A Customer Harassed Your Employee. From 30 October, That's on You

From 30 October 2026, third-party harassment is your problem to fix

Third-party harassment: what UK SMEs must do by 30 October 2026

Picture this. Your team are doing a great job. Then a customer crosses a line. From 30 October 2026, third-party harassment is your problem to fix. This new duty means you must protect staff from harassment by people outside your business, as well as from colleagues.

So let's jump straight in. Third-party harassment puts a legal and moral spotlight on how customers, clients, suppliers and contractors treat your people. If you don't take reasonable steps to prevent it and deal with it, you can be liable.

What the third-party harassment duty actually says

The two changes that land together

• From 30 October 2026, your existing sexual harassment duty steps up. You must take all reasonable steps to prevent sexual harassment. That is a higher bar than before.
• Also from 30 October 2026, employers can be liable for third-party harassment. That covers customers, clients, suppliers, contractors, and members of the public.

Be precise on scope. Third-party harassment covers conduct related to any protected characteristic: race, disability, age, religion or belief, sex, sexual orientation and gender reassignment. Sexual harassment is included, but it is wider than that.

And a quick myth-buster. The old "three strikes" idea has gone. There is no free go. One incident can be enough if you have not taken reasonable steps.

Plain-English definitions that matter

• Third party: anyone your workers meet in the course of their job who is not a colleague.
• Harassment: unwanted conduct related to a protected characteristic that violates dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment.

Acas puts it simply:

"Employers should take reasonable steps to prevent harassment and respond quickly and fairly to any complaints."

Source: Acas guidance on sexual harassment

The honest bit: the detail is still coming

You deserve a straight answer. Detailed regulations setting out what counts as reasonable steps are expected after a public consultation in 2027. The higher standard applies from 30 October 2026. The detail arrives later.

That is not a reason to wait. Do the obvious, proportionate things now and write them down. Your best defence is: we acted like a sensible employer and here is the evidence.

Real-life examples you will recognise

Here's the heart of it. These are the kinds of situations third-party harassment is about.

• A care worker on home visits gets repeated sexual comments. She dreads the job and says nothing because she thinks nothing will change.
• A young bar team member is groped on a Friday night. A colleague sees it. The customer laughs. The shift rolls on because the queue is long and nobody knows the rules.
• A contractor on site makes racist "jokes" at your engineer. It is framed as banter. Your engineer starts avoiding the site.
• A high-spend client is belittling and aggressive with the account manager. Everyone knows he is "difficult". Everyone works around it.

In the past, the instinct was to smooth it over. Keep the customer happy. Tell the team to toughen up. From 30 October, that instinct is a legal risk. The question is simple: did you take all reasonable steps to protect your worker from third-party harassment?

The steps to take before October

Protecting your team from third-party harassment is about a handful of sensible moves. You do not need a legal department. You need clear expectations, safe reporting, and managers who back their people.

1) Update policies and spell it out

• Add third-party harassment to your anti-harassment policy.
• State that your staff have the right not to be harassed by customers, clients or contractors.
• Say what you will do if it happens.

Quick actions:

• Refresh policy wording and handbook references
• Share it on your HR system and in team briefings
• Add a clear definition and simple examples

2) Tell your team they are protected

Many people think client abuse is part of the job. Say clearly it is not. Explain what to do in the moment and how to report it.

Quick actions:

• Run a 10-minute briefing at shift handovers or team meetings
• Put a one-page poster in staff areas with a reporting route

3) Give a safe route to report and act fast

People need a way to raise concerns that will not get them blamed for "losing a customer". A safe route must lead to someone trained to assess risk and act.

Quick actions:

• Set up a dedicated email inbox or form with clear SLAs
• Name two safe contacts in case one is off or involved
• Keep a simple incident log with actions and outcomes

If you want a credible independent route, our independent appeals service can support fair, impartial handling when a concern escalates. See: Independent appeals

4) Plan for known hotspots

Most businesses can name the flashpoints. Lone working. Late shifts. A client everyone dreads. Put guardrails in place.

Quick actions:

• Pair up for higher-risk visits or use live check-ins
• Give staff a short "stop the behaviour" script and permission to pause service
• Be willing to end a client relationship that keeps crossing the line

5) Back your people when it counts

A policy only works if staff believe you mean it. The first time you refuse service to an abusive customer or have a firm word with a client on someone's behalf, your whole team gets the message.

