When a customer harasses your employee, who pays the price?

Support from your HR consultant in Thanet to prepare your business for the new third-party harassment duty arriving in October 2026.

As an owner of a small business, you might assume that harassment is only your problem when it happens between colleagues.

From October 2026, that assumption will land you in front of a tribunal.

A new legal duty is going to make you directly liable when a customer, client or contractor harasses one of your team.

And the burden of proof sits with you to show what you did to prevent it.

Here's what you need to have in place and how to get it sorted.

What your harassment policy needs to say about third parties

Most harassment policies only deal with behaviour between employees. That's the first gap to close.

Your policy needs to specifically reference people outside your organisation. Customers, clients, suppliers, contractors and members of the public should all be named. If your policy just uses the word "harassment" without spelling out who it covers, a tribunal has no way of knowing whether you'd even considered the risk from external people.

Beyond naming who's covered, your policy should confirm that harassment from someone outside the business is treated with equal seriousness to harassment from a colleague or manager. Too many businesses quietly treat these incidents as "customer service issues" and move on. Under the new duty, that won't hold up.

You also need a clear statement that your employees are never expected to tolerate poor behaviour for the sake of keeping a customer or client happy. If someone on your team has been harassed, they shouldn't feel pressured to carry on serving that person or smooth things over.

How reporting should work for third-party incidents

Your internal grievance process is built around situations where the person causing the problem is another employee. It assumes formal meetings, investigations and outcomes that involve someone on your payroll.

When the issue involves a customer walking through the door or a contractor on site, that process doesn't fit.

A third-party incident needs a quicker, more practical route. Your staff should know they can report directly to a line manager or duty manager at the time it happens. Waiting days for a formal grievance meeting isn't appropriate when someone's been harassed by a member of the public during a shift.

Make sure your team actually know this route exists. Briefing client-facing staff on their right to report and what happens next is part of demonstrating you've taken "all reasonable steps."

Are you prepared to act against the customer?

Here's the bit most businesses haven't thought through.

Your policy should commit to taking action against the third party, not just supporting the employee after the fact. That might mean issuing a warning to a client, refusing to serve someone, ending a supplier contract or barring a customer from your premises.

I know that feels uncomfortable. Especially if it's a client who brings in good revenue. But the new duty doesn't give you room to weigh up the commercial relationship against your employee's right not to be harassed.

If you can show that you were willing to act, and that you did act when it was warranted, you're in a far stronger position.

What does "all reasonable steps" actually look like?

You can't control how other people behave. Nobody expects you to. But you do have full control over your own policies, your processes and how you respond.

For third-party harassment specifically, a tribunal will be looking at whether you had:

• A policy that explicitly addresses harassment from people outside the business
• Staff who knew how to report an incident involving a customer or client
• An escalation route designed for these situations, separate from your standard grievance process
• Evidence that you were prepared to take action against the third party
• A written record of what happened and what you did about it

If any of those pieces are missing, you're relying on luck. And luck isn't a defence at tribunal.

What does the new duty cover?

The obligation applies across all relevant protected characteristics. That includes age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.

So whether a customer makes a racist comment to a member of your team or a contractor makes unwanted remarks about someone's age, you have the same obligation to have taken all reasonable steps to prevent it.

It's also worth knowing that the standard for sexual harassment claims is changing at the same time. The test moves from "reasonable steps" to "all reasonable steps." The difference matters. You'll need to demonstrate there was nothing more you could reasonably have done.

A sample policy clause worth considering

If you're wondering what a third-party harassment clause might look like in practice, here's an example:

"This policy covers harassment by anyone an employee encounters through their work, including customers, clients, suppliers, contractors and members of the public. Any report of harassment by a third party will be investigated and treated with the same seriousness as harassment involving a colleague. The business may take action including speaking to the individual, withdrawing service or ending the relationship where appropriate."

That's a starting point. Your own clause should reflect how your business operates and the types of third-party contact your team has.

Questions to ask yourself before October

• Does your current harassment policy mention customers, clients or members of the public by name?
• Do your client-facing staff know who to tell if something happens with a customer, and do they know they can report it straight away?
• Have you documented any past incidents involving third parties, even ones that felt resolved at the time
• Do you have a written risk assessment that covers the specific third-party contact situations in your business?
• Would you actually be willing to end a client relationship if that client harassed a member of your team?

 

If any of those gave you pause, it's worth getting your policy and processes reviewed before the deadline.

 

Getting your business ready

As part of my HR consultancy services in Thanet, I work with small businesses to review harassment policies and put practical, workable processes in place for exactly this kind of situation.

If a customer or client has already caused problems for someone on your team, it's better to get advice now rather than after the new duty kicks in.

Even if nothing has happened yet, having the right policy and reporting route in place before October means you're covered.

As an outsourced HR consultant in Thanet, I can help you get this sorted quickly and simply.

If you'd like to talk it through, get in touch and we can book a discovery call.