Workplace online harassment: protecting staff from online targeting

Who This Guidance Is For

This guidance is intended for frontline employees, lone workers, housing officers, customer service teams, enforcement staff, managers, human resources professionals and those responsible for workplace safety.

It covers situations where employees are targeted because of their work, including incidents involving residents, service users, customers or members of the public.

Employees need to understand how to recognise and report concerns. Managers need clear procedures for assessing the risk, coordinating the response and supporting affected colleagues.

The guidance primarily addresses workplaces in England and Wales. Important legal differences across Scotland, Northern Ireland and the Republic of Ireland are outlined below.

Recognising Online Targeting and Harassment

Online targeting can take several forms. Some behaviour may initially appear relatively minor, but repeated incidents or the combination of online and face-to-face contact can create a significant personal safety risk.

Common examples include:

• Online naming and identification:Publishing an employee's name, photograph, workplace or role to encourage unwanted attention.
• Threatening or abusive messages: Direct messages, emails, comments or posts containing threats, intimidation or targeted abuse.
• Doxxing: Publishing private information, such as a home address, personal telephone number or family details, without appropriate authority, particularly to expose someone to harm or intimidation.
• Repeated unwanted contact: Persistent messages, attempts to contact personal accounts or repeated approaches across several platforms.
• Coordinated targeting: Encouraging others to complain about, contact, intimidate or confront a named employee.
• Manipulated photographs or recordings: Sharing edited videos, misleading captions, fabricated screenshots, altered voices or AI-generated material.
• Targeting family members: Contacting relatives or sharing information about children, partners or other family members.

Not every critical post, complaint or unpleasant comment constitutes harassment or a criminal offence.

The concern becomes more serious when behaviour involves threats, persistence, identifiable employees, personal information, coordinated intimidation or an escalating pattern.

Warning signs that require particular attention

A person may move from criticising an organisation to focusing on an individual employee. They may start mentioning where the employee works, how they travel, their vehicle, family members or where they might be found outside work.

This change in focus should trigger a review of the employee's safety, even where no explicit threat has been made.

Preventing Online Targeting: Employer Responsibilities

Online abuse should form part of an organisation's assessment of violence, aggression and personal safety risks where staff may reasonably be exposed to it.

Employers should not wait until an employee's personal details have been published before deciding how to respond.

Practical preventative measures

1. Assess the risks. Consider previous incidents, public-facing roles, contentious decisions, enforcement activity, home visits and repeated contact with dissatisfied individuals.
2. Establish a reporting procedure. Employees should know whom to contact, including outside normal working hours where appropriate.
3. Protect employee information. Review how names, direct telephone numbers, staff photographs, work locations and other identifying details are published or disclosed.
4. Introduce an evidence-handling procedure. Decide who can capture, store, review and share material containing personal information.
5. Prepare an escalation plan. Identify when managers should involve security, safeguarding, information governance, the police or legal advisers.
6. Provide staff guidance and training. Employees need to recognise targeting, understand professional boundaries and know how to report concerns.
7. Review incidents collectively. Connect reports involving telephone calls, reception encounters, home visits, social media and repeated unwanted contact.

The organisation should appoint a responsible manager or team to coordinate incidents.

Employees should never be expected to investigate online targeting themselves or negotiate directly with someone who is threatening them.

Understanding the Legal Position

Several areas of UK law may be relevant to online abuse, harassment, threats and workplace safety.

Workplace health and safety

The Health and Safety at Work etc. Act 1974 and the Management of Health and Safety at Work Regulations 1999 provide the framework for assessing and managing work-related risks.

The Health and Safety Executive opens in a new tab recognises that workplace violence can include verbal and online abuse.

Employers should assess foreseeable risks and implement appropriate protective arrangements.

Harassment, stalking and threatening communications

In England and Wales, the Protection from Harassment Act 1997 may apply where conduct forms a relevant pattern of harassment or stalking.

Certain threatening and false communications may fall within offences introduced by Part 10 of the Online Safety Act 2023.

Whether behaviour constitutes an offence depends on the facts and applicable legal tests. A manager should not attempt to determine criminal liability before reporting a credible safety concern.

