stored securely, with the worker's knowledge, and retained for at least two years given the doubled ET time limits from 1 October 2026.

The Bottom Line

From 30 October 2026, "all reasonable steps" is the law — not best practice. Every UK employer must have a written policy, trained staff, a reporting process, and an incident log in place. EHRC can act directly. Compensation is uplifted by 25% for breaches. And with uncapped unfair dismissal awards landing from January 2027, this is the wrong moment to have gaps in your employee protection documentation.

44 days is enough time to get this right. But only if you start now.

• Third-party harassment duty: in force 30 October 2026
• Sexual harassment "all reasonable steps" upgrade: in force 30 October 2026
• EHRC enforcement: active from day one, no tribunal needed
• Compensation uplift for breaches: 25%
• Minimum steps: written policy, training records, reporting process, incident log

👉 compliancealert.co.uk — free forever, no card required

Need professional help with this? Find a verified employment lawyer or HR specialist at compliancemarket.co.uk/employment-lawyers.