# When a Customer Harasses Your Staff: What Hospitality Operators Need to Do by 30 October 2026

> From 30 October 2026, hospitality employers in England, Wales and Scotland must take all reasonable steps to prevent customers and other third parties harassing their staff. Here is what an independent venue can put in place now, without turning Saturday service into a legal exercise.

- Author: Alex Riesenkampff (Super44)
- Published: 2026-08-28
- Canonical: https://super44.ai/blog/uk-third-party-harassment-duty

## Key takeaways

- The new third-party harassment duty starts on 30 October 2026 in England, Wales and Scotland. It applies to employers of every size. Northern Ireland has its own equality and employment rules.
- Many operators already protect their teams by taking over a table, refusing service or asking a customer not to return. For them, the change is less about acting differently and more about making that response consistent, understood and recorded.
- This is a preventative duty. Waiting for someone to make a formal complaint is not enough; operators need to think about foreseeable risks such as alcohol, late finishes, lone working and staff serving large groups.

It is 10.45pm on a Saturday. A regular has made the same young server uncomfortable twice, but he spends well and insists he was joking. The floor manager is trying to close three tables, the owner is not on site, and nobody is quite sure who has the authority to tell him to leave.

That is the operating problem behind the new third-party harassment duty. It is not mainly a request for a longer employee handbook. It is a request to decide, before the next busy shift, who backs the member of staff and what happens to the customer.

**From 30 October 2026, employers in England, Wales and Scotland must not permit customers and other third parties to harass their employees.** In practice, an employer permits it where the harassment happens in the course of employment and the employer failed to take all reasonable steps to prevent it (Employment Rights Act 2025, section 21). The same date also strengthens the existing duty to prevent sexual harassment from "reasonable steps" to "all reasonable steps" (section 20).

*This article is general information, not legal advice. The law and guidance are current as at 28 August 2026. If an incident or claim is already live, take advice on the facts.*

Plenty of operators already do the important part. They take over a table when a server is uncomfortable, stop serving someone who has crossed the line, walk a colleague to their car after a bad close or tell a regular not to come back. **For many venues, 30 October will not mean a big change in how they protect their team.** It formalises that responsibility and asks the business to make its existing approach consistent, understood by every manager and clear enough to demonstrate.

## The five things to put in place before 30 October

For many venues, the bones of this are already in place. The work before October is to make the response clear enough that it does not depend on the owner being in the room or one experienced manager being on shift.

**A practical file for an independent venue**

- [ ] **Assess the shifts and roles where the risk is highest**: Look at alcohol service, late finishes, lone working, large groups, private events and any role that leaves one person dealing with a customer alone.
- [ ] **Make the policy name customers**: Say plainly that harassment by customers, delivery drivers, contractors and suppliers is covered, and that managers may refuse service or ask someone to leave.
- [ ] **Give staff two ways to report a concern**: The manager on shift is one route. Add another person or confidential channel in case the manager is unavailable, dismissive or involved.
- [ ] **Brief managers on the moment itself**: Agree who takes over the table, who speaks to the customer, when security or police are called, and how the employee gets home safely after a serious incident.
- [ ] **Keep a short, factual incident log**: Record what was reported, what the venue did and whether the same customer or risk has appeared before. Review the pattern, not just each entry in isolation.

*Write this for the venue you actually run. A daytime bakery, a late bar and a restaurant with private dining do not have the same risks.*

Nick Gibson, owner of The Drapers Arms in Islington, described the commercial decision behind that plan rather better than most policies do:

> “I’d put financial loss to one side and ask someone to leave the building.”

That does not mean ejecting someone over every awkward exchange. It means the team knows that protecting a good member of staff outranks keeping one table's spend.

## What the new duty covers — and where

The third party can be a customer, a delivery driver, a supplier, a contractor or anyone else who is neither the employer nor another employee. The harassment must happen in the course of the employee's work.

The new duty is broader than sexual harassment. It covers sexual harassment and harassment related to the characteristics covered by section 26 of the Equality Act: age, disability, gender reassignment, race, religion or belief, sex and sexual orientation. A customer's racist abuse of a waiter can therefore engage the duty just as unwanted touching can.

There are two limits worth stating clearly:

- **It is not strict liability.** A customer behaving badly does not automatically make the employer liable. The legal question includes whether the employer failed to take all reasonable preventative steps.
- **It does not apply in Northern Ireland.** These changes apply in England, Wales and Scotland. Northern Ireland has its own equality and employment rules, so operators there should follow the local requirements (business.gov.uk, updated 30 July 2026).

There is no small-business exemption. A venue with one employee is in scope on the same basis as a group with 20 sites; what counts as reasonable will differ with the risks and resources.

## Prevention starts before anyone reports anything

The easiest mistake is to write a complaints process and wait. The existing EHRC guidance describes prevention as a positive, proactive duty. Hearing nothing is not proof that nothing is happening, particularly where the customer is a regular, the employee is new or their future shifts depend on the manager taking the report well.

Start with a 20-minute conversation with the people who work the exposed shifts. Ask:

- Which customers or situations make you change how you work?
- When would you want someone else to take over a table or section?
- Who would you actually tell if the manager on duty was busy or involved?
- Is there a point in the close or journey home where you feel on your own?

