Last updated: 4 September 2026
TL;DR: From 30 October 2026 employers must take all reasonable steps to prevent third party harassment of their staff. A third party is anyone who is not you or another employee, which in a veterinary practice means clients above all. One incident is now enough, where the old law needed a pattern. Reacting well after the event is no longer a defence.
Third party harassment is harassment of your staff by someone who does not work for you. Clients, customers, service users, suppliers, contractors and visitors all count. In a veterinary practice, in practice, it means clients.
The conduct has to relate to a protected characteristic to fall inside the duty: age, disability, gender reassignment, race, religion or belief, sex, or sexual orientation. So the client who swears at reception because the wait is long is a conduct problem but not necessarily third party harassment. The client who tells a young RVN she is too young to know what she is doing, or refuses to be seen by a particular vet because of their race, is squarely inside it.
Protection against third party harassment was removed from the statute book in 2013. Section 20 of the Employment Rights Act 2025 brings it back, and brings it back stronger than the version that went.
Two things land on the same day, and they compound.
The single most important detail is the threshold. Under the pre 2013 law, an employer was only liable once harassment by a third party had happened on at least two previous occasions and the employer had failed to act. That “three strikes” structure is gone. One incident is now enough.
That is the change that catches practices out. The old law effectively gave you a free first incident. The new one does not.
Because your staff absorb distressed people as a routine part of the job, and the profession has normalised a level of client behaviour that most workplaces would not tolerate.
Consider where the exposure actually sits in a practice:
None of that is new to anyone who has run a practice. What is new is that from 30 October third party harassment is a legal exposure rather than a cultural one, and the defence depends on what you did before it happened.
It requires anticipation, not just reaction. The word “all” removes the argument that you did something sensible. The question becomes whether there was anything further you reasonably could have done and did not.
In practical terms, a practice that only responds after an incident of third party harassment will struggle. A practice that can show it identified where third party harassment was likely, decided in advance how staff should respond, told them so, and recorded what happened when it did occur, is in a completely different position.
There is no statutory checklist. There is, however, a clear direction of travel: risk assessment, policy, training, reporting, and evidence that all four exist.
Steps one, two and three cost nothing but an afternoon. If your practice already runs structured incident reporting, our See It Report It system gives step five an audit trail rather than a paper form in a drawer.
If a third party harassment claim ever reaches a tribunal, the question will not be whether you care about your team. It will be what you can put in front of someone. Four documents do most of the work.
Acas guidance on preventing sexual harassment at work sets out the same shape for the duty that already exists, and it is a fair guide to what “all reasonable steps” will look like for third party harassment too.
None of these need to be long. A one page risk assessment beats a twenty page policy nobody has read, because the first is evidence of thought and the second is evidence of a template.
Yes, and after 30 October the harder question is whether you can afford not to. The duty runs to your staff, not to the client, and a practice that keeps a client it knows harasses its team is taking the risk knowingly.
The professional obligations that sit alongside this are real but narrower than people assume. There are duties around animals in immediate distress and around continuity of care, and those need handling properly rather than ignoring. But nothing in professional practice requires you to keep exposing a named member of staff to a named client indefinitely. Deregistering a client is a decision to take carefully, in writing, with a reason, and with any urgent clinical need dealt with first.
The duty is about steps taken, not outcomes guaranteed. An incident of third party harassment does not automatically mean you have failed it. What matters is that you can show what you had in place beforehand, that the member of staff was supported afterwards, and that something changed as a result.
Record it the day it happens, in the person’s own words where you can. Memory degrades, and a contemporaneous note written by the person affected is worth more than a summary written by a manager three weeks later.
It can. The requirement for a pattern of previous incidents has gone, so a single incident is capable of engaging the duty. Whether the conduct amounts to harassment still depends on the usual test: was it unwanted, related to a protected characteristic, and did it have the purpose or effect of violating dignity or creating an intimidating, hostile, degrading, humiliating or offensive environment.
Not necessarily. A clear section inside your existing anti harassment or dignity at work policy is usually enough, provided it names third parties explicitly and says what staff should do. A separate document is easier to point to, which has its own value.
Yes. There is no small employer exemption from the harassment duties. The reasonable steps expected of a small practice will be proportionate to its size, but the duty itself applies from the first employee.
The new duty protects employees. People who are not your employees may be third parties themselves rather than beneficiaries of the duty, which cuts both ways: a contractor who harasses your employee is exactly who this covers.
No. Context may shape how you respond and whether you deregister someone, but distress does not remove conduct from the scope of harassment, and it does not reduce your duty to your own staff.
Most practices already know which clients the third party harassment duty is about. Ask any practice manager and they can name them inside ten seconds. What changes on 30 October is that knowing is no longer neutral, because knowing without acting is the thing the duty is designed to catch.
Do the risk assessment, put the sign up, tell the team they are allowed to end the call. If you want the policy and training record built properly, our free HR health check covers it, and you keep the written summary either way. You may also want to read our guide to the 2026 employment law changes and the new annual leave records duty, both of which land in the same year.
Read next: Veterinary Practice HR Policies.
Contracts, rotas, holiday, a difficult conversation. Tell us what you are dealing with and we will come back within one working day. Nothing to sign up to.
Got it. We will come back to you within one working day. If you do not see a reply, please check your spam folder.