Quick actions:

• Create a manager playbook with do/say steps
• Share debriefs of resolved cases to show follow-through

6) Train your managers

Frontline managers will receive most reports. If they respond calmly, take it seriously, and escalate well, you solve problems early. If they brush it off, you store up risk.

• Practical help: Cake, Coffee and Compliance is one hour a week of real HR for line managers. The harassment sessions land before the duty goes live. Each session ends with a usable document, not just slides.

Quick reference: map your hotspots to actions

Reporting, whistleblowing and independent routes

Since 6 April 2026, reporting sexual harassment can be a protected disclosure under whistleblowing law. In plain terms, someone who raises a concern about harassment, including by a third party, may have whistleblowing protection.

That raises the stakes. If a worker reports harassment and is then treated badly for speaking up, this can become a whistleblowing issue as well as harassment. The lesson is simple: take every report seriously, act fairly, and never penalise someone for raising a genuine concern.

Independent routes earn their place here. "Tell your manager" is not enough if the manager is part of the problem or unsure what to do. An independent channel gives people somewhere credible to turn and gives you a record to evidence all reasonable steps.

• Independent support for escalated cases: Independent appeals
• KUHR services overview for ongoing support: Outsourced HR support
• Media coverage of Kate explaining changes: Press page

For an external reporting platform sized for SMEs, see SafeVoice.

The cheapest tribunal insurance a small business can buy

Here's a hard truth from years of cases. Claims rarely start with one dramatic event. They build from small things that get brushed off. A report lands with a busy manager who means well and does nothing. A grievance sits with no timeline or reply. The person stops asking.

By the time someone calls Acas, the cheap window closed months ago. From then on it costs time, money and attention. And the fix was often a ten-minute conversation done promptly.

Make it easy and safe to raise things early. It pays for itself. From 1 October 2026, the time limit for some claims extends to six months. That is twice as long for an unresolved grumble to harden into something formal. Catching it in week one is now worth even more.

One more nudge while we are here. National Payroll Week runs 7 to 11 September. Repeated pay errors are a breach of a fundamental contract term. Treat payroll issues as high-priority, fix them fast, and stop a small crack becoming a claim.

A calm word on wellbeing

This piece lands close to World Suicide Prevention Day. The reason this matters is human. Being harassed at work wears people down. Sleep suffers. Confidence drops.

Protecting your team from third-party harassment says their dignity matters and someone has their back. If a colleague seems to be struggling, a kind check-in and a signpost to proper support is time well spent.

Getting ready, calmly

Third-party harassment is new, but the response is familiar: a clear policy, a safe way to speak up, managers who know what to do, and leaders who back their people. Put those in place this month and 30 October brings no drama.

Need a hand?

• Train your managers: Cake, Coffee and Compliance
• Independent handling for tricky cases: Independent appeals
• Ongoing help for SMEs: Outsourced HR support
• See where Kate has explained these changes in the media: Press page

Kettle On, Standards Up. Until next time, keep buzzing and take care of your people!

References and guidance

• Acas guidance on sexual harassment
• Equality Act 2010 guidance (GOV.UK)
• CIPD harassment and bullying resources

Expert quote

"Employers who act early, train managers, and keep clear records will be best placed to meet changing legal duties and protect staff." - HR policy lead, referencing Acas and CIPD guidance

FAQs

• What counts as third-party harassment at work? It is unwanted conduct by someone outside your organisation, linked to a protected characteristic, that violates dignity or creates an intimidating, hostile, degrading, humiliating or offensive environment.
• Are employers liable for a single incident by a customer? Yes. The old "three strikes" approach has gone. If you have not taken reasonable steps, one incident can be enough to create liability.
• What are "all reasonable steps" for sexual harassment prevention? Think policy, training, safe reporting, quick action, records, and tackling hotspots. The precise list will be clarified in 2027 guidance, but you should act now.
• Does the duty cover contractors and volunteers working for us? If they are your workers or you control the setting, plan for their safety too. The third-party duty covers what external people do to your staff.
• How do we handle reports that might be whistleblowing? Treat reports seriously, act fairly, and never penalise someone for raising concerns. Some harassment reports can qualify for whistleblowing protection.
• What records should we keep to show reasonable steps? Keep your policy, training logs, incident forms, actions taken, client warnings, and any contract clauses about conduct. Short, clear evidence beats long essays.