13 Sep When a customer harasses your staff, who pays the price?
Support from an HR consultant in Wychavon to prepare your business for the new third-party harassment duty arriving in October 2026.
I’ve been working with a number of clients recently who’ve had issues with customers behaving badly towards their staff.
What surprises most of them is that from October 2026, it could be the employer who ends up liable for that behaviour.
Not the customer. You.
A new legal duty is coming in that will make you directly responsible if you haven’t done enough to protect your people from harassment by third parties.
Here’s what you need to know and what to do about it.
What’s actually changing in October 2026?
Two shifts are happening at the same time. The first raises the bar on sexual harassment prevention. Where employers previously had to show they took “reasonable steps” to prevent it, the new standard requires you to demonstrate you took “all” reasonable steps. If a claim reaches a tribunal, you’ll need to prove there was nothing more you could reasonably have done.
The second change is brand new. Employers will become directly liable for harassment carried out by people who don’t work for them. That includes customers, clients, suppliers, contractors and members of the public.
This applies across all protected characteristics, including age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
If something happens and you can’t show what steps you had in place to prevent it, a tribunal can hold you accountable.
What does “all reasonable steps” look like in practice?
You can’t control what a customer says or does. But you can control how your business is set up to deal with it.
For third-party situations specifically, a tribunal will want to see evidence of things like:
- A harassment policy that specifically mentions third parties, not just behaviour between colleagues
- Staff who know they have the right to report an incident and understand the process for doing so
- A clear escalation route for incidents involving someone outside the business, separate from your standard grievance procedure
- A willingness to take action against the person responsible, up to and including ending the commercial relationship
- A written record of any incident and the steps you took in response
Without this kind of evidence, you’re exposed.
Your harassment policy probably has a gap
Most harassment policies I review are written with internal behaviour in mind. They cover how colleagues should treat each other. That’s important, but it’s only half the picture under the new rules.
Your policy needs to explicitly name the types of people your employees might encounter through their work. Customers, clients, suppliers, contractors and members of the public should all be referenced directly. A generic reference to “harassment” won’t demonstrate to a tribunal that you’d considered third-party risk at all.
It also needs to state clearly that harassment from an external party carries the same weight as harassment from a colleague or manager. Too often, incidents involving customers get treated as a customer service problem rather than a safeguarding issue for your employee.
Reporting needs to work differently for third-party incidents
Your internal grievance process assumes the person causing the problem is another employee. That doesn’t fit when the issue involves a customer standing in front of your staff member right now.
Third-party incidents need a reporting route that works in the moment. Usually that means going straight to a line manager or duty manager, rather than waiting days for a formal meeting.
Your team need to know this route exists. If they don’t, it’s the same as not having one.
Be prepared to act against the customer
This is the part most businesses overlook entirely.
Your policy should commit to taking appropriate action against the third party. That might mean having a conversation with the individual, issuing a formal warning to a client, refusing to serve someone, ending a supplier contract or barring a customer from your premises.
Critically, your staff should never feel they’re expected to keep serving someone who has harassed them just to protect a commercial relationship. If your policy doesn’t say that explicitly, your employees may assume the opposite.
An example of what a policy clause could say
A practical clause covering third-party harassment might read along these lines:
“This policy covers harassment by anyone an employee encounters through their work, including customers, clients, suppliers, contractors and members of the public. Any report of harassment by a third party will be investigated and treated with equal seriousness to harassment involving a colleague. The business may take action including speaking with the individual concerned, withdrawing service or ending a contract or relationship where appropriate.”
You can adapt the wording to suit your business, but the key elements need to be there.
What else to sort out before October
Beyond updating your policy, there are a few other things worth checking.
Make sure your staff actually know how to report an incident involving a customer and who they should speak to. If you ran a quick test right now and asked your team what they’d do, would they have a clear answer?
If an incident has already occurred, write down what happened and how you responded. Even if it felt resolved at the time, having a record matters. If you’re unsure whether your handling of a past situation would stand up under the new duty, get advice now rather than waiting until the rules are live.
You should also have a written risk assessment that looks at the specific situations in your business where employees interact with third parties. HR consultancy services in Wychavon can help you identify where your exposure sits and what practical measures to put in place.
Get your business ready before the deadline
I can review your current harassment policy, check it covers third-party situations properly, and help you put a straightforward process in place for handling incidents.
If a customer or client has already caused problems for one of your team, or you simply want to make sure you’re covered before October, let’s have a conversation.
As an outsourced HR consultant in Wychavon, I work with businesses like yours to get these things right without overcomplicating them.
Get in touch to book a discovery call and we’ll look at where you stand.
