This guide is for human resources, organisation leaders, health and safety leads, information governance and operational managers. Then team leaders. Typical readers work in housing associations, local authorities, care and support, charities and trades.
Default copy here is for England and Wales, and is labelled as such. Name the nation before you name a duty. Say UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018. Do not say “the GDPR” as if European Union law still applied in the United Kingdom.
Targeting and doxxing. Online naming after a visit or call. Edited or captioned clips. Family exposure. Persistent contact, reposting, threats, following, pile-ons and a possible course of conduct. Authenticity questions when material may be altered.
This is not legal advice. It does not decide that a post is defamation, a communications offence or harassment. It does not teach staff to scrape, create fake profiles, geolocate or investigate an uploader. It does not retell doorbell, indoor-camera, baby-monitor, camera-auditor or drone methods.
How staff are filmed, livestreamed or captured by devices is covered in when staff are recorded or livestreamed. Employer-issued cameras are covered in body-worn cameras at work.
Write digital targeting into violence, lone working and public-facing assessments. Do not wait for a Facebook pile-on to invent the owner.
Name who owns the response. Write the reporting route. Write the evidence rules: who captures URLs and screenshots, where they are stored, and who may see staff home addresses. Write the welfare route. Write who owns communications, so individual staff do not reply from personal accounts.
Set the police and legal trigger: persistent contact, threats, doxxing, family targeting or a possible course of conduct. Review after incidents. Include digital targeting in the same pattern review as visits and calls.
Name the nation, then the duty. This page is operational guidance. It is not a statute dump. Use the legislation guide for depth.
England and WalesThe Protection from Harassment Act 1997 may apply to a possible course of conduct. For conduct on or after 31 January 2024, the Online Safety Act 2023 Part 10 introduced false and threatening communications offences. The Defamation Act 2013 requires serious harm. Inaccurate publication is not automatically defamation.
ScotlandDo not paste the Protection from Harassment Act 1997 as if it applies unchanged. Use Scottish advice and the legislation guide.
Northern IrelandUse the Protection from Harassment (Northern Ireland) Order 1997, not the 1997 Act.
IrelandHarassment sits in the Non-Fatal Offences Against the Person Act 1997, section 10. Data protection follows the European Union General Data Protection Regulation and the Irish Data Protection Act 2018, not the UK General Data Protection Regulation.
The UK General Data Protection Regulation and the Data Protection Act 2018 apply when the organisation processes personal data about staff or third parties. A member of the public posting about a worker is not, by itself, the employer's surveillance system. The employer's handling of that material is.
Information Commissioner's Office (ICO) worker-monitoring and covert-monitoring guidance is not the main tool for public targeting of staff. Do not tell managers to run a covert data protection impact assessment as the response to a Facebook pile-on. The default is overt, organisational and lawful preservation. Staff and managers must not create fake accounts, friend the client or scrape personal profiles.
The Worker Protection (Amendment of Equality Act 2010) Act 2023 has been in force since 26 October 2024. It inserted Equality Act 2010 section 40A: a duty to take reasonable steps to prevent sexual harassment of employees in the course of employment. Keep the Employment Rights Act 2025 separate. From 30 October 2026 the section 40A test becomes all reasonable steps, and separate third-party harassment liability for harassment generally also applies (see the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, statutory instrument (SI) 2026/1065). Until then, those Employment Rights Act 2025 changes are not current law. Sexual-harassment whistleblowing from 6 April 2026 is in force. Coming into forceSI 2026/1065 regulation 3(a) and (b) confirms that Employment Rights Act 2025 sections 20 and 21 commence on 30 October 2026. That covers all reasonable steps under Equality Act 2010 section 40A, and third-party harassment liability under Equality Act 2010 section 40(1A) to (1C). Those provisions are still not current law until that date. Those provisions take effect on 30 October 2026 and are not yet in force. Martyn's Law Part 1 premises duties are not in force.
Recording and later publication are different issues. A person recording an interaction is not the same as that recording being edited, published, shared or used to target a member of staff.
