All Reasonable Steps? Investigating Third-party Harassment Under The Employment Rights Act 2025

The Employment Rights Act 2025 will make employers liable for third-party harassment unless they can show they took all reasonable steps to prevent it, with this new expanded duty expected to take effect in October 2026. This article considers why effective investigations will be central to demonstrating compliance with the new duty, and the challenges of investigating allegations involving individuals outside the organisation.

New employer liability for harassment by third parties

Changes under the Employment Rights Act 2025 (ERA) will mean that employers are liable if their employees are harassed by third parties in the course of employment, unless they can demonstrate that they took “all reasonable steps” to prevent the harassment. This duty will apply to every type of harassment, not just sexual harassment. It is expected that these measures will take effect on 30 October 2026 without further consultation. We have written in more detail about the proposals in our article.

What is third-party harassment?

Third-party harassment refers to harassment of an employee which is carried out by a person who is neither the employer nor a fellow employee (e.g. a contractor, customer or client of the employer). The Equality Act 2010 defines harassment as unwanted conduct related to a relevant protected characteristic (e.g. age, disability, race) that has the purpose or effect of violating an individual's dignity or creating an intimidating, hostile, degrading, humiliating, or offensive environment. Sexual harassment is defined separately as unwanted conduct of a sexual nature which has the same purpose or effect.

Third-party harassment can arise in many workplace settings, from members of the public targeting employees in service-facing roles (such as retail, hospitality or healthcare) to clients or contractors who the organisation has a commercial relationship with. The circumstances in which the harassment occurs will often shape the scope and nature of any investigation.

Why will the ERA changes make it even more important to investigate third-party harassment?

The circumstances surrounding third-party harassment can make it more challenging to investigate (see below). In some cases, this can lead to investigations being handled inadequately or, occasionally, not being carried out at all. However, the upcoming ERA changes should bring renewed focus to this area. Employers will need to treat allegations of third-party harassment with the same seriousness and rigour as any other form of harassment.

Once the changes take effect, a properly conducted investigation into third-party harassment will serve two key purposes:

1. It can be a reasonable step in its own right for the purposes of preventing future harassment. A thorough investigation enables the employer to respond appropriately to the allegation, identify any weaknesses in its existing controls, and determine what further measures may be required to reduce the risk of similar incidents occurring in the future.
2. It can be an important means of evidencing the employer's compliance with the preventative duty. A thorough investigation can help establish not only what happened, but also what preventative measures were already in place, how they operated in practice, and how the employer responded once concerns were raised. This evidential record may prove valuable if the employee later brings a claim and the employer needs to demonstrate that it took all reasonable steps to prevent the harassment.

Additional considerations when investigating third-party harassment allegations

Although many of the usual principles of workplace investigations apply, allegations of third-party harassment often present additional challenges and considerations for investigators. Some of the most common are set out below.

01. Limited control over the alleged harasser

In cases of third-party harassment, employers will often have limited control over the alleged perpetrator. Because the individual is not an employee, the employer will generally have no power to suspend, discipline or otherwise sanction them, and may have limited ability to require their cooperation with an investigation. This is particularly likely where the alleged harasser is a member of the public, and we have previously considered some of the challenges this can create in the context of co-working spaces. The position may be different where the alleged perpetrator, or their employer, has a commercial relationship with the employer. In those circumstances, it may be possible to secure a degree of cooperation as part of the investigation. However, this can raise practical questions about who should conduct the investigation, how information should be shared between the parties, and what data protection considerations need to be taken into account (see below). Employers should also review any relevant contractual arrangements with the alleged perpetrator or their employer. These may contain provisions governing conduct, cooperation with investigations, information sharing, or the steps that can be taken in response to substantiated allegations.

The practical consequence is that investigators cannot always expect the same level of access to the alleged perpetrator as they would in a conventional workplace investigation. In some cases, they may have no opportunity to interview the alleged harasser at all. As a result, establishing the facts can be more challenging, with greater reliance often being placed on the complainant's account, internal witnesses, contemporaneous documents, and other available evidence such as call recordings, emails or CCTV footage.

In these circumstances, the focus is likely to be on assessing the overall weight of the evidence and identifying points of corroboration, rather than simply resolving conflicting accounts. Investigators should be prepared to reach findings of fact despite evidential gaps, while being transparent about any limitations in the evidence available and the impact those limitations may have had on their conclusions.

