Third Party Harassment: The Blind Spot in Most Workplace Harassment Policies
Say the words "workplace harassment" and most people picture the same thing: two colleagues, one incident, a policy that gets pulled out of a drawer. That's where the training goes, that's where the reporting process points - it's what most policies are actually built for.
But a lot of harassment doesn't come from a colleague at all. It comes from the customer shouting down the phone, the patient who won't stop commenting, the delegate at the conference who doesn't know when to stop, or the client who says something in a meeting and expects it to slide.
That's third party harassment: harassment from someone who doesn't work for your organisation at all. And the law is starting to take it a lot more seriously.
Download our free Third Party Harassment toolkit here.
Third party harassment: who actually counts as a "third party"?
The definition is broader than most people assume. A third party is anyone who isn't employed by your organisation but who your staff come across through their work. In practice, that's:
- Customers and clients
- Patients and service users
- Students
- Contractors and suppliers
- Consultants and freelancers
- People attending conferences and events
- Employees' friends or family
- Members of the public
If your staff deal with people from any of these groups, you already have third party harassment risk in your organisation. Whether it's on anyone's radar yet is a different question.
What third party harassment actually looks like
It's not one scenario. It shows up differently depending on the industry.
A retail worker gets racially abused by a customer. A hotel worker gets sexually harassed by a guest. A nurse gets a comment from a patient that they have to just absorb and carry on. Event staff get touched by someone at the bar who's had too much. A consultant sits in a meeting and hears something discriminatory from the client paying the bill. A call centre worker gets threatened down the phone and has to stay professional anyway.
Sexual harassment tends to dominate the conversation, but the same protection covers race, disability, religion, gender reassignment, age, marriage, pregnancy, sex and sexual orientation too.
The law on third party harassment isn't waiting around
Here's where things stand right now - since October 2024, the Worker Protection Act 2023 has required employers to take proactive steps to prevent sexual harassment at work, and the EHRC has confirmed that includes third party harassment too. So employers can't just wait for something to happen and deal with it afterwards, they're meant to be looking for the risk and doing something about it before anyone gets hurt.
Get it wrong, and there are real consequences. The EHRC can investigate and take enforcement action. Tribunals can add up to 25% onto compensation where an employer hasn't taken reasonable steps. And there's often more sitting behind that one claim: constructive dismissal, discrimination, breaches of health and safety duties.
And it's about to get tougher. From October 2026, changes under the Employment Rights Act will push employer liability further:
That's a genuine shift. Right now, a lot of organisations are set up to respond once something's gone wrong. Soon, they'll need to prove they tried to stop it happening in the first place.
So what do you actually do about third party harassment?
You've got far less control over a customer or a member of the public than you do over an employee, so this takes more deliberate effort than a standard policy update.
Start by working out where the risk actually sits. Customer-facing roles, lone working, home visits, events, hospitality, night shifts, anywhere alcohol is served, work travel, shared workspaces with other employers. Some jobs carry a lot more exposure than others, and a proper risk assessment should reflect that.
Then say it out loud before anything happens. Zero-tolerance notices where people can see them. A line on the website or the booking form. Behaviour expectations shared before an event. A shared code of conduct with contractors and suppliers. Even a message on the phone line. None of this stops every incident, but it sets the tone, and it gives you something to point to afterwards.
Train your people properly. Staff need to know what harassment actually looks like, how to respond without putting themselves at risk, when and how to report it, and what support they'll get if they do. Managers need more than that - they need to know how to handle a report well, because a badly handled report does almost as much damage as the incident itself.
And make it easy to speak up. If reporting feels complicated, or risky, or pointless, people won't do it - especially when the person they're reporting is a customer, a client, or someone senior on the other side of a relationship. Anonymous routes help here more than almost anywhere else. When something is reported, what you do next might be a warning, removing someone from the premises, restricting their access, calling the police, upping security, running the risk assessment again, or just checking in with the person affected and making sure they actually feel safe going back to work.
.png)
The policy isn't the test, the response is.
Having a policy gets you to the starting line. What actually matters to your staff is what happens the moment someone reports harassment from a customer, a client, or someone senior. Brush it off to protect the relationship, and staff notice. They learn exactly which behaviour gets a pass and who it's allowed for. Take it seriously, and the opposite happens - staff trust that reporting means something.
From October 2026, that second option won't just be the right thing to do. Looking the other way for the sake of a client relationship will be a legal risk, not just a bad culture call.
Want the full Third Party Harassment toolkit? Download it here.
What we're reading
Latest insights from the front lines of workplace culture.
Third Party Harassment: The Blind Spot in Most Workplace Harassment Policies
Most harassment policies are built around one scenario: two colleagues, one incident. But a lot of harassment comes from outside the organisation - customers, clients, patients, delegates - and the law is catching up. Learn what third party harassment looks like in practice, where employer liability stands under the Worker Protection Act, and what changes from October 2026 under the Employment Rights Act, including a higher bar for "reasonable steps" and liability from the first incident.
What Happens Before a Misconduct Panel? Lessons from the University of Sussex
At a recent Community of Practice session, colleagues from the University of Sussex shared how they've strengthened their student misconduct processes. One insight stood out: successful outcomes don't start in the hearing room. They start long before a panel is ever convened.
The Tribunal Risk HR Leaders Can't Ignore
Featured in HR News, our latest research in the Culture Shifters Annual Report 26-27 reveals a stark gap between how confident HR professionals feel about sexual harassment compliance and what they can actually prove. Of 300 senior UK HR professionals surveyed, 91% said they're confident their organisation could evidence taking "all reasonable steps" to prevent sexual harassment if challenged today. But when asked to demonstrate specific measures, the evidence often isn't there. Only half can show clear reporting processes are in place. Only a third have measures to prevent retaliation.
Feeling inspired?
Take the first step toward preventative misconduct management with a demo of our Report + Support™ platform. We can show you how to breakdown reporting barriers with anonymous 2-way messaging, and how to act before things escalate with name-matching and pattern-spotting across our analytics dashboard.
