A Customer Is Harassing Me at Work – Does My Employer Have to Protect Me?

Most employees know that if a colleague harasses them at work, they can raise it with their employer.

But what if the person making your working life miserable doesn’t actually work there?

A customer repeatedly makes sexual comments.

A client makes racist jokes during meetings.

A patient makes degrading comments about your sexuality.

A supplier behaves aggressively towards you every time they visit.

Or perhaps somebody has complained before, but the response has been:

“Unfortunately, they’re a customer. There’s only so much we can do.”

That answer is becoming increasingly difficult for employers to give.

There are already important protections and responsibilities around harassment at work. But from 30 October 2026, the law is changing significantly.

Employers will potentially be liable where employees are harassed in the course of their employment by third parties — such as customers, clients, patients or members of the public — unless the employer can show it took all reasonable steps to prevent that harassment. 

And the change isn’t limited to sexual harassment. The third-party provisions cover harassment relating to protected characteristics covered by the Equality Act harassment provisions, including age, disability, race, religion or belief, sex and sexual orientation. 

For employees who regularly deal with the public, that’s an important change.

Who is a “third party”?

Essentially, someone you encounter through your work who isn’t your employer or one of your colleagues.

ACAS gives examples including customers, clients and service users such as school students or healthcare patients. 

Depending on your work, it could therefore potentially include:

A customer in a shop.

A guest in a hotel.

A client you’re visiting.

A patient.

A passenger.

A contractor.

A member of the public.

The fact that somebody isn’t employed by your organisation doesn’t necessarily mean your employer can simply wash its hands of their behaviour.

What is actually changing?

At the moment, employers already have important obligations concerning workplace harassment, and since October 2024 there has been a proactive duty to take reasonable steps to prevent sexual harassment.

From 30 October 2026, that sexual-harassment duty becomes stronger.

Instead of taking simply “reasonable steps”, employers will be required to take “all reasonable steps” to prevent sexual harassment. 

At the same time, new third-party harassment provisions take effect.

An employer can potentially be liable if an employee is harassed by a third party in the course of their employment and the employer failed to take all reasonable steps to prevent it. 

That shifts the conversation.

The question is no longer simply:

“What did the employer do after somebody complained?”

Increasingly, employers need to be thinking:

“What risks did we know about, and what did we do to prevent this happening?”

What does “all reasonable steps” actually mean?

This does not mean employers can guarantee that nobody will ever behave badly.

That would be unrealistic.

What is reasonable will depend upon the organisation, its size, sector, workforce and the particular risks employees face.

ACAS explains the new standard as requiring employers to take all the steps that are reasonable for their organisation, rather than choosing only some of them. The emphasis is on prevention across the organisation, not merely reacting after an incident has occurred. 

That distinction is important.

A policy sitting on an intranet that nobody reads is one thing.

Understanding that employees regularly encounter inappropriate behaviour from customers and taking practical preventative action is quite another.

“But that’s just what customers are like…”

This is where workplace culture becomes important.

Certain sectors have historically normalised behaviour that employees shouldn’t necessarily have to tolerate.

Hospitality workers dealing with drunk customers.

Retail employees facing abuse.

Healthcare staff subjected to inappropriate comments from patients.

Junior employees expected to tolerate behaviour from valuable clients because somebody doesn’t want to upset the commercial relationship.

The problem is that when unacceptable behaviour becomes normalised, employees may stop reporting it.

Or worse, they report it once and learn that nothing meaningful happens.

That doesn’t make the risk disappear.

It may actually tell the employer that a risk exists.

And from an employer’s perspective, that matters.

What should happen when you report harassment?

An employer should take concerns seriously.

Exactly what happens next will depend upon what has occurred and the organisation’s procedures.

But the response shouldn’t simply be:

“They don’t work for us, so we can’t investigate them.”

It may be true that the employer cannot discipline a customer in the same way it could discipline an employee.

But that doesn’t mean there is nothing it can do.

Depending upon the circumstances, there may be ways of changing how contact is managed, escalating concerns to the third party’s organisation, restricting access, changing arrangements or taking other preventative action.