Equality and workplace harassment

From 30 October 2026, section 20 of the Employment Rights Act 2025 strengthened the preventative duty in section 40A of the Equality Act 2010 to require employers in Great Britain to take all reasonable steps to prevent sexual harassment of employees.

Section 21 also introduced employer liability for qualifying harassment by third parties where the employer fails to take all reasonable steps to prevent it.

Section 40A of the Equality Act 2010, added by the Worker Protection (Amendment of Equality Act 2010) Act 2023 and amended by section 20 of the Employment Rights Act 2025 from 30 October 2026, requires employers in Great Britain to take all reasonable steps to prevent sexual harassment of their employees in the course of their employment. That change came into force under regulation 3(a) of the Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (statutory instrument 2026/1065). Sexual-harassment whistleblowing from 6 April 2026 is in force.

These provisions may be relevant to some online incidents involving employees. However, not every instance of online abuse meets the statutory definition of harassment.

Data protection

The UK General Data Protection Regulation and Data Protection Act 2018 are relevant when an organisation collects, stores, uses or discloses personal information associated with an incident.

Evidence should be handled lawfully, securely and only by those with an appropriate need to access it.

Differences between jurisdictions

Scotland and Northern Ireland have different aspects of harassment and criminal law. In Northern Ireland, the Protection from Harassment (Northern Ireland) Order 1997 is particularly relevant.

The Republic of Ireland has separate harassment and data protection legislation, including the Non-Fatal Offences Against the Person Act 1997, the European Union General Data Protection Regulation and the Irish Data Protection Act 2018.

Organisations should apply the law relevant to their jurisdiction and obtain specialist advice where necessary.

For more detailed legislation, refer to our Frontline Workplace Safety Legislation Guide.

When Workplace Incidents Move Online

An incident involving an employee may continue online long after the original interaction has ended.

For example, a housing officer may explain an unpopular tenancy decision during a visit. Later that day, their name and photograph appear in a local community group, accompanied by allegations about their behaviour.

Other people begin commenting, sharing the post or encouraging further contact.

The original disagreement has now developed into a potential employee safety concern.

Employees should:

• Avoid responding from personal social media accounts.
• Report the publication promptly through the appropriate organisational procedure.
• Identify whether the material contains threats, personal information or attempts to locate them.
• Inform their manager about any connected incidents or previous contact.
• Explain any immediate concerns about their own safety or their family's safety.

Managers should:

• Preserve relevant information through an authorised process.
• Assess whether the employee could be approached or confronted.
• Consider whether planned visits, duties or working arrangements need to change.
• Coordinate any organisational response.
• Review whether the incident forms part of a developing pattern.

A complaint about an employee's conduct can be considered through the organisation's normal procedures without leaving the employee exposed to intimidation.

Doxxing, Personal Information and Escalating Risks

The publication of an employee's private information can create serious anxiety and, in some circumstances, physical safety risks.

Information that appears harmless in isolation may become sensitive when combined with other details.

For example, a photograph of a vehicle, a reference to a local school and information about someone's working pattern may allow others to identify where an employee lives or spends time.

If personal information is published:

1. Report the incident promptly and identify any immediate threats.
2. Preserve the relevant evidence through an authorised process, avoiding unnecessary redistribution.
3. Establish exactly what information has been disclosed and who might be able to access it.
4. Consider personal safety implications for the employee and anyone else affected.
5. Arrange appropriate requests for content removal through the platform or relevant authority.
6. Review workplace and lone-working arrangements if there is a risk of confrontation or unwanted contact.
7. Consider police involvement where there are threats, stalking, persistent targeting or other serious concerns.

Employees should not have to manage these decisions without organisational support.

Where there is an immediate danger to life or safety, contact the emergency services on 999.

Professional Boundaries and Personal Digital Safety

Professional boundaries are an important part of preventing unwanted access to personal information.

Employees should be encouraged to review their online visibility without being made responsible for the abusive behaviour of others.

