When a customer harasses your staff, who pays the price?
Insight from an HR consultant in Ipswich on the new third-party harassment duty arriving in October 2026 and what you need to do before it lands.
From October 2026, you'll be legally responsible for protecting your team from harassment by customers, clients and members of the public.
That's new. Right now, most harassment policies only deal with behaviour between colleagues.
The incoming rules change that completely, and if you can't show what steps you took to prevent it, a tribunal could hold you liable.
Here's what's changing and what you need to have in place.
What you actually need to do first
Let's start with the practical stuff, because that's what matters most.
Your harassment policy almost certainly covers behaviour between colleagues. That's standard. But from October 2026, it needs to go further. It has to explicitly address harassment from people outside your organisation: customers, clients, suppliers, contractors and the general public.
If your policy just uses the word "harassment" without specifying who it applies to, a tribunal won't be able to see that you ever considered the risk from third parties. That distinction matters.
Your policy wording needs to do a few things clearly:
Name the people it covers. List customers, clients, suppliers, contractors and members of the public as potential perpetrators. Don't leave it vague.
Treat it with equal weight. Make it clear that harassment from someone outside your business is taken just as seriously as harassment from a colleague or manager. It shouldn't be downgraded to a "customer service" matter.
Give your team a way to report it that actually works. Your internal grievance process assumes the other person is an employee. That doesn't fit when the problem is a customer standing in front of your staff member right now. They need to be able to flag it to a line manager or duty manager immediately, not wait for a formal meeting days later.
Commit to acting against the third party. Most policies skip this entirely. Yours should state that the business will take action where needed, which could include warning a client, refusing to serve someone, ending a contract or barring a customer from your premises.
There's one more thing your policy should say plainly: your people are not expected to keep smiling and carry on serving someone who has just harassed them. No smoothing things over for the sake of the relationship. That expectation needs to be removed in writing.
A sample clause you could use
If you're wondering what this looks like on paper, here's an example of the kind of wording that would work:
"This policy covers harassment by anyone an employee encounters through their work, including customers, clients, suppliers, contractors and members of the public. Reports of harassment by a third party will be investigated and treated with the same seriousness as harassment involving a colleague. Action may include speaking to the individual involved, withdrawing service or ending a contract or relationship where necessary."
You can adapt this to suit your business. The point is that it exists and covers the right ground.
What's actually changing in the law
Two things are shifting in October 2026.
The first is an upgrade to the existing duty around sexual harassment. The standard is moving from "reasonable steps" to "all reasonable steps." In practice, that means if a claim reaches a tribunal, you'll need to demonstrate there was nothing more you could reasonably have done to prevent it. The bar is higher.
The second change is entirely new. Employers will have a direct legal obligation to take all reasonable steps to prevent their team from being harassed by third parties. Customers, clients, contractors, members of the public.
This applies across all protected characteristics, including age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
The key phrase here is "all reasonable steps." You can't control how a customer behaves. Nobody expects you to. But you can control your policies, your processes and how you respond when something happens. That's what a tribunal will look at.
Beyond the policy: what else needs checking
Updating your policy is the obvious step. But there's more to it than paperwork.
Ask yourself whether your client-facing team actually know what to do if a customer harasses them. Do they know who to tell? Do they know it'll be taken seriously? If the answer is "I'm not sure," that's a gap you need to close before October.
You should also have a written risk assessment that covers the specific situations in your business where your people come into contact with third parties. A retail environment has different risks to a consultancy office. A care setting looks different again. Your risk assessment should reflect your reality.
And if something has already happened, write it down. Record what occurred and how you dealt with it, even if you feel it's been resolved. If a future claim references a past incident and you've got nothing documented, that's a problem.
As part of our HR consultancy services in Ipswich, I regularly see businesses where an incident happened months ago and nobody recorded it. Getting that documentation in order now, before the new duty kicks in, puts you in a much stronger position.
What "all reasonable steps" looks like in practice
A tribunal won't expect perfection. But it will expect evidence that you thought about this risk and did something about it.
That means having:
A harassment policy that specifically names third-party harassment
Staff who have been briefed on their right to report and what happens next
An escalation route designed for incidents involving someone outside your organisation, separate from your standard grievance process
A willingness to act against the customer or client, up to and including ending the relationship
A written record of any incidents and your response to them
Without these things, you're relying on luck. And luck isn't a defence at tribunal.
Questions worth sitting with
Before October arrives, it's worth asking yourself a few honest questions:
Does your current harassment policy mention customers, clients or suppliers at all?
If one of your team was harassed by a customer tomorrow, would they know exactly who to report it to and how?
Have you ever had an incident involving a third party that wasn't formally recorded?
Would you be willing to end a client relationship to protect a member of your team?
If any of those gave you pause, that's your signal to act now.
Get your policy and process sorted before the deadline
I can review your harassment policy, help you put the right wording in place and build a straightforward process for handling third-party incidents.
If a customer or client has already caused a problem for someone on your team, it's better to get that looked at now rather than after the new rules are in force.
As an outsourced HR consultant in Ipswich, I work with small businesses to get this kind of thing right without overcomplicating it.
If you'd like to have a chat about where you stand, book a discovery call and we'll go through it together.
Comments