What is appropriate will depend on the circumstances.

And this is where the new law becomes important: the focus is increasingly on whether the employer has taken all reasonable steps to prevent the harassment.

What happens on the employer’s side?

This is where TrustForce’s employer-side experience is particularly useful.

When a serious harassment complaint arrives, a good employer should not only look at the individual allegation.

It should also start asking broader questions.

Did we know this person posed a risk?

Has anybody complained previously?

Were managers aware of inappropriate behaviour?

What guidance have employees been given?

What training have managers received?

What reporting routes exist?

Were risk assessments appropriate?

And after previous incidents, what actually changed?

ACAS is already telling organisations to prepare for the October changes by considering policies, training, reporting mechanisms and preventative measures. 

That means previous complaints may matter.

Not necessarily because they prove your complaint.

But because they may be relevant to what the employer knew and what preventative action it reasonably could have taken.

What if your employer tells you to ignore it?

That should make you think carefully about what is happening.

There is a significant difference between an employer saying:

“We’ve looked at this carefully and here’s what we’re going to do.”

and:

“That’s just how that customer is.”

One is an attempt to manage a workplace risk.

The other may be normalising it.

Employees sometimes minimise behaviour themselves because they don’t want to be seen as difficult.

They laugh something off.

Avoid a particular customer.

Ask a colleague to take the next meeting.

Change shifts.

None of those reactions necessarily means the behaviour was acceptable.

And an employer shouldn’t rely on employees silently reorganising their working lives around somebody else’s harassment.

Does the new protection only cover sexual harassment?

No.

This is an important distinction.

The strengthened preventative duty specifically concerns sexual harassment.

But the new third-party harassment provisions extend more broadly across the harassment protections covered by the Equality Act, including harassment related to age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. 

So this isn’t only about unwanted sexual comments from customers.

It may also concern racist abuse, disability-related harassment or other unlawful harassment by third parties.

Should I wait until 30 October to raise something?

No.

If you are experiencing harassment now, the fact that further legal protections come into force on 30 October does not mean your employer currently has no responsibilities.

Existing Equality Act protections remain relevant, employers already have a preventative duty concerning sexual harassment, and employers have wider responsibilities towards the wellbeing and safety of their workforce.

The October change strengthens the legal framework.

It shouldn’t become a reason to tolerate unacceptable behaviour in September.

Don’t just ask whether the behaviour was wrong

If you’re experiencing harassment from somebody outside your organisation, there are really two issues to understand.

The first is obvious:

What did the person do?

But the second can be equally important:

What did your employer know, and what did they do about it?

Those are different questions.

If previous incidents have occurred, complaints have been made or managers were aware of a continuing problem, the employer’s response may become particularly important.

That doesn’t mean every unpleasant customer interaction amounts to unlawful harassment.

Employment law is more nuanced than that.

But employees shouldn’t automatically assume they lose workplace protection simply because the person causing the problem signs the cheques, buys the product or receives the service.

Frequently asked questions

Does this mean my employer is responsible every time a customer behaves badly?
No. Liability isn’t automatic. Under the new third-party provisions, the question includes whether the employer took all reasonable steps to prevent the harassment. 

Does third-party harassment only mean customers?
No. ACAS says a third party can include customers, clients and service users, among others. 

When does the new law start?
The strengthened harassment provisions are scheduled to take effect on 30 October 2026 in England, Scotland and Wales. 

What if my employer already knows this person behaves like this?
That may be important. What the employer knew, what risks were foreseeable and what preventative steps it took can all be relevant. The precise legal position will depend upon the circumstances.

Someone in your corner

If you’re experiencing harassment from a customer, client or somebody else you encounter through work, don’t assume that “they don’t work here” ends the conversation.

At TrustForce, we can help you look at what has happened, how your employer has responded and what may be going on behind the scenes before you decide your next step.

Because sometimes the issue isn’t only who behaved badly.

It’s what your employer did once the risk became clear.

TrustForce — Someone in your corner.

www.trustforce.co.uk
support@trustforce.co.uk