This guide is for human resources, organisation leaders, health and safety leads, information governance and operational managers. Then team leaders. Typical readers work in housing associations, local authorities, care and support, charities and trades.
Default copy here is for England and Wales, and is labelled as such. Name the nation before you name a duty. Say UK General Data Protection Regulation and Data Protection Act 2018. Do not say “the GDPR” as if European Union law still applied in the United Kingdom.
Targeting and doxxing. Online naming after a visit or call. Edited or captioned clips. Family exposure. Persistent contact, reposting, threats, following, pile-ons and a possible course of conduct. Authenticity questions when material may be altered.
This is not legal advice. It does not decide that a post is defamation, a communications offence or harassment. It does not teach staff to scrape, create fake profiles, geolocate or investigate an uploader. It does not retell doorbell, indoor-camera, baby-monitor, camera-auditor or drone methods.
How staff are filmed, livestreamed or captured by devices is covered in when staff are recorded or livestreamed. Employer-issued cameras are covered in body-worn cameras at work.
Write digital targeting into violence, lone working and public-facing assessments. Do not wait for a Facebook pile-on to invent the owner.
Name who owns the response. Write the reporting route. Write the evidence rules: who captures URLs and screenshots, where they are stored, and who may see staff home addresses. Write the welfare route. Write who owns communications, so individual staff do not reply from personal accounts.
Set the police and legal trigger: persistent contact, threats, doxxing, family targeting or a possible course of conduct. Review after incidents. Include digital targeting in the same pattern review as visits and calls.
Name the nation, then the duty. This page is operational guidance. It is not a statute dump. Use the legislation guide for depth.
England and WalesThe Protection from Harassment Act 1997 may apply to a possible course of conduct. For conduct on or after 31 January 2024, the Online Safety Act 2023 Part 10 introduced false and threatening communications offences. The Defamation Act 2013 requires serious harm. Inaccurate publication is not automatically defamation.
ScotlandDo not paste the Protection from Harassment Act 1997 as if it applies unchanged. Use Scottish advice and the legislation guide.
Northern IrelandUse the Protection from Harassment (Northern Ireland) Order 1997, not the 1997 Act.
IrelandHarassment sits in the Non-Fatal Offences Against the Person Act 1997, section 10. Data protection follows the European Union General Data Protection Regulation and the Irish Data Protection Act 2018, not the UK General Data Protection Regulation.
The UK General Data Protection Regulation and the Data Protection Act 2018 apply when the organisation processes personal data about staff or third parties. A member of the public posting about a worker is not, by itself, the employer's surveillance system. The employer's handling of that material is.
Information Commissioner's Office worker-monitoring and covert-monitoring guidance is not the main tool for public targeting of staff. Do not tell managers to run a covert data protection impact assessment as the response to a Facebook pile-on. The default is overt, organisational and lawful preservation. Staff and managers must not create fake accounts, friend the client or scrape personal profiles.
The Worker Protection (Amendment of Equality Act 2010) Act 2023 has been in force since 26 October 2024. It requires reasonable steps to prevent sexual harassment, including foreseeable third-party sexual harassment. Keep the Employment Rights Act 2025 separate. Sexual-harassment whistleblowing from 6 April 2026 is in force. Planned 30 October 2026 all-reasonable-steps and third-party harassment liability is not current law until commencement is confirmed. Acas last updated that timetable on 26 August 2026. Martyn's Law duties are not in force.
Recording and later publication are different issues. A person recording an interaction is not the same as that recording being edited, published, shared or used to target a member of staff.
Capture dates, locations, URLs, screenshots and the impact on the staff member. Do not retell device types here. Method-by-method capture sits on when staff are recorded or livestreamed.
Recording alone is not automatically harassment. Employers should avoid making automatic legal conclusions. Where behaviour becomes persistent, threatening, targeted or part of a wider pattern, managers should consider police or legal advice.
Escalation themes that stay on this page include persistent unwanted contact, repeated publication or reposting of staff images, threats, doxxing, following staff online or in person, coordinated pile-ons, targeting of family members, and behaviour that may form a course of conduct.
Digital harm can continue after the workplace incident ends. Edited videos, local Facebook groups, TikTok, Instagram, YouTube, X, forums and anonymous accounts can create anxiety, loss of confidence, fear of returning to work and concern for family safety. Posts written to provoke anger, selective editing, and publication of names, photos, uniforms, vehicles or locations all belong in the same organisational response.
After a visit, a housing officer is named in a local Facebook group. Comments invite others to add photographs and a home area. The learning is to preserve the URL, support the worker and coordinate any response. It is not to argue in the thread.
A trades worker's family photograph is taken from a personal account and posted next to a van registration. The learning is that staff posts can reveal family life, and that managers must stop informal investigation by colleagues.
Do not befriend clients on Facebook. Do not accept friend requests during or after a filmed encounter or a heated visit. Personal posts can reveal family life, schools, vehicles and a home area.
Gossip, group chats and unofficial sharing of clips or addresses may engage the UK General Data Protection Regulation and the Data Protection Act 2018. Staff must not circulate another worker's home address “so people know to be careful”. That is processing. It needs an owner and a lawful basis, not a WhatsApp thread.
Use recognising boundary drift and the legislation guide.
Authenticity and lawfulness are separate questions. Artificial intelligence can alter footage, generate video from a still image or imitate a voice. A clip that looks authentic is not proof of what happened.
Preserve original files and available metadata. Do not rely only on screenshots or reposts. Do not discipline on unverified clips. Do not argue authenticity online. If manipulated content is used to target a staff member, assess the same safety, harassment and publication risks as for genuine content, with specialist advice where needed.
These rules come after policy, not instead of it. They are designed to be usable under pressure.
Managers should coordinate, not react emotionally. Staff should not be left to challenge uploaders, reply from personal accounts, argue in local groups or gather evidence without support.
Safety Solutions Training does not run a standalone online-targeting course. Digital intimidation comes up in Conflict Management when the client needs that covered.
Training does not replace a named owner, an evidence rule or a communications owner. It does not complete a data protection or employment-law decision.
Official sources used for this page
Published 11 July 2026. Source check 30 August 2026. Next review 28 October 2026, or sooner if communications, harassment or data-protection rules change. Not legal advice.
Practical insight and resources built from thirty years at the frontline.
Guidance for organisations whose staff work alone, visit, travel or need check-in and escalation.
Practical controls for violence, aggression, conflict, reporting and review.
Abusive calls, repeated contact, boundary setting, records and escalation.
Tell us about your staff roles, working environment and the situations your staff face. We will recommend the right training approach for your organisation.
Trusted by organisations across the UK for practical, scenario-led staff safety training.
