Third-Party Harassment: Customers, Clients and Suppliers

A member of the public leans over the pharmacy counter and shouts sexually explicit comments at a young dispensing assistant. A supplier's site manager makes an unwelcome comment to a facilities coordinator every time he visits. A hotel guest corners a housekeeper in a stairwell after his evening at the bar. None of the people involved works for the employer whose staff member is affected — but all three incidents fall squarely within UK harassment law, and UK employers now carry a positive legal duty to prevent this kind of harassment before it happens, not simply respond once it has.

Most workplace harassment policies were written with colleague-to-colleague conduct in mind: a manager, a teammate, someone on the payroll. Third-party harassment — carried out by customers, clients, suppliers, contractors or members of the public — is a different problem, and it is one that gets far less attention than it should, even though it now sits at the centre of what "reasonable steps" mean under UK employment law. This guide sets out what counts as third-party harassment, why it is so often missed, what the law actually requires, and the practical steps that reduce the risk in customer-facing and field-based roles.

What Counts as Third-Party Harassment

Third-party harassment is unwanted conduct — verbal, physical or online — that has the purpose or effect of violating a worker's dignity, or creating an intimidating, hostile, degrading, humiliating or offensive environment for them, carried out by someone who is not employed by the organisation. The person responsible might be:

• A customer or member of the public in a retail, leisure or transport setting
• A patient, service user or their visitor in a healthcare or care setting
• A client visited during field sales, home care, utilities or trades work
• A supplier, contractor or delivery driver attending site
• A guest or diner in hospitality

It can be sexual in nature, or related to any protected characteristic — race, disability, age, religion, sexual orientation and so on. The common thread is that the harasser sits outside the employment relationship, which is exactly why this category tends to fall through the gaps in policies built around internal conduct. For broader context on how harassment prevention fits within an organisation's wider people obligations, see Learnsignal's core harassment-prevention guide.

The Legal Position: October 2024, and the Stronger Duty from October 2026

The Worker Protection (Amendment of Equality Act 2010) Act 2023 came into force on 26 October 2024. It introduced a new, proactive duty requiring employers to take reasonable steps to prevent sexual harassment of their workers — and the Equality and Human Rights Commission's (EHRC) guidance is explicit that this duty extends to harassment by third parties, not only by colleagues. Employers are expected to maintain a robust anti-harassment policy that covers third-party conduct and to carry out risk assessments that consider customer- and client-facing roles specifically.

It is worth being precise about scope, because this area of law has moved more than once. An earlier version of the 2023 Act would have reinstated a specific, standalone right for a worker to bring a claim directly against an employer for failing to prevent third-party harassment — a provision that existed in the original Equality Act 2010 until it was repealed in 2013. That specific third-party liability clause was removed from the Bill during its passage through Parliament, and the standard was also softened from "all reasonable steps" to "reasonable steps" before it became law. So, since October 2024, the practical position has been: no separate standalone claim purely for a third party's conduct, but the preventative duty covering sexual harassment does explicitly include the third-party risk, and a tribunal can increase compensation by up to 25% where it finds an employer breached the preventative duty in a successful sexual harassment claim. The EHRC also holds independent enforcement powers and can act even without an individual bringing a claim.

That position is changing again. The Employment Rights Act 2025 reinstates direct employer liability for third-party harassment, due to take effect from October 2026, and broadens it well beyond sexual harassment to cover harassment related to any protected characteristic — age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. Under the new provisions, an employer that fails to take all reasonable steps to prevent a third party from harassing a worker will itself be treated as having permitted that harassment. Detailed regulations setting out what "all reasonable steps" means in practice are expected to follow a public consultation, but the direction of travel is clear: this is moving from a supporting factor in sexual harassment claims to a standalone, cross-characteristic liability with a higher bar.

For organisations that have treated third-party harassment as a secondary concern, this is a narrow window to get ahead of a materially stricter regime.

Why Third-Party Harassment Is Often Overlooked

Several factors make this category of harassment easy to miss, even in organisations that take internal conduct seriously:

• "The customer is always right" culture. Staff in retail, hospitality and call-centre roles are often trained to defuse and accommodate, which can bleed into tolerating conduct that should never be tolerated.
• Normalisation. In healthcare, care work and hospitality particularly, inappropriate comments or contact from patients, service users or guests are sometimes treated as "part of the job" rather than logged as incidents.
• Lone and field-based working. Field sales, home visits, deliveries and utilities work put staff alone with a client or customer, often without a colleague or manager nearby to intervene.
• Policy gaps. Harassment policies are frequently written for internal conduct only, with no reference to how a staff member should respond to, or report, harassment by someone outside the organisation.
• Inconsistent reporting routes. Where there is no clear process for logging incidents involving customers or suppliers, patterns — a repeat offender, a particular site, a particular shift — never surface.