It can also be helpful for investigators to explain the standard of proof that has been applied. Given that workplace investigations are typically conducted on the balance of probabilities standard, setting out how that standard was applied in a case where evidence is incomplete or unavailable may help demonstrate that the conclusions reached were fair, reasonable and evidence-based.

02. Scoping the investigation

From the employer's perspective, it will be particularly important to gather evidence relevant to the "all reasonable steps" question (i.e. whether the organisation took all reasonable steps to prevent the harassment from occurring). This may include evidence of previous incidents, risk assessments, training, policies, guidance, reporting mechanisms, and any preventative measures already in place. As a result, the investigation should be framed correctly from the outset. Its purpose is not simply to establish what happened, but also to assess whether the organisation's existing controls were adequate and whether it responded appropriately to protect its workforce. Additionally, employers may wish to consider whether it would be appropriate for the investigator to make recommendations, such as additional training or changes to existing processes, alongside their findings of fact.

It may also be appropriate to broaden the scope of the investigation beyond the individual incident. In some cases, there may be value in examining wider organisational factors, controls or cultural issues. For example, investigators might explore whether there is a pattern of similar behaviour by the same third party (such as a client or customer), whether particular roles or teams face an elevated risk of harassment, or whether there is an established culture of tolerating unacceptable behaviour from customers, clients or other third parties.

Taking this wider lens can help identify systemic issues that may not be apparent from the incident in isolation. It also enables employers to implement targeted improvements to policies, training, reporting mechanisms or working practices, helping to strengthen both employee protection and the employer's ability to demonstrate that it has taken all reasonable steps to prevent harassment going forward.

03. Impact of commercial sensitivities

Investigators should be aware that employees may feel more vulnerable reporting harassment by a third party than by a colleague. For example, they may fear that the organisation will prioritise its relationship with a client or customer over their complaint. Investigators should therefore take particular care to build trust, encourage open disclosure and ensure the complainant feels supported throughout the process. It can also be helpful to ensure that relevant policies expressly address third-party harassment, make clear that complaints will be taken seriously, and explain how concerns should be reported. In client-facing roles and those involving significant contact with the public, employers may also wish to implement a dedicated third-party harassment protocol, reinforcing that employee safety will not be compromised in order to preserve commercial relationships.

Investigations may also be complicated by commercial sensitivities, particularly where the alleged harasser is a key client or customer. In such cases, organisations should consider whether an external or independent investigator is appropriate, particularly where commercial interests could influence, or be perceived to influence, decision-making and undermine confidence in the investigation's impartiality.

04. Data protection considerations

Third-party harassment investigations raise more complex data protection considerations than standard workplace investigations because they involve processing personal data about individuals outside the employer's usual data processing frameworks. Where the alleged harasser is employed by another organisation, sharing personal data with that organisation introduces a second data controller, reducing the employer's control over subsequent handling. Employers and investigators should address these issues at the outset.

The employer must identify and document a lawful basis for processing personal data during the investigation. Legitimate interests will typically be the most appropriate basis, though employers should also consider whether processing is necessary for compliance with a legal obligation, particularly duties under the Equality Act 2010 and the forthcoming ERA provisions. Where legitimate interests are relied on, a legitimate interests assessment should be completed.

Harassment investigations frequently involve special category data, i.e. information about health, race, religion, sexual orientation or another protected characteristic, which requires both a lawful basis and a separate condition. The most relevant condition is likely to be that the processing is necessary to perform obligations in connection with employment, on the basis that employers are legally required to investigate allegations of harassment in order to protect their employees and show they have taken all reasonable steps.

The data minimisation principle requires the employer to process only personal data that is adequate, relevant and not excessive. This is particularly important in third-party investigations, where there may be a temptation to seek extensive records from the third party's employer. Investigators should set clear retention timescales at the outset for all investigation records including witness statements, correspondence and the investigation report, consistent with the organisation's data retention policy.

Any individual involved in the investigation, including the alleged harasser, may make a subject access request during or after the investigation. A request cannot be refused simply because the investigation is ongoing, though disclosure may be restricted or delayed where it would prejudice the investigation or an applicable exemption under the Data Protection Act 2018 applies (e.g. relating to the prevention or detection of crime, or the management forecasting exemption where disclosure would prejudice the employer's ability to conduct the investigation). Employers should consider taking legal advice before relying on an exemption and document their reasoning carefully. Requests from a third party's employer should be assessed by reference to whose personal data is being requested and that organisation's authority to act.

