All reasonable steps? Investigating third-party harassment under the Employment Rights Act 2025

In cases of third-party harassment, employers will often have limited control over the alleged perpetrator. Because the individual is not an employee, the employer will generally have no power to suspend, discipline or otherwise sanction them, and may have limited ability to require their cooperation with an investigation. This is particularly likely where the alleged harasser is a member of the public, and we have previously considered some of the challenges this can create in the context of co-working spaces. The position may be different where the alleged perpetrator, or their employer, has a commercial relationship with the employer. In those circumstances, it may be possible to secure a degree of cooperation as part of the investigation. However, this can raise practical questions about who should conduct the investigation, how information should be shared between the parties, and what data protection considerations need to be taken into account (see below). Employers should also review any relevant contractual arrangements with the alleged perpetrator or their employer. These may contain provisions governing conduct, cooperation with investigations, information sharing, or the steps that can be taken in response to substantiated allegations.

The practical consequence is that investigators cannot always expect the same level of access to the alleged perpetrator as they would in a conventional workplace investigation. In some cases, they may have no opportunity to interview the alleged harasser at all. As a result, establishing the facts can be more challenging, with greater reliance often being placed on the complainant's account, internal witnesses, contemporaneous documents, and other available evidence such as call recordings, emails or CCTV footage.

In these circumstances, the focus is likely to be on assessing the overall weight of the evidence and identifying points of corroboration, rather than simply resolving conflicting accounts. Investigators should be prepared to reach findings of fact despite evidential gaps, while being transparent about any limitations in the evidence available and the impact those limitations may have had on their conclusions.

It can also be helpful for investigators to explain the standard of proof that has been applied. Given that workplace investigations are typically conducted on the balance of probabilities standard, setting out how that standard was applied in a case where evidence is incomplete or unavailable may help demonstrate that the conclusions reached were fair, reasonable and evidence-based.

From the employer's perspective, it will be particularly important to gather evidence relevant to the "all reasonable steps" question (i.e. whether the organisation took all reasonable steps to prevent the harassment from occurring). This may include evidence of previous incidents, risk assessments, training, policies, guidance, reporting mechanisms, and any preventative measures already in place. As a result, the investigation should be framed correctly from the outset. Its purpose is not simply to establish what happened, but also to assess whether the organisation's existing controls were adequate and whether it responded appropriately to protect its workforce. Additionally, employers may wish to consider whether it would be appropriate for the investigator to make recommendations, such as additional training or changes to existing processes, alongside their findings of fact.

It may also be appropriate to broaden the scope of the investigation beyond the individual incident. In some cases, there may be value in examining wider organisational factors, controls or cultural issues. For example, investigators might explore whether there is a pattern of similar behaviour by the same third party (such as a client or customer), whether particular roles or teams face an elevated risk of harassment, or whether there is an established culture of tolerating unacceptable behaviour from customers, clients or other third parties.

Taking this wider lens can help identify systemic issues that may not be apparent from the incident in isolation. It also enables employers to implement targeted improvements to policies, training, reporting mechanisms or working practices, helping to strengthen both employee protection and the employer's ability to demonstrate that it has taken all reasonable steps to prevent harassment going forward.

Investigators should be aware that employees may feel more vulnerable reporting harassment by a third party than by a colleague. For example, they may fear that the organisation will prioritise its relationship with a client or customer over their complaint. Investigators should therefore take particular care to build trust, encourage open disclosure and ensure the complainant feels supported throughout the process. It can also be helpful to ensure that relevant policies expressly address third-party harassment, make clear that complaints will be taken seriously, and explain how concerns should be reported. In client-facing roles and those involving significant contact with the public, employers may also wish to implement a dedicated third-party harassment protocol, reinforcing that employee safety will not be compromised in order to preserve commercial relationships.

Investigations may also be complicated by commercial sensitivities, particularly where the alleged harasser is a key client or customer. In such cases, organisations should consider whether an external or independent investigator is appropriate, particularly where commercial interests could influence, or be perceived to influence, decision-making and undermine confidence in the investigation's impartiality.

Third-party harassment investigations raise more complex data protection considerations than standard workplace investigations because they involve processing personal data about individuals outside the employer's usual data processing frameworks. Where the alleged harasser is employed by another organisation, sharing personal data with that organisation introduces a second data controller, reducing the employer's control over subsequent handling. Employers and investigators should address these issues at the outset.

The employer must identify and document a lawful basis for processing personal data during the investigation. Legitimate interests will typically be the most appropriate basis, though employers should also consider whether processing is necessary for compliance with a legal obligation, particularly duties under the Equality Act 2010 and the forthcoming ERA provisions. Where legitimate interests are relied on, a legitimate interests assessment should be completed.

Harassment investigations frequently involve special category data, i.e. information about health, race, religion, sexual orientation or another protected characteristic, which requires both a lawful basis and a separate condition. The most relevant condition is likely to be that the processing is necessary to perform obligations in connection with employment, on the basis that employers are legally required to investigate allegations of harassment in order to protect their employees and show they have taken all reasonable steps.

The data minimisation principle requires the employer to process only personal data that is adequate, relevant and not excessive. This is particularly important in third-party investigations, where there may be a temptation to seek extensive records from the third party's employer. Investigators should set clear retention timescales at the outset for all investigation records including witness statements, correspondence and the investigation report, consistent with the organisation's data retention policy.

Any individual involved in the investigation, including the alleged harasser, may make a subject access request during or after the investigation. A request cannot be refused simply because the investigation is ongoing, though disclosure may be restricted or delayed where it would prejudice the investigation or an applicable exemption under the Data Protection Act 2018 applies (e.g. relating to the prevention or detection of crime, or the management forecasting exemption where disclosure would prejudice the employer's ability to conduct the investigation). Employers should consider taking legal advice before relying on an exemption and document their reasoning carefully. Requests from a third party's employer should be assessed by reference to whose personal data is being requested and that organisation's authority to act.

Employers must provide privacy information to data subjects whose personal data is processed. For employees, the workplace privacy notice will typically suffice but employers should verify it covers investigation-related processing. Where personal data is collected about a third party such as the alleged harasser, privacy information may also need to be provided unless an exemption applies, e.g. because providing it would be impossible, involve disproportionate effort or seriously impair the objectives of the processing by prejudicing the investigation. Any reliance on an exemption should be considered carefully and recorded.

Where an investigation involves sharing personal data with an organisation outside the UK, the employer must ensure the transfer complies with the UK GDPR's international transfer requirements. Given the practical pressures of investigations, employers should address these issues in advance and, where possible, agree data-sharing protocols with key third-party organisations before a complaint arises, covering matters such as the purposes for which shared data will be used, retention periods, access controls, security measures and deletion arrangements.

Given these complexities, data protection and employment teams should work closely together from the outset of any third-party harassment investigation. Embedding data protection considerations into investigation procedures will help employers manage risk, maintain the confidence of all parties and demonstrate compliance with both data protection and employment law obligations.