Retail, hospitality, healthcare and field sales are consistently the highest-risk environments, simply because they combine high volumes of public contact with, in many cases, lone working and limited ability to remove a difficult individual from the interaction.

Practical Prevention Steps

The preventative duty is deliberately broad — there is no fixed checklist that guarantees compliance — but the following measures are consistently identified as good practice for reducing third-party harassment risk:

• Empower staff to end an interaction. Give employees explicit, unambiguous permission to walk away from, refuse service to, or end a call with a customer or client who is behaving inappropriately, without fear of it affecting their targets or performance review.
• Make policies visible to third parties, not just staff. Customer-facing signage, terms of engagement, booking confirmations and supplier or contractor codes of conduct should set out, in plain terms, that abusive or harassing behaviour towards staff will not be tolerated.
• Build in manager backup. Staff need a fast, reliable way to get a manager or supervisor involved in the moment, particularly in lone-working or field-based situations — not just a policy document to refer to afterwards.
• Log every incident, including "minor" ones. A consistent reporting and record-keeping process turns isolated incidents into visible patterns, which is essential both for risk assessment and for demonstrating that reasonable steps are actually being taken.
• Risk-assess customer-facing and field roles specifically. Treat exposure to third-party harassment as an occupational risk factor, in the same way as any other health and safety hazard, and target training and controls at the highest-risk roles and locations.
• Investigate consistently. When an incident is reported, it needs a fair, documented investigation in the same way an internal complaint would — Learnsignal's guide to conducting workplace investigations sets out a practical framework for handling this well.

How This Connects to — and Differs from — Internal Harassment Prevention

Third-party harassment prevention shares its foundations with internal harassment prevention: the same underlying anti-harassment policy, the same training on what harassment is and how to report it, and the same commitment to a workplace free of discrimination sits behind both. Both also sit within a wider equality, diversity and inclusion framework — see Learnsignal's guide to equality, diversity and inclusion in the workplace for how these obligations connect across an organisation.

Where the two diverge is in who the policy has to reach. Preventing colleague-to-colleague harassment is largely an internal exercise: recruitment, induction, internal communications, management behaviour. Preventing third-party harassment requires the policy to reach outward — customer communications, supplier and contractor agreements, site signage, booking terms — because the people whose behaviour you are trying to influence never see the staff handbook. An organisation with excellent internal harassment prevention but no external-facing measures has only done half of what the law now expects.

Frequently Asked Questions

Does the duty to prevent third-party harassment apply to all types of harassment, or just sexual harassment?

As things stand, the specific preventative duty under the Worker Protection Act 2023 applies to sexual harassment. From October 2026, the Employment Rights Act 2025 extends direct third-party harassment liability to all protected characteristics, not just sex, so employers should not wait for that date to start treating other forms of third-party harassment seriously.

Can an employer be held responsible for a customer's behaviour it didn't know about?

The preventative duty is forward-looking: it asks whether an employer took reasonable steps to prevent harassment happening in the first place, not only whether it responded well after the fact. A risk assessment, a visible policy and a clear reporting route are all things a tribunal or the EHRC can point to when assessing whether reasonable steps were taken, regardless of whether a specific prior complaint had been made.

Does this apply to suppliers and contractors, not just members of the public?

Yes. Anyone who is not employed by the organisation and interacts with staff in the course of their work — customers, clients, patients, suppliers, contractors and delivery drivers included — falls within the definition of a third party for these purposes.

What is the single biggest gap employers should close first?

In most organisations it is the absence of a clear, visible route for staff to report incidents involving customers, clients or suppliers, combined with unclear permission to end an interaction that has become abusive. Closing that gap costs little and immediately improves both staff confidence and the organisation's ability to demonstrate reasonable steps.

Third-party harassment sits at the intersection of people management, customer service and legal compliance, and the standard is only getting stricter. Learnsignal's accredited CPD courses help HR teams, managers and customer-facing staff understand their obligations under the Worker Protection Act 2023 and prepare for the changes arriving in October 2026, with practical training that goes beyond a policy left on a shelf.