Practical personal safety measures

• Review social media privacy settings and the information visible to the public.
• Consider whether personal profiles identify your employer, job role or regular workplace.
• Avoid posting details of forthcoming home visits, work schedules or sensitive operational activity.
• Be cautious about publicly sharing home locations, vehicle registrations, regular travel routines or information about children.
• Do not accept personal friend requests from residents, customers or service users where this would compromise professional boundaries.
• Use approved organisational communication channels rather than personal accounts.
• Enable appropriate account security measures, including multifactor authentication.
• Report suspicious attempts to contact or identify you through personal accounts.

Employees are entitled to a private life. Employers should provide proportionate guidance rather than demanding unrestricted access to personal accounts.

Personal digital safety measures reduce exposure, but they do not replace the employer's responsibility to manage work-related risks.

See Recognising Boundary Drift.

AI-Generated Content, Deepfakes and Misleading Recordings

Photographs, video recordings and audio can now be altered or generated to create misleading impressions of events.

An employee's image or voice may be manipulated, or a short recording may be published without the surrounding context.

Organisations should avoid assuming that online material is complete or authentic.

When questionable material appears:

• Preserve the original available source and relevant publication details.
• Record what is known about the incident, separating confirmed facts from allegations.
• Avoid publicly debating whether a recording is genuine.
• Do not circulate altered material unnecessarily.
• Consider specialist technical advice where authenticity is important.
• Assess the employee's safety and welfare regardless of whether the material has been manipulated.

A fabricated allegation can still cause genuine distress, reputational harm or increased personal safety concerns.

Managers should not make disciplinary findings solely on the basis of unverified online material.

What Employees Should Do When Targeted Online

Employees need a straightforward reporting procedure that can be followed under pressure.

A practical five-step response

Step 1: Protect your immediate safety

If the material contains threats, reveals your location or suggests someone may approach you, inform your manager immediately. Move to a safer location if necessary and follow emergency procedures.

Step 2: Do not engage or retaliate

Avoid arguments, threats, personal messages or attempts to challenge the person responsible.

Do not encourage colleagues, friends or family members to respond on your behalf.

Step 3: Preserve relevant information

Where safe and permitted by organisational procedures, record or provide the URL, platform, date, time, account name and details of the threatening or abusive material.

Do not repeatedly view distressing content or circulate it among colleagues.

Step 4: Report through the organisation

Explain what happened, why you believe you have been targeted and whether there have been previous incidents.

Include the impact on your safety, confidence or wellbeing.

Step 5: Agree what happens next

Ask who will manage the response, whether the material will be reported to the platform or police, and how you will be kept informed.

You should not be expected to monitor the person's online activity yourself.

Remember: You do not have to prove that a criminal offence has occurred before reporting a concern.

Manager Response: From Initial Report to Follow-Up

A manager's response should be calm, consistent and focused on protecting the employee.

Initial response

• Listen to the employee and take the concern seriously.
• Check for immediate safety risks, including threats to family members.
• Arrange authorised evidence preservation.
• Establish whether the person responsible has previously contacted, threatened or confronted the employee.
• Consider temporary changes to duties, home visits, reception arrangements or contact procedures.

Coordinating the response

• Nominate one person or team to manage the incident.
• Liaise with human resources, health and safety, information governance, security or safeguarding colleagues as appropriate.
• Consider police or legal advice based on the nature and persistence of the behaviour.
• Arrange any reporting or removal requests through an approved process.
• Keep relevant information confidential and restrict unnecessary access.

Employee welfare and recovery

• Ask how the incident has affected the employee.
• Consider whether they need additional support or temporary adjustments.
• Agree how updates will be communicated.
• Avoid requiring the employee to repeatedly examine abusive material.
• Record further incidents and review the risk assessment.
• Confirm when the arrangements will be reviewed.

A report should not be closed simply because an abusive post has been removed.

The underlying risk may continue through other accounts, direct messages or face-to-face contact.

Managers should consider whether the behaviour is escalating, whether the employee remains identifiable and whether further protective measures are necessary.

Example: Repeated targeting after a housing visit

Following an unsuccessful home visit, a housing officer receives several abusive messages. Their name is subsequently posted in a local online group, and a contributor claims to know where they live.