The answers are the useful part of the risk assessment. "Customers may harass staff: medium risk" is paperwork. "After 10pm, the lone bartender can call the duty manager to take over service without first explaining why" is a control.

Current official guidance already points towards risk assessments, clear policies, reporting routes, training and records. The government says further guidance will be published before the new provisions commence. Ministers also have the power to specify particular reasonable steps through later regulations. Those possible regulations will add detail; they do not make the current duty unknowable.

## Give the manager on shift a simple response

A policy is only useful if it changes the next thirty seconds. The duty manager does not need to decide whether conduct meets a tribunal's legal definition while standing at the pass. They need a short operating sequence:

1. Get the employee away from the customer and check they are safe.
2. Put another person on the table, section or door.
3. Decide whether to warn the customer, stop service or ask them to leave.
4. Call security or the police if there is an immediate safety risk or possible crime.
5. Before the employee's next shift, agree the follow-up and record what happened.

Do not make the employee confront the customer, repeat the story to several managers or finish serving the table to avoid a scene. If the customer is a regular, the owner—not the youngest person on the floor—should decide whether they return.

Afterwards, ask what the employee needs rather than announcing it for them. That might include changing section, not serving that person again, getting home safely, having a colleague present for a follow-up conversation or taking advice about reporting the matter to the police. Keep them informed about what the venue does next.

## A policy has to be alive, not merely saved

In *Allay (UK) Ltd v Gehlen*, the Employment Appeal Tribunal agreed that equality training delivered about two years earlier had become stale. Staff had received it but failed to act when harassment happened, and refresher training was a further reasonable step the employer could have taken.

For a small venue, the answer is not a yearly slide deck from head office. Revisit the policy with the team, use situations from your own shifts and record when the briefing happened. New starters need it during induction; duty managers need to rehearse the in-the-moment response; everyone needs to know the second reporting route.

A ten-minute pre-service brief can cover more useful ground than a document nobody remembers signing.

Super44 connects to your POS and shows you where your money leaks — then tells you what to do about it: https://super44.ai

## If something has already happened

Do not begin by asking whether it was "serious enough" or whether the customer meant it. Begin with the person who experienced it.

- Check their immediate safety and wellbeing.
- Make sure they do not have to keep serving or dealing with the customer.
- Listen without asking them to prove the incident on the spot.
- Make a dated, factual record and preserve relevant CCTV or messages.
- Explain who will be told and what will happen next.
- Review whether the customer may return and whether the risk assessment now needs another control.

If the report involves assault, threats, an ongoing risk, a senior person or concern about how the venue previously responded, get tailored HR or legal advice promptly. Whether the employee wants police involvement is a conversation to handle with care; an immediate danger still calls for an immediate safety response.

## Backing staff without making a different equality mistake

Managers can refuse service and remove abusive customers, but they should not turn a sensible safety policy into automatic assumptions about disability.

The Equality Act's explanatory notes use the example of a pub licensee mistaking a customer with cerebral palsy for being drunk because of his speech. The practical lesson is short: act on the behaviour and the risk in front of you, pause where something may have been misunderstood, and get advice when the distinction matters. This is not a reason to leave an employee exposed while a manager debates the law.

## What a claim can cost

An employee will be able to bring a third-party harassment claim against the employer. Compensation in discrimination cases is uncapped and can include injury-to-feelings awards as well as financial loss.

Keep the separate duties separate here. If a tribunal finds sexual harassment and also finds that the employer breached the sexual-harassment preventative duty, it may increase compensation by up to 25%. That uplift does **not** automatically apply to every third-party harassment claim across all protected characteristics.

The better reason to act is more immediate. A team that believes the owner will sacrifice them to keep a regular or protect one night's takings is a team that stops reporting problems and eventually leaves. The policy is evidence; the operating decision is the protection.

## What to do this week

**Where does your venue stand today?** *(interactive decision helper in the web version)*

**Possible routes:**
- **Which best describes your current position on harassment by customers? — We have no written policy:** Start with the risky shifts. Ask the team where customers, alcohol, late hours, lone working or private events create pressure. The policy should be built around those answers. Next move: Write down your three highest-risk situations, the manager response and a second reporting route.
- **Which best describes your current position on harassment by customers? — A policy exists, but nobody has discussed it recently:** Turn the document back into an operating rule. A policy people cannot remember will not guide the next busy shift. Stale training has also failed employers in tribunal. Next move: Run a short team brief, rehearse one customer scenario and record who attended.
- **Which best describes your current position on harassment by customers? — The policy is current and incidents can be logged:** Test whether it works in practice. You have the foundations. The remaining risk is that staff do not trust the route or managers respond differently under pressure. Next move: Ask the team anonymously whether they would report a regular and review the incident log quarterly.
- **Which best describes your current position on harassment by customers? — Something has already happened:** Start with the person, then review the control. Check their safety and what they need for the next shift. Do not require them to keep serving the customer or confront that person themselves. Next move: Record the facts, agree the follow-up and get advice promptly if the incident or earlier response may create legal risk.

