“We can’t control the public” has been a common answer when a customer keeps getting a trans colleague’s name or pronouns wrong, or makes remarks about them being trans. From 30 October 2026 it is a risky answer to rely on.
What changes on 30 October 2026
From 30 October 2026, under Employment Rights Act 2025 s.21 (inserting Equality Act 2010 s.40(1A)–(1C); commenced by SI 2026/1065 reg 3), an employer is liable where a third party (such as a customer, client or service user) harasses one of its employees in the course of their employment and the employer failed to take all reasonable steps to prevent it.
A third party is anyone other than the employer or its employees: customers, clients, service users, visitors, members of the public and an external contractor’s staff. The rule covers harassment related to any relevant protected characteristic (s.26(5): age, disability, gender reassignment, race, religion or belief, sex, sexual orientation), not only sexual harassment. For a trans colleague the characteristic in play is usually gender reassignment (s.7), which does not depend on a gender recognition certificate.
Before that date the Equality Act 2010 had no provision making an employer liable to an employee for harassment by a third party: the earlier provisions, s.40(2)-(4), were repealed with effect from 1 October 2013. Since 26 October 2024 s.40A has required reasonable steps to prevent sexual harassment of employees, including by third parties. The new provision makes no special rule for earlier conduct, so conduct before 30 October 2026 is judged under the law as it then stood. Where conduct continues after that date, the conduct on or after 30 October 2026 can fall within the new provision.
The Act does not list the steps that count as reasonable. Regulations may specify reasonable steps to prevent sexual harassment (s.40B), but not harassment related to gender reassignment or the other characteristics; none had been made when this page was written (24 October 2026), so check before relying on that.
In practice the question moves from “did you respond?” to “what did you do to prevent it?”.
Five steps you can show
1. Know your third parties and the risks. List who deals with your staff, note where people work alone, and write it up as a short risk assessment by site and role. Treat it as a hazard of the role, so it never requires anyone to say whether they are trans. Do not solve it by moving a member of staff away from the public unless they ask; that puts the cost on them.
2. Tell customers what is expected. Say it at entrances, on your website and in booking letters, in wording about behaviour towards every member of staff. It need not single anyone out. Give staff the same message as a short script.
3. Make reporting easy. A report should take a minute and not depend on the person it happened to. Offer more than one route, let colleagues who saw it report it, and record what was said and when — not guesses about anyone’s identity or history.
4. Back staff when they challenge or refuse service. Agree in advance what staff may do, then back it; staff who are overruled in front of the customer learn not to try. Where a customer’s conduct expresses a religious or philosophical belief, aim the response at the manner of the conduct and its effect on the colleague, not at the belief, and keep it proportionate: a correction and a warning before any refusal of service. Where a customer says it is their belief, take advice. Some services cannot simply be withdrawn, such as a clinical appointment or a statutory service, and some customers may not understand what they are doing, for example a patient with dementia. There the response is a changed arrangement: a second person present, a different setting, one agreed point of contact. Let the member of staff’s wishes lead, record why, and take advice before withdrawing a service from someone vulnerable.
5. Record what you did. Keep the risk assessment, the notices, the briefings, each report and what followed. Keep it to what happened, restrict who can see it, and never put anyone’s trans history in an incident log.
Staff often do not complain: nobody wants to be the person who made a fuss, and some have learned that raising it makes things worse. If colleagues have noticed, you know enough to act.
Supporting the member of staff
You do not need to know or ask whether someone is trans, or anything about their history, to act on what was said or done. Act on the conduct. Never ask the person to explain or prove anything about themselves. If they choose to tell you something, share it only with those who need it to do their job.
The choice of response is theirs. Ask privately what they want and offer options rather than a script. Ask again later, because wishes change.
What it does not cover
Harassment between colleagues sits under the employer’s own liability for its employees (s.109), not this provision. The new rule protects employees, not job applicants; take advice if the question arises. Though “employee” has the Equality Act’s wide meaning and includes someone engaged personally to do the work (s.83(2)(a)), so a person engaged that way can be your own employee rather than a third party. It extends to England, Wales and Scotland, not Northern Ireland. General rudeness unrelated to a protected characteristic falls outside it, though other duties, such as health and safety, may apply.
This is decision-support, not legal advice. Where this page says to take advice, do.