An appropriate management response would include preserving the available evidence, checking previous contact, reviewing the officer's forthcoming visits, assessing the reference to their home and considering police advice.

The employee should not be instructed to contact the contributors or defend their actions online.

Related Safety Hub Guidance

Online targeting often connects with other workplace safety concerns. The following guidance provides additional support:

• When Staff Are Recorded or Livestreamed: What employees should do when someone records or broadcasts workplace interactions.
• Body-Worn Cameras at Work: Employer-controlled recording, appropriate activation, evidence handling and staff responsibilities.
• Frontline Workplace Safety Legislation Guide: The legal framework for managing threats, violence, harassment and employee safety.
• Recognising Boundary Drift: Maintaining appropriate professional relationships and protecting personal information.
• Incident Evidence and Reporting: Producing clear, factual reports and preserving relevant evidence.
• Workplace Violence and Aggression: Identifying risks and preventing escalation.
• Post-Incident Support for Staff: Supporting employees after threats, aggression or distressing incidents.
• Managing Challenging and Abusive Phone Calls: Managing difficult conversations, abuse and threats through telephone contact.
• When Staff Are Filmed or Recorded: An Employer's Action Guide

Training and Organisational Preparedness

Effective prevention requires more than a written social media policy.

Employees need confidence in recognising risks, maintaining professional boundaries, responding to threatening behaviour and reporting concerns.

Managers need to understand how online incidents connect with workplace violence, lone working, safeguarding and employee welfare.

Safety Solutions Training provides practical, scenario-based training for public-facing teams, including housing associations, local authorities, healthcare organisations and charities.

Our Conflict Management and Lone Worker Personal Safety training can incorporate relevant examples of online intimidation, personal information exposure, professional boundaries and incident reporting as part of a wider programme tailored to the organisation's risks and procedures.

Training should help employees understand:

• How threatening or abusive behaviour can move from the workplace onto social media.
• The warning signs of fixation, repeated contact and escalating intimidation.
• How personal and professional information can become connected.
• What to do when targeted or threatened online.
• How to preserve evidence and complete a factual incident report.
• When to seek immediate support and how to avoid unnecessary engagement.

Training supports the employer's preventative arrangements. It does not replace effective risk assessments, management procedures, information governance or post-incident support.

Discuss your training needs

To explore how our training can support your organisation's frontline employees, contact Safety Solutions Training Ltd.

Official guidance and sources

• Health and Safety Executive: workplace violence and aggression opens in a new tab
• Health and Safety Executive: assessing the risks of violence opens in a new tab
• Crown Prosecution Service: communications offences opens in a new tab
• Legislation: Online Safety Act 2023, Part 10 opens in a new tab
• Legislation: Protection from Harassment Act 1997 opens in a new tab
• Legislation: Protection from Harassment (Northern Ireland) Order 1997 opens in a new tab
• Legislation: Equality Act 2010 opens in a new tab
• Legislation: Employment Rights Act 2025 opens in a new tab
• Legislation: Employment Rights Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 opens in a new tab
• Legislation: Data Protection Act 2018 opens in a new tab
• Information Commissioner's Office: UK General Data Protection Regulation guidance opens in a new tab
• Equality and Human Rights Commission: sexual harassment and harassment at work opens in a new tab
• Advisory, Conciliation and Arbitration Service (Acas): Employment Rights Act 2025 opens in a new tab

Published 11 July 2026. Editorial review for this revised material: 6 November 2026. This guide provides general workplace safety information, not legal advice. Specific legal duties and offences depend on the jurisdiction and circumstances. Organisations should consult current official guidance and obtain specialist advice where necessary.

The law changes. A published or source-check date is not a promise that every later change has been caught. On the day you rely on this page, check the named statute, regulations and official sources. For UK law, start with legislation.gov.uk and the regulator named on this page. For the Republic of Ireland, start with the Irish revised Acts and the named Irish regulator.

Duties on this page apply only in the nations named here. Do not copy England or Wales wording onto Scotland, Northern Ireland or Ireland unless this page says that duty extends there.