Hotels are in the business of welcoming strangers. Most of them are perfectly pleasant.
Some are not.
A receptionist deals with an aggressive guest at midnight. Bar staff receive inappropriate comments from a customer who has had too much to drink. A housekeeper is harassed while working alone. An events team has to deal with somebody whose behaviour has moved well beyond “difficult customer”.
For years, some of that behaviour has been dismissed as part of working in hospitality.
From 30 October 2026, that becomes a much more dangerous assumption for employers.
Changes introduced by the Employment Rights Act 2025 will make employers liable for harassment of employees by third parties unless they can show they took all reasonable steps to prevent it. The law will also strengthen the existing duty around sexual harassment, changing the requirement from taking “reasonable steps” to taking “all reasonable steps”.
For hotels, that matters because third parties are everywhere; guests, visitors, contractors, event attendees, d elivery drivers, bar and restaurant customers.
The question is no longer simply how a hotel responds when somebody crosses the line. It is what the hotel did beforehand to reduce the chance of it happening.
A third party is someone an employee encounters through work who is not their employer or a fellow employee.
That can include customers, clients, contractors, tradespeople, conference attendees and members of the public. From 30 October 2026, employers can be liable where a third party harasses an employee in the course of their employment and the employer failed to take all reasonable steps to prevent it.
In a hotel, that could mean harassment involving a guest staying at the property, someone attending a wedding or conference, a customer in a hotel bar or restaurant, or a contractor working on site. To name a few...
And the protection is broader than sexual harassment alone.
The Employment Rights Act 2025 extends the existing Equality Act 2010 protections to cover harassment by third parties. This includes harassment related to protected characteristics such as age, disability, gender reassignment, race, religion or belief, sex and sexual orientation.
That makes this much more than an HR issue. It becomes an operational one.
Hotels create an unusual mixture of people, environments and working patterns.
Employees frequently work face-to-face with members of the public. Some work alone, many work late at night. Alcohol may be involved.
People are often entering private or semi-private spaces.
And the balance between providing good service and challenging inappropriate behaviour is not always comfortable.
That can create moments where employees feel pressure to tolerate behaviour they would never be expected to accept in a conventional office.
A guest is paying hundreds of pounds for a room. A wedding party has booked the venue. A corporate event is worth significant revenue.
None of those things removes the employer's responsibility to protect staff.
The commercial value of the customer does not change the nature of the behaviour.
There are two changes hotel employers should pay particular attention to.
First, the existing duty to prevent sexual harassment becomes stronger.
Since October 2024, employers have been required to take reasonable steps to prevent sexual harassment of employees. From 30 October 2026, that becomes a requirement to take all reasonable steps.
Second, employers will gain a specific liability relating to harassment by third parties.
The Employment Rights Act 2025 inserts new provisions into the Equality Act 2010 covering circumstances where employees are harassed by somebody outside the organisation and the employer has failed to take all reasonable preventative steps.
That word preventative is important.
Waiting for something to happen and then handling the complaint well is not the same thing as trying to prevent it.
There is no single checklist that will apply identically to every hotel.
What is reasonable will depend on circumstances such as the size of the organisation, the sector and the type of work employees carry out. Acas says employers should consider all of the preventative measures it would be reasonable for their particular organisation to take, rather than selecting only some of them.
For hotels, that makes risk assessment particularly important.
A receptionist working behind a staffed desk during the day may face a very different exposure to a lone night worker. Housekeeping staff entering guest rooms face different risks again.
Security teams, bar staff, spa employees, event teams and maintenance workers all interact with third parties in different environments.
So the useful question is not: Do we have an anti-harassment policy?
It is: Where could harassment realistically happen here, and what have we done about it?
Start with the operating environment:
Which roles involve lone working? Which teams regularly deal with intoxicated customers? Who enters guest rooms? Who works late shifts? Which departments deal with complaints or confrontational situations?
Risk assessments should reflect the reality of how the hotel operates, not simply the organisation chart.
Acas specifically recommends regularly assessing the risk of third-party harassment and taking action to reduce those risks.
A reporting process only works if people actually use it.
If a member of staff has to find a manager, complete a paper form later and remember exactly what happened at the end of a busy shift, smaller incidents may never be recorded.
That matters because apparently isolated incidents can form a pattern.
The same guest, the same event type, the same location, the same time of night. The same role being repeatedly exposed.
Acas includes monitoring and recording incidents and the actions taken among the measures employers should consider.
You cannot identify a pattern in information you never capture.
Hospitality employees are trained to solve problems. Usually that is a strength, but in a harassment situation, it can create ambiguity.
Should the employee challenge the customer? Call a manager? Contact security? Remove themselves from the situation? Ask the guest to leave or contact the police?
Those decisions become harder when somebody is already under pressure.
Clear escalation routes remove some of the judgement from the moment it is needed most.
A policy saying “harassment will not be tolerated” is useful.
It does not tell a receptionist what to do when a guest becomes sexually aggressive. It does not tell bar staff how to respond to racist abuse. Nor does it tell a housekeeper how to get help quickly when working alone.
Training needs to bridge the gap between policy and reality.
Acas specifically identifies staff-safety and de-escalation training as examples of preventative measures employers may need to consider.
This is the part that can easily be overlooked.
Policies, risk assessments, training, incident records and escalation procedures.
Individually, each may seem administrative. Together, they build the evidence that the organisation has actively considered the risk and responded to it.
If an employer later needs to demonstrate that it took all reasonable steps, that evidence matters.
A single complaint can look isolated. Several incidents recorded consistently may reveal a pattern.
Perhaps the same location is involved. The same shift. The same type of event. The same staffing gap.
That matters because Acas specifically identifies monitoring and recording incidents and actions taken as part of a preventative approach.
Good incident reporting helps hotels move beyond anecdote. It creates a clearer picture of where risk is concentrated, whether existing controls are working and where additional action may be needed.
The point is not that reporting prevents harassment. It is that hotels cannot learn from incidents they cannot see.