When the Harasser Is Your Customer

regulatory update · Employment · England & Wales

The New Workplace Rules Employers Need to Understand

By Claire Mullaney · 2026-10-29

From customers making sexual comments to staff, patients abusing healthcare workers and clients behaving inappropriately towards professional advisers, employers are about to assume greater responsibility for harassment that comes from outside their own workforce.

For years, businesses have largely concentrated their workplace harassment policies upon the behaviour of employees towards colleagues, with training, reporting procedures and disciplinary processes designed around problems arising internally.

From 30 October 2026, that approach may no longer be enough.

Changes introduced through the Employment Rights Act 2025 will strengthen employers’ responsibilities for preventing sexual harassment while also introducing liability relating to harassment committed by third parties, including customers, clients, patients, contractors and members of the public.

The change creates an important practical question for thousands of organisations across Britain: what responsibility does an employer have when the person harassing their employee does not actually work for them?

Customers, clients and patients will all potentially count

The new third-party provisions are deliberately broad because workplace harassment does not necessarily come from somebody appearing on the company payroll.

A third party could include a customer in a restaurant, a client dealing with a professional services business, a patient receiving healthcare, a student interacting with school staff, an external contractor or somebody attending a work-related conference or event.

Harassment can also happen online rather than exclusively during face-to-face interactions, making the issue relevant to businesses whose employees communicate with customers through email, messaging platforms or other digital channels.

Under the new legislation, an employer must not permit a third party to harass an employee during the course of their employment.

Crucially, the legislation says an employer will be treated as permitting that harassment where the employee is harassed during their employment and the employer failed to take all reasonable steps to prevent it.

That means the legal focus is not simply upon what an employer does after somebody complains. Businesses will increasingly need to consider what risks were foreseeable beforehand and what reasonable measures could have reduced them.

The customer is not always right when employees are being harassed

The changes could prove particularly significant within sectors where difficult or inappropriate customer behaviour has historically been treated as an unavoidable part of the job.

Hospitality workers regularly interact with customers who have consumed alcohol, healthcare professionals can encounter distressed or aggressive patients, retail employees deal continuously with members of the public, while professional services employees may develop long-running relationships with individual clients.

Employers operating in those environments will need to think carefully about the risks their employees actually encounter rather than relying upon generic policies written primarily around relationships between colleagues.

Acas gives the example of convenience-store workers who report threats and racist abuse from customers, only to be told by their employer that such behaviour is simply part of their job.

Under the forthcoming framework, dismissing concerns in that way is very unlikely to demonstrate that an employer has taken all reasonable steps to protect its workers.

Sexual harassment protections are becoming stronger at the same time

The third-party provisions arrive alongside a significant strengthening of the existing preventative duty concerning sexual harassment.

Since October 2024, employers have been required to take reasonable steps to prevent sexual harassment of employees through the Worker Protection Act 2023.

From 30 October 2026, that requirement changes from taking “reasonable steps” to taking “all reasonable steps”, increasing the emphasis upon proactive prevention rather than simply responding appropriately after an incident has occurred.

The distinction may sound small, but its practical consequences could be considerably larger.

Acas explains that employers will be expected to take all the preventative measures that are reasonable for their particular organisation, rather than selecting only some reasonable measures while leaving others unaddressed.

Those measures will differ according to the organisation’s size, sector, workforce and particular risk environment, meaning there is no single compliance checklist that will work for every employer.

Four in ten employers may not realise the law is changing

Despite the approaching implementation date, recent Acas research suggests substantial numbers of employers remain unaware of what is coming.

Research published by Acas in September found that 41 per cent of employers were unaware of important changes to the law surrounding the prevention of sexual harassment at work.

That knowledge gap could become increasingly important as businesses move towards a framework requiring them to demonstrate preventative action rather than simply producing a harassment policy after something has gone wrong.

For organisations regularly placing employees in contact with customers, patients, clients or other members of the public, assessing third-party risks could therefore become an increasingly important part of workplace management.

What could “all reasonable steps” actually look like?

The measures expected from individual employers will depend heavily upon the circumstances in which their employees work.

Acas recommends regularly assessing the risks of third-party harassment, recording incidents and the actions taken afterwards, reviewing workplace policies and ensuring employees understand how concerns can be reported.

Employers may also need to review contracts or terms and conditions involving customers, clients and suppliers, while making clear that harassment of employees can result in consequences.

Higher-risk workplaces may require considerably more practical safeguards, potentially including appropriate staffing levels, security arrangements, personal alarms, cameras, staff training or systems allowing employees to call quickly for assistance.

Importantly, businesses may also need to record why particular preventative measures were considered but ultimately judged unreasonable or inappropriate.

The emerging expectation is therefore considerably broader than simply inserting another paragraph into an employee handbook.

What happens when an important client crosses the line?

Perhaps one of the most difficult practical questions will arise when protecting an employee conflicts with preserving a valuable commercial relationship.

A business may find itself dealing with a longstanding client who repeatedly makes inappropriate comments towards an employee, a customer who sexually harasses hospitality staff, or a service user whose behaviour has previously generated complaints.

Those situations can force employers to make uncomfortable decisions about boundaries, commercial relationships and employee protection. The new legislation makes those decisions increasingly difficult to dismiss as purely matters of customer service.

For Maria Calvy, Principal Solicitor at Pearl Baker Solicitors, this is where the forthcoming changes could become particularly important in practice, especially for employers whose staff regularly interact with customers, clients or members of the public.

“The real test will come when the person causing the problem is a valuable client. Treating that as a customer service issue and hoping it goes away now carries real risk. Businesses should decide now where the line is and what they'll do when it's crossed. Protecting your staff has to come before protecting the account.”

Her comments highlight an important distinction within the new framework, because employers will increasingly need to consider potential harassment risks before an incident occurs rather than relying upon an appropriate response afterwards.

Where an employer knew, or reasonably should have recognised, that employees faced a particular risk, the question may increasingly become whether the organisation had already taken all reasonable steps to reduce that risk.

October 2026 deadline

The changes take effect across England, Wales and Scotland on 30 October 2026, while Northern Ireland operates under its own devolved equality and discrimination framework.

Employers therefore have only weeks remaining to examine whether their existing approach genuinely addresses harassment risks created by people outside their workforce.

For some businesses, preparation may involve refreshing policies and training, while others may need to examine customer terms, reporting systems, security arrangements and how managers respond when an employee raises concerns about somebody commercially important.

The fundamental change is straightforward even if implementing it may not be.

When somebody harasses an employee at work, the fact that the person happens to be a customer, client or member of the public will no longer mean the employer can regard the problem as somebody else’s responsibility.

Sources

Research conducted: September 2026

Department for Business and Trade, Workplace Sexual Harassment and Third-Party Harassment, 2026.

Department for Business and Trade, Plan to Make Work Pay and Employment Rights Act: Timeline Update, updated September 2026.

Acas, Third Party Harassment – Harassment Law Changes, updated August 2026.

Acas, Sexual Harassment – Harassment Law Changes, updated August 2026.

Acas, Sexual Harassment at Work: Why Prevention Cannot Wait, September 2026.

Employment Rights Act 2025, sections 20–22.

Research and sources checked September 2026. This article reflects the legislation, implementation timetable and official guidance available at that date.