Third-party harassment: October 2026

From 30 October 2026, third-party harassment is not an awkward guest and it is not “part of the job.” It is a standalone claim. An employer is liable where a worker is harassed by a customer, client, contractor, patient, or member of the public in the course of employment — unless the employer took all reasonable steps to prevent it.

There is no prior-incident requirement. No three-strikes rule. No knowledge threshold that lets you wait until it has happened twice. The first call can be the claim. If you run a contact centre, a shop, a hospital, a hotel, or any customer-facing operation, this is not a footnote in a policy. It is the claim that can arrive before you have a second incident to point at.

The preventative duty as a whole is all reasonable steps. What follows is who is liable, what “in the course of employment” means for an agent on the phone, and what a frontline worker actually needs to be able to do before the next abusive caller is in their ear.

Who counts as a third party

A third party is anyone who is not the employer and not a fellow worker. Customers. Clients. Patients. Contractors. Delivery drivers. Members of the public. The person on the other end of the headset. The guest at the table. The client at the off-site.

That definition is wider than most “respect at work” modules. Those modules are written as if the risk lives inside the org chart. For a contact centre, a shop, a hospital, a hotel, a stadium, or a professional-services firm that still takes clients to dinner, the risk often walks in from outside — or dials in.

The Employment Rights Act 2025 restoration of third-party liability is not limited to sexual harassment. It covers harassment related to protected characteristics. Sexual harassment is the search term, and it is the preventative-duty sibling. Do not write a customer-abuse script that only covers swearing. The comment about someone’s body, the “banter” aimed at a woman on the phones, the client who will not stop — those are the incidents this law is for.

Unite’s hospitality research has, for years, found that the vast majority of workers in that sector have experienced sexual harassment, much of it from customers. Women who work for tips are hit harder. The British Retail Consortium has reported sharp rises in abuse of shop workers. Contact-centre leaders already know the Friday-night call. The law is catching up to the floor.

Who is liable

The worker is not expected to absorb it as a cost of doing the job. The employer is liable if the harassment happened in the course of the worker’s employment and the employer failed to take all reasonable steps to prevent it.

That is a different shape from vicarious liability for a colleague’s act. You are not being asked whether the customer was “your employee.” You are being asked whether you equipped your people — and designed your operation — so that this was less likely, and so that when it happened someone knew how to stop it.

The traditional response is a poster (“we will not tolerate abuse of our staff”) and a line in the policy. Posters are not a step aimed at the moment. A policy that tells agents to “remain professional” while a caller describes their body is an instruction to endure. Endurance is not prevention.

All reasonable steps, in this context, looks like: you assessed the customer-facing risk, you gave people a practised way to shut it down, you gave them permission to end the interaction, you had a live escalation path, and you can show that this is how the operation actually runs — not how the induction slide describes it.

In the course of employment — including on the phone

“In the course of employment” is about the worker’s work, not the harasser’s contract with you. An agent taking a customer call is at work. A home worker on the same queue is at work. A shop assistant on the till is at work. A consultant at a client dinner is usually at work. The headset does not make it private life.

This is the point contact-centre employers still under-read. The harasser is a stranger. They may never have an account again. They are not in the building. None of that takes the agent out of the course of employment. The call is the job.

Hybrid and remote work do not help you. If the worker is doing the work you pay them for, a sexually abusive caller is third-party harassment in the course of employment. “They were at the kitchen table” is not a defence. “We could not control the customer” is not the test. The test is what you did to prevent it and to make the response possible.

Lone working, night shifts, public-facing roles, roles that work for tips, and roles where the customer holds the power (complaints, collections, hospitality, care) should already be on the risk assessment. If they are not, you are assessing offices and missing the floor.

What a frontline worker needs in the moment

A policy paragraph cannot be retrieved under adrenaline. What the worker needs is a sequence they have already said out loud.

1. Shut the customer down. A sentence that exists. Firm, short, not a debate. “I’m going to stop you there. I can help with your account. I will not continue this call if you speak to me like that.” Not a joke to defuse it. Not a silence that teaches the caller it worked. Not “I don’t mind, I’ve heard worse.”

