An employer can now be liable when someone outside the organisation harasses one of its employees.
Section 21 of the Employment Rights Act 2025 inserts new subsections (1a) to (1c) into Section 40 of the Equality Act 2010. An employer must not permit a third party to harass an employee. It “permits” harassment if the harassment happens in the course of the employee’s employment and the employer failed to take all reasonable steps to prevent it.
A third party is anyone other than the employer or one of its own employees. That means customers, clients, patients, service users, suppliers’ staff and members of the public. Harassment online counts as well as harassment face to face.
The new duty covers every form of harassment under Section 26 of the Equality Act 2010. A parent who racially abuses a teacher, or a client who mocks a worker’s disability, is also within scope.
To avoid liability, the employer must show it took all reasonable steps, and NOT just some reasonable steps. Tribunals already apply that test to the vicarious liability defence and the case law is strict. A “step” can be one the employer should have taken even if it might not have prevented the harassment (Canniffe v East Riding of Yorkshire Council). Out-of-date training and a policy nobody reads will not be enough.
There is no exception for overheard conversations or the expression of opinions, despite concerns raised while the Bill went through Parliament. The government’s position is that a “step” which would interfere disproportionately with a third party’s freedom of expression is not a reasonable step. Expect that to be tested, particularly in pubs, bars and restaurants.
Where the harassment is sexual and the claim succeeds, the Tribunal can increase compensation by up to 25% if the employer also breached its preventative duty under Section 40 of the Equality Act 2010.
So, what should employers do?
First, identify which third parties staff deal with and where the risks lie: lone working, late shifts, alcohol, client sites, etc.
Second, give staff a clear reporting route, record every incident and act on it. A warning, a ban or a change to staffing is evidence of reasonable steps. Doing nothing is evidence of the opposite.
Third, ensure all staff are properly trained, and proper risk assessments and policies are in place.