*General information, not legal advice. Based on the Employment Rights Act 2025 and official guidance available on 28 August 2026.*

The deadline is 30 October, but the useful test is the next Saturday night: if a customer crosses the line, does the person running the shift know exactly how to back the team? For many operators, the answer is already yes. The legal work is to make sure that answer remains yes when the owner is away, a new manager is running the floor or the customer is a valuable regular—and to keep enough of a record to show the approach is real.

The same Act carries the [shift-notice and cancellation-pay rights hospitality is still waiting on](/blog/uk-employment-rights-act-rotas), while [building a rota people can live with](/blog/fair-staff-rota-guide) covers the wider operating habits that help good people stay.

## FAQ

### Does the third-party harassment duty apply to my small cafe, pub or restaurant?

Yes, if you employ staff in England, Wales or Scotland. There is no minimum headcount, turnover or venue-capacity threshold. The change does not apply in Northern Ireland. Businesses there follow Northern Ireland's own equality and employment rules (Employment Rights Act 2025, section 21; business.gov.uk).

### What changes on 30 October 2026?

Two related changes start together. Employers must take "all reasonable steps", rather than "reasonable steps", to prevent sexual harassment of employees. A separate new duty says employers must not permit third parties, including customers, delivery drivers and suppliers, to harass employees. That third-party duty covers harassment related to the protected characteristics covered by section 26 of the Equality Act, not sexual harassment alone.

### What actually counts as "all reasonable steps"?

There is no universal checklist because what is reasonable depends on the business and the risks. Current official guidance points employers towards a tailored risk assessment, a policy that covers third parties, clear reporting routes, current training and records showing how concerns were handled. A late-night bar will need different controls from a daytime bakery.

### Can I still refuse service to an abusive customer?

Yes. The new duty does not require staff to keep serving someone who is harassing or threatening them. Managers should still avoid making assumptions about behaviour that may be connected to disability, and should take tailored legal advice where the position is unclear.

### What happens if a venue does not comply?

An employee may bring a third-party harassment claim against the employer, and compensation for discrimination claims is uncapped. In a sexual-harassment case, a tribunal may also increase compensation by up to 25% if the employer breached the separate preventative duty. That uplift does not automatically attach to every kind of third-party harassment claim.

### One of my staff has been harassed by a customer. What should I do first?

Start with the person, not the form. Check that they are safe, ask what they need for the rest of the shift, and make sure they do not have to serve the customer again. A manager should deal with the customer. Afterwards, record the facts, agree any follow-up with the employee and check whether the risk assessment or shift plan needs to change.

## Sources

1. [Employment Rights Act 2025, Section 20](https://www.legislation.gov.uk/ukpga/2025/36/section/20) — Strengthens the duty to prevent sexual harassment from "reasonable steps" to "all reasonable steps"
2. [Employment Rights Act 2025, Section 21](https://www.legislation.gov.uk/ukpga/2025/36/section/21) — Creates the duty not to permit third parties to harass an employee and defines the all-reasonable-steps test
3. [business.gov.uk: Workplace sexual harassment and third-party harassment](https://www.business.gov.uk/campaign/employment-changes/employers/workplace-sexual-harassment-and-third-party-harassment/) — Confirms the 30 October 2026 commencement date, territorial scope and that further guidance will be published before commencement
4. [EHRC: Sexual harassment and harassment at work, technical guidance](https://www.equalityhumanrights.com/guidance/sexual-harassment-and-harassment-work-technical-guidance) — Explains that the existing preventative duty is positive and proactive, and sets out the risk-based approach
5. [ACAS: Steps for employers to prevent sexual harassment](https://www.acas.org.uk/sexual-harassment/steps-for-employers-to-prevent-sexual-harassment) — Practical guidance on risk assessments, reporting routes, training and incident records
6. [UKHospitality: Preventing sexual harassment](https://www.ukhospitality.org.uk/guidance/preventing-sexual-harassment/) — Sector-specific guidance covering risk by role, reporting registers and visible communication to customers
7. [Restaurant: Nick Gibson on tackling sexual harassment in pubs and restaurants](https://www.restaurantonline.co.uk/Article/2021/03/26/Tackling-sexual-harassment-in-pubs-and-restaurants-Nick-Gibson/) — The owner of The Drapers Arms discusses backing staff and challenging customers whose behaviour crosses the line
8. [Allay (UK) Ltd v Gehlen [2021] UKEAT 0031/20](https://www.gov.uk/employment-appeal-tribunal-decisions/allay-uk-ltd-v-mr-s-gehlen-ukeat-slash-0031-slash-20-slash-at) — The Employment Appeal Tribunal found that stale training should have been refreshed
9. [GOV.UK: New protections from sexual harassment come into force](https://www.gov.uk/government/news/new-protections-from-sexual-harassment-come-into-force) — Explains the possible compensation uplift for breach of the sexual-harassment preventative duty
10. [Equality Act 2010, Explanatory Notes](https://www.legislation.gov.uk/ukpga/2010/15/notes/division/3/2/2/3) — Includes the example of a pub wrongly interpreting disability-related speech as drunkenness