2. Escalate. Not “I’ll mention it at huddle.” A live path: supervisor barge-in, a wrap-up code that means something, an incident log that is not optional, a named person who is actually on shift. If the only escalation is “tell your manager later,” you have asked them to carry it alone until the next break.

3. Stay safe. Permission to end the call or walk away, written in the same policy that tells them to be commercially helpful. Aftercare that is not “take the next one.” A worker who has just been sexually abused on a recorded line should not be measured on average handling time for the following twenty minutes.

If your quality framework still scores “kept control of the call” as staying on the line through abuse, the framework is part of the risk. You cannot tell a tribunal you took all reasonable steps if your own QA punished the step.

Managers need a fourth skill the floor does not: the private follow-up afterwards — with the worker, not only with the incident form. That conversation is cousin to the manager training problem. Most harassment still never reaches a formal complaint. The worker will decide, in that 1-1, whether the organisation meant the poster.

A practised scenario, not a policy paragraph

The status quo is a module that says “report it” and a call-handling script that says “empathise, then solve.” Neither one is the sentence you need when a caller crosses the line.

We treat this as a conversation you rehearse before it is live — the same way contact-centre teams already rehearse arrears, vulnerability, and the cancellation they were not trained for. The customer who sexually harasses an agent is one of those calls. It should sit in the same library as “I can’t afford this,” not in a once-a-year respect course.

People can rehearse that call against an AI partner who does not get embarrassed, does not let you off, and does not stop because the room went quiet. You can build the exact caller your floor actually gets — the collections account, the late-night hospitality guest, the client who thinks the dinner is the point. Every attempt is scored. The artefact is a dated record that this person could shut it down, escalate, and not freeze.

realtalkstudio.com

The sibling conversation for managers — a colleague reporting a sexualised comment, privately, before it is a grievance — is the follow-up after banter. The disclosure that asks you to keep it quiet is Please don’t tell anyone.

If you run a contact centre, start on the customer service page and add the third-party harassment call to the same cohort model: two hours off the phones, against your QA, before the hard call is live. That is a reasonable step aimed at the risk you actually have.

What “all reasonable steps” looks like here

A defensible third-party file is specific. It is not a generic “we do not tolerate abuse” statement.

• The risk assessment names customer-facing roles, channels (phone, chat, shop floor, events), times of day, and whether anyone has practised the shut-down.
• The policy gives permission to end the interaction and says who takes the incident.
• Training for the floor is the sentence and the escalation, spoken, with pushback — not a cartoon that says “that’s inappropriate.”
• Training for managers is the follow-up with the worker, and the client conversation if the third party is a revenue relationship.
• Evaluation: you can show who has passed, who has not, and what you did about their queue. Completions of a knowledge module do not do that job.

The board-facing list is the reasonable steps checklist. The duty as a whole is all reasonable steps.

FAQ

Frequently asked questions

01What is third-party harassment?

Harassment of a worker by someone who is not the employer or a colleague — a customer, client, contractor, patient, or member of the public. From 30 October 2026 UK employers can be liable unless they took all reasonable steps to prevent it.

02What does the Employment Rights Act say about third-party harassment?

From 30 October 2026 it restores standalone employer liability for third-party harassment in the course of employment, with an all-reasonable-steps defence. Confirm the live wording with counsel. It is not limited to sexual harassment.

03Are we liable if a customer harasses an agent on the phone?

If the agent is working, they are in the course of employment. The fact the harasser is a caller rather than a visitor does not take the incident outside the duty. What matters is what you did to prevent it and to equip the agent to respond.

04Do we have to wait for it to happen more than once?

No. The restored liability is not a three-strikes rule. Plan for the first incident. That is what “preventative” means.

05What should a frontline worker actually do?

Shut the interaction down with a practised line, escalate on a live path, and stay safe — including ending the call. Then a manager should follow up with the worker. None of that is a multiple-choice answer.

06Is a poster enough for third-party harassment?

No. A poster can support a culture. It is not evidence that anyone can handle the moment. Pair it with a risk assessment, permission to end the interaction, and practised response.