Changes to Harassment Legislation: What Employers Need to Know
From 30 October 2026, employers will face an important new responsibility when it comes to protecting their employees from harassment at work.
Under the Employment Rights Act 2025, employers will have an obligation not to permit their employees to be harassed by third parties. This could include customers, clients, patients, service users, suppliers and other people employees encounter through their normal day to day work.
For any company with customer-facing or public-facing employees in particular, now is the time to review whether the measures already in place will be enough.
What is third-party harassment?
Third-party harassment is harassment experienced by an employee during the course of their employment from somebody who is not their employer or another employee of the organisation.
Depending on the workplace, a third party might be:
a customer or client
a patient or service user
a supplier or contractor
a visitor
a member of the public
This is particularly relevant for sectors such as retail, hospitality, healthcare, social care and other environments where employees regularly interact with people outside their organisation.
What is changing?
The new legislation introduces an obligation on employers not to permit a third party to harass an employee.
This means employers need to think proactively about where the risks of third-party harassment could exist and what measures could be introduced to reduce those risks.
The new third-party liability will apply to all types of harassment covered by the legislation.
Sexual harassment duties are also becoming stronger
There is another significant change arriving at the same time.
Since October 2024, employers have had a proactive duty to take reasonable steps to prevent sexual harassment of their employees.
From 30 October 2026, this will be strengthened so that employers must take all reasonable steps to prevent sexual harassment.
That additional word – “all” – is important.
The explanatory notes to the Employment Rights Act make clear that an employer will have taken all reasonable steps where there are no further steps that they could reasonably have been expected to take in the circumstances.
Simply having an anti-harassment policy sitting in a handbook is therefore unlikely to tell the whole story. Employers should be able to demonstrate what they have actually done to identify risks and prevent harassment.
What should employers be doing now?
Although further guidance is expected ahead of the legislation coming into force, employers do not need to wait until October to start preparing.
A sensible starting point is to review your organisation's exposure to third parties and consider:
Risk assessments: Where and when could employees encounter inappropriate behaviour from customers, clients, patients, service users or other third parties?
Policies: Do your harassment, dignity at work and equality policies clearly address third-party harassment?
Reporting procedures: Do employees know how and where to report an incident, and are they confident that concerns will be taken seriously?
Manager training: Would managers know what to do if an employee reported harassment by a customer or client?
Employee training: Do employees understand what harassment can look like and the support available to them?
Third-party expectations: Could codes of conduct, contracts, notices or customer communications make standards of acceptable behaviour clearer?
Responding to incidents: Is there a consistent process for investigating incidents and taking appropriate action?
Keeping records: Can the organisation demonstrate the preventative steps it has taken?
The right measures will vary depending on the size and nature of the organisation and the risks employees’ may encounter.
Don't wait for an incident
Perhaps the biggest message for employers is that prevention matters.
The changes encourage employers to think about harassment before something happens, rather than relying solely on a complaints process after an employee has already experienced inappropriate behaviour.
For a home or office-based business with relatively little contact with external parties, the risks may look very different from those of a pub, care provider, retailer or healthcare organisation.
The important thing is to identify the risks that apply to your workforce and put proportionate preventative measures in place.
Is your business ready for October 2026?
With the new provisions coming into force on 30 October 2026, employers should use the coming months to review their policies, risk assessments, reporting arrangements and training.
Being able to show that you have considered the risks and taken appropriate preventative action will become increasingly important.
Paveley HR can help you prepare for the October 2026 changes, from reviewing your existing policies and procedures to identifying areas of risk and supporting managers with practical training.
If you're unsure whether your current arrangements are sufficient, get in touch with Paveley HR to discuss what your business should have in place before the new rules take effect.