Staff in care homes, hotels, pubs, restaurants and shops face harassment from third parties every day. A resident’s family member makes inappropriate comments to a carer. A hotel guest harasses reception staff. A pub regular directs racist remarks at bar workers. A customer verbally abuses a shop assistant.
From 30 October 2026, the law is changing. Under the Employment Rights Act 2025, employers will be directly liable if an employee is harassed by a third party – unless they can prove they took “all reasonable steps” to prevent it.For care, hospitality and retail businesses, where staff interact constantly with customers, service users and visitors, this is a significant shift.
If you employ frontline staff, now is the time to prepare.
What is changing and when?
The Employment Rights Act 2025 strengthens workplace protections against sexual harassment in two phases:
6 April 2026: Whistleblowing protection
Disclosures relating to sexual harassment now explicitly qualify for statutory whistleblowing protection. This offers enhanced safeguards against retaliation and the potential right to interim relief if an employee is dismissed for reporting harassment.
30 October 2026: Strengthened employer duties
Two major changes take effect:
1. “All reasonable steps” duty
The proactive legal duty on employers is raised from taking “reasonable steps” to taking “all reasonable steps” to prevent sexual harassment. This is a higher threshold. Employers will need to demonstrate they have done everything reasonably possible to prevent harassment.
2. Third-party harassment liability
Employers will be directly liable if an employee is harassed by a third party — such as clients, customers, residents, visitors or contractors — unless they can prove they took “all reasonable steps” to prevent it.
Tribunal compensation uplift
If an employee wins a sexual harassment claim and the Employment Tribunal finds the employer failed in its preventative duty, compensation can be increased by up to 25%.
Why this matters for care, hospitality and retail
These sectors are on the front line. Staff regularly interact with people who are not employees:
- Care homes: Residents, family members and visiting professionals
- Hotels: Guests, event attendees and contractors
- Pubs and restaurants: Customers, delivery drivers and suppliers
- Retail: Shoppers, sales representatives and members of the public
Until now, many employers have focused harassment policies on colleague-to-colleague behaviour. From October 2026, that is not enough. You must also take all reasonable steps to protect staff from harassment by third parties.
Real scenarios employers will recognise
Care
A resident’s adult son visits regularly and makes sexual comments to care staff. Staff feel uncomfortable but nothing is done because “he’s family.”
Hospitality
A hotel guest makes repeated advances towards a receptionist. The manager tells staff to “keep him happy” because he is a regular.
A pub customer makes racist remarks to bar staff. Other customers hear it but the manager does not intervene.
Retail
A customer verbally abuses and threatens a shop assistant who asks them to wait. The assistant is told to apologise to avoid a complaint.
Under the new law, if employers fail to act in situations like these, they could face direct liability — and compensation could be uplifted by 25%.
What does “all reasonable steps” mean?
The law does not define exactly what “all reasonable steps” means, it will depend on the size, resources and circumstances of your business. However, the government has indicated that employers should:
- Update risk assessments — revisit and document workplace risk assessments specifically regarding sexual harassment and third-party interactions
- Revise policies — update staff handbooks, reporting procedures and grievance channels to reflect the “all reasonable steps” standard
- Provide training — deliver comprehensive, tailored training on how to handle complaints, including interactions with customers and clients
For frontline employers in care, hospitality and retail, this means thinking carefully about how staff interact with third parties and what you can do to prevent and respond to harassment.
A practical checklist for care, hospitality and retail employers
Here are six steps you can take now to prepare:
1. Review your policies
Do your harassment and dignity at work policies cover third-party harassment, not just harassment by colleagues? If not, update them before October 2026.
2. Conduct a risk assessment
Where do your staff interact with third parties? What situations create risk? Document your assessment and the steps you are taking to manage those risks.
3. Train your managers
Can your managers recognise harassment? Do they know how to respond when a customer, resident or visitor behaves inappropriately? Training is essential to demonstrate you have taken “all reasonable steps.”
4. Empower staff to report
Is there a clear, confidential route for staff to raise concerns? Do they trust that complaints will be taken seriously?
5. Act on complaints
Do you have a process for addressing incidents involving third parties? This might include warning customers, refusing service or reporting behaviour to relevant authorities.
6. Display your standards
Do customers, visitors and service users know how you expect them to behave? Consider signage, terms of service and verbal reminders where appropriate.
Common mistakes to avoid
- Assuming “the customer is always right” — this outdated mindset can leave staff unprotected and expose your business to liability
- Treating third-party harassment as less serious — harassment by a customer can be just as harmful as harassment by a colleague
- Having no policy or process in place — without documented steps, you cannot demonstrate you took “all reasonable steps”
- Failing to act when patterns emerge — if the same customer or visitor repeatedly causes problems, inaction creates risk
- Ignoring the new whistleblowing protections — from April 2026, staff who report sexual harassment have explicit legal protection against retaliation
How Supportis can help
The new third-party harassment duties do not need to be overwhelming. Supportis helps care homes, hotels, restaurants, pubs and retail businesses put the right policies, training and processes in place, so your staff feel protected and your business is ready for the changes ahead.
If you are not sure whether you are prepared for 30 October 2026, we can help.
Book a free consultation to discuss your business.
Frequently asked questions
What is third-party harassment?
Third-party harassment is harassment of an employee by someone who is not a colleague, such as a customer, client, service user, visitor or contractor. From 30 October 2026, employers can be directly liable for third-party harassment unless they took “all reasonable steps” to prevent it.
Are employers liable for harassment by customers?
From 30 October 2026, yes. Employers will be directly liable if a third party harasses an employee, unless the employer can prove they took “all reasonable steps” to prevent it.
What are “all reasonable steps”?
This is a higher standard than the previous “reasonable steps” duty. Employers must demonstrate they have done everything reasonably possible to prevent sexual harassment, including updating risk assessments, revising policies and providing training.
Do small businesses need a third-party harassment policy?
While there is no specific legal requirement for a standalone policy, having clear documented policies and procedures will help you demonstrate that you took “all reasonable steps” to prevent harassment. This is especially important for care, hospitality and retail businesses where staff regularly interact with third parties.
What happens if an employer fails to prevent harassment?
If an employee brings a successful sexual harassment claim and the Employment Tribunal finds the employer failed to take all reasonable steps to prevent it, compensation can be uplifted by up to 25%.
When do the new rules come into force?
Whistleblowing protection for sexual harassment disclosures came into force on 6 April 2026. The strengthened “all reasonable steps” duty and third-party harassment liability come into force on 30 October 2026.