Employers must provide privacy information to data subjects whose personal data is processed. For employees, the workplace privacy notice will typically suffice but employers should verify it covers investigation-related processing. Where personal data is collected about a third party such as the alleged harasser, privacy information may also need to be provided unless an exemption applies, e.g. because providing it would be impossible, involve disproportionate effort or seriously impair the objectives of the processing by prejudicing the investigation. Any reliance on an exemption should be considered carefully and recorded.

Where an investigation involves sharing personal data with an organisation outside the UK, the employer must ensure the transfer complies with the UK GDPR's international transfer requirements. Given the practical pressures of investigations, employers should address these issues in advance and, where possible, agree data-sharing protocols with key third-party organisations before a complaint arises, covering matters such as the purposes for which shared data will be used, retention periods, access controls, security measures and deletion arrangements.

Given these complexities, data protection and employment teams should work closely together from the outset of any third-party harassment investigation. Embedding data protection considerations into investigation procedures will help employers manage risk, maintain the confidence of all parties and demonstrate compliance with both data protection and employment law obligations.

What should employers do?

Employers can take proactive steps both to reduce the risk of third-party harassment occurring and to ensure their policies and investigation procedures are equipped to deal with complaints involving third parties should they arise. These steps may include:

• Review policies and risk assessments: Ensure anti-harassment policies address third-party harassment in line with the EHRC guidance, and incorporate third-party harassment into workplace risk assessments (e.g. by identifying roles or environments involving significant contact with third parties). Consider implementing a third-party harassment protocol for public or client-facing roles and ensure your workplace privacy notice expressly covers investigation-related processing.
• Prepare staff and managers: Provide appropriate training and maintain effective reporting mechanisms.
• Use contractual protections: Include suitable conduct and cooperation obligations in contracts with third parties.
• Prepare to investigate: Review and update investigation procedures specifically for third-party scenarios, including how to engage with third parties and their employers, manage evidential gaps, protect confidentiality and personal data, and identify when wider organisational issues require further action.
• Define the scope of data to be collected and how it will be shared at the start of the investigation: The data sharing provisions (i.e. how shared data may be used, retention periods, how data will be transferred, access controls, deletion arrangements etc.) should be clearly set out and understood.
• Conduct a third-party harassment audit: Review past complaints, grievances, and exit interview data to identify patterns, high-risk roles, or recurring third-party issues that may previously have gone unaddressed.
• Establish escalation protocols with key third parties: Proactively agree frameworks with major clients, suppliers, or contractors setting out how complaints will be raised, investigated, and resolved between organisations, as well as how data will be shared.
• Create a centralised incident log: Maintain a dedicated record of third-party harassment reports (including informal ones) to identify trends over time.
• Review the physical working environment: For customer-facing roles, consider practical protective measures such as CCTV, lone-working protocols, panic buttons, or adjustments to working arrangements that reduce exposure to high-risk interactions. Remember to conduct a data protection impact assessment (DPIA) where any monitoring is likely to result in high-risk processing.
• Coworking spaces: If employees are required to work in coworking or shared office spaces, employers should tailor their approach to address the third-party harassment risks in this context.
• Ensure board-level accountability: Designate a senior leader or committee with responsibility for overseeing the employer’s approach to preventing third-party harassment, ensuring it is treated as a governance issue rather than solely an HR matter.
• Signpost employee support: Ensure employees in high-risk roles are aware of available support (such as EAPs, mental health first aiders, and designated harassment contacts) and feel confident that complaints about third parties will be taken as seriously as complaints about colleagues.
• Consider a dedicated reporting line for third-party harassment: If incidents of third-party harassment are likely to arise regularly, particularly in large organisations where employees frequently interact with customers, clients or members of the public, employers may wish to establish a dedicated reporting line to make it easier for employees to raise concerns and access support. Employers should ensure data protection compliance is in place for the reporting line (e.g. conduct a DPIA, update privacy notice, restrict access to reports, agree retention periods etc.).

While investigating allegations of third-party harassment can be challenging for the reasons outlined above, employers that invest in robust investigation processes now will be better placed to demonstrate compliance when the new duty takes effect in October 2026.