Capture dates, locations, URLs, screenshots and the impact on the staff member. Do not retell device types here. Method-by-method capture sits on when staff are recorded or livestreamed.
Recording alone is not automatically harassment. Employers should avoid making automatic legal conclusions. Where behaviour becomes persistent, threatening, targeted or part of a wider pattern, managers should consider police or legal advice.
Escalation themes that stay on this page include persistent unwanted contact, repeated publication or reposting of staff images, threats, doxxing, following staff online or in person, coordinated pile-ons, targeting of family members, and behaviour that may form a course of conduct.
Digital harm can continue after the workplace incident ends. Edited videos, local Facebook groups, TikTok, Instagram, YouTube, X, forums and anonymous accounts can create anxiety, loss of confidence, fear of returning to work and concern for family safety. Posts written to provoke anger, selective editing, and publication of names, photos, uniforms, vehicles or locations all belong in the same organisational response.
After a visit, a housing officer is named in a local Facebook group. Comments invite others to add photographs and a home area. The learning is to preserve the URL, support the worker and coordinate any response. It is not to argue in the thread.
A trades worker's family photograph is taken from a personal account and posted next to a van registration. The learning is that staff posts can reveal family life, and that managers must stop informal investigation by colleagues.
Do not befriend clients on Facebook. Do not accept friend requests during or after a filmed encounter or a heated visit. Personal posts can reveal family life, schools, vehicles and a home area.
Gossip, group chats and unofficial sharing of clips or addresses may engage the UK General Data Protection Regulation and the Data Protection Act 2018. Staff must not circulate another worker's home address “so people know to be careful”. That is processing. It needs an owner and a lawful basis, not a WhatsApp thread.
Use recognising boundary drift and the legislation guide.
Authenticity and lawfulness are separate questions. Artificial intelligence can alter footage, generate video from a still image or imitate a voice. A clip that looks authentic is not proof of what happened.
Preserve original files and available metadata. Do not rely only on screenshots or reposts. Do not discipline on unverified clips. Do not argue authenticity online. If manipulated content is used to target a staff member, assess the same safety, harassment and publication risks as for genuine content, with specialist advice where needed.
These rules come after policy, not instead of it. They are designed to be usable under pressure.
Managers should coordinate, not react emotionally. Staff should not be left to challenge uploaders, reply from personal accounts, argue in local groups or gather evidence without support.
Safety Solutions Training does not run a standalone online-targeting course. Digital intimidation comes up in Conflict Management when the client needs that covered.
Training does not replace a named owner, an evidence rule or a communications owner. It does not complete a data protection or employment-law decision.
Official sources used for this page
Published 11 July 2026. Source check 30 August 2026. Next review 28 October 2026, or sooner if communications, harassment or data-protection rules change. Not legal advice.
This page is not legal advice. It does not decide liability, guilt, or the outcome of any particular case.
The law changes. A published or source-check date is not a promise that every later change has been caught. On the day you rely on this page, check the named statute, regulations and official sources. For UK law, start with legislation.gov.uk and the regulator named on this page. For the Republic of Ireland, start with the Irish revised Acts and the named Irish regulator.
Duties on this page apply only in the nations named here. Do not copy England or Wales wording onto Scotland, Northern Ireland or Ireland unless this page says that duty extends there.
Practical insight and resources built from thirty years at the frontline.
Practical controls for violence, aggression, conflict, reporting and review.
Guidance for staff who work alone, visit, travel, or need check-in and escalation.
Abusive calls, repeated contact, boundary setting, records and escalation.
What non-specialist staff should notice, record in fact, and refer.
Gifts, over-familiarity, unofficial contact and pressure to bend the rules.
What to check before a visit, and what to do if a dog is present.
How scenario practice tests real workplace decisions without theatrical conflict.
Travel, walking and public transport. Written for employers to share with staff.
Tell us about your staff roles, working environment and the situations your staff face. We will recommend the right training approach for your organisation.
Trusted by organisations across the UK for practical, scenario-led staff safety training.
