Third-party harassment: your new duty of care

One of the most significant changes introduced by the Employment Rights Act 2025 — and one of the least discussed — is the reintroduction and strengthening of the duty on employers to prevent third-party harassment of their workers. If a customer, client, supplier, or member of the public sexually harasses one of your employees and you had not taken reasonable preventive steps, your organisation may be liable.

The previous third-party harassment provisions, introduced in the Equality Act 2010, required the harassment to have occurred on at least three occasions before liability attached. Those provisions were repealed in 2013. ERA 2025 reintroduces the duty in a stronger form: a single incident of third-party harassment can be enough to establish liability if the employer cannot show they took proactive steps to prevent it.

The standard is not perfection. The law does not require employers to eliminate all possibility of harassment — that would be impossible. What it requires is that employers take reasonable preventive steps. What does that mean in practice?

First, a clear and accessible anti-harassment policy. The policy should explicitly cover harassment by third parties — not just colleagues — and explain the reporting routes available to workers. It should be written in plain language, made accessible to all staff, and reviewed at least annually. A policy buried in a staff handbook that no one has read is not a preventive step.

Second, training for staff who deal directly with the public, clients, or customers. Training should cover what constitutes harassment, what workers can do if it happens, and what managers should do when it is reported. The training should be recorded — who attended, when, what was covered. If a claim is ever made, you want to show that prevention was taken seriously before the incident, not adopted as a response to it.

Third, a safe and visible reporting route. Workers need to know they can report third-party harassment without fear of disbelief, dismissal, or retaliation. The reporting process should be documented and the responses to reports should be logged. If a worker reports harassment and the employer's response is inadequate — no investigation, no follow-up — that absence of response can itself be used as evidence of a failure to take reasonable steps.

Fourth, a track record of acting on complaints. The preventive duty is ongoing, not a one-time exercise. If a pattern of harassment from a particular client or venue emerges and the employer does nothing to address it — does not speak to the client, does not adjust working arrangements, does not take any protective step — that inaction is relevant evidence in a tribunal claim.

Some sectors carry particular exposure: hospitality, retail, transport, care, and any environment where workers interact with members of the public in service settings. If your business operates in one of these sectors, a review of current prevention measures against the new legal standard is a reasonable and proportionate response.

Read our HR policies guide for which written policies are now legally required, and our ERA 2025 compliance checklist for a full audit of what to review.

Mellow's policy hub allows you to publish and track acknowledgement of your harassment policy across your workforce. [Start a free trial →](https://mellowhr.com/register)