University response to stalking or cyberbullying

Overview

Stalking and cyberbullying affecting students engage several overlapping obligations for a university in England and Wales. A university is not a criminal justice body, so it cannot convict anyone or impose criminal punishment, but it does have duties to protect students, to investigate under its own disciplinary and conduct rules, and increasingly to meet regulatory requirements set by the Office for Students. Alongside this, the underlying conduct may amount to criminal offences and to civil wrongs, which run in parallel with anything the university does. The right response depends heavily on who the perpetrator is (another student, a staff member, or an external person), the severity and nature of the conduct, and the wishes and safety of the person affected.

The regulatory framework

From 1 August 2025 a new ongoing condition of registration, condition E6, applies to higher education providers registered with the Office for Students in England. It requires providers to have a clear and accessible approach to preventing and responding to harassment and sexual misconduct affecting students. The OfS statement of expectations and the E6 material make clear that the concept of harassment they regulate expressly includes stalking, and includes behaviour committed through any medium, including online. That directly captures cyberstalking and much online abuse between students.

In practical terms this means a university is expected to have a visible, easy to understand policy that sets out when it will begin disciplinary proceedings against a student, staff member or visitor, and how it handles matters that may also be criminal offences. It is expected to take a fair, clear and accessible approach to responding to reports and disclosures, to minimise barriers to reporting, and to investigate complaints against its registered students, normally as a disciplinary matter.

Note that condition E6 is an England-specific OfS registration condition. In Wales the regulatory landscape differs, with Medr (the Commission for Tertiary Education and Research) now overseeing the sector, but the same general duties of care, harassment law and safeguarding expectations apply.

What the university should actually do

The steps below reflect what a well-run university process should look like, and broadly what the regulatory expectations require.

1. Take the report seriously and act on it promptly. There should be a clear reporting route, often an online report-and-support tool, and a named contact or team. The person affected should be able to report and receive support even if they do not want a formal investigation.

2. Assess immediate safety and risk. This is the priority with stalking in particular, because stalking is a pattern of behaviour that can escalate. The university should carry out a risk assessment and consider protective measures such as timetable or accommodation changes, no-contact arrangements, restrictions on the alleged perpetrator’s access to certain buildings or online systems, and adjustments to reduce the chance of contact.

3. Preserve and gather evidence. For cyberbullying and cyberstalking this means keeping messages, emails, social media posts, screenshots with dates and times, call logs and any witness accounts. The university should advise the student to preserve this rather than delete it.

4. Offer support independently of any investigation. This includes wellbeing and counselling services, academic mitigation such as extensions or deferrals, and signposting to specialist support such as the National Stalking Helpline run by the Suzy Lamplugh Trust, and to the police where appropriate. Support should not be conditional on the student pursuing a formal complaint.

5. Consider the interaction with the criminal process. Where the conduct may be a criminal offence, the university should explain the option of reporting to the police and should not obstruct or discourage that. It should have a policy on how it handles matters that are also potentially criminal, including whether and how to run an internal process in parallel, and how to avoid prejudicing a police investigation. It is common, and generally appropriate, to pause or adjust an internal investigation if the police ask, but the university can still take precautionary protective measures in the meantime.

6. Investigate under the disciplinary or student conduct code. Where the alleged perpetrator is a student, the matter should be investigated fairly under the university’s disciplinary procedures, applying the civil standard (balance of probabilities), not the criminal standard. The process should be fair to both parties, with the accused told the allegations and given a chance to respond. Where the perpetrator is a staff member, staff disciplinary procedures apply instead.

7. Take proportionate disciplinary action if the allegation is upheld. Sanctions can range from warnings, behaviour contracts and no-contact orders through to suspension or expulsion for serious cases, and for staff, up to dismissal.

8. Deal appropriately with external perpetrators. If the harasser is not connected to the university, its disciplinary powers do not reach them, but it can still support the student, adjust arrangements, involve security, and help the student engage the police or pursue civil remedies.

Distinguishing stalking from other conduct

It is worth being precise, because the label affects the response. Stalking is a course of conduct amounting to harassment where the behaviour is associated with stalking, such as following, monitoring, contacting or watching a person, and it is dealt with under the Protection from Harassment Act 1997 (as amended to create specific stalking offences). It requires a course of conduct, meaning conduct on at least two occasions. A single unpleasant message is unlikely to meet that test, though it may still breach conduct rules.

Cyberbullying is not itself a single defined criminal offence. Depending on what actually happened, the same behaviour might amount to harassment or stalking under the 1997 Act, to offences under the Communications Act 2003 or the Malicious Communications Act 1988, to threats, to offences relating to sharing intimate images, or to nothing criminal at all but still a breach of the university’s behaviour and IT-use policies. Before treating conduct as unlawful, it is worth identifying exactly what was done, how often, by whom, and with what effect, because an isolated rude comment, a heated academic disagreement, or a one-off falling-out is materially different from a sustained targeted campaign, and the two should not be treated the same way.

If the university does not act properly

If a student reports stalking or cyberbullying and the university fails to respond appropriately, the student has escalation routes.

They can use the university’s internal complaints procedure to challenge how the report was handled. If that is exhausted and the student remains dissatisfied, they can complain to the Office of the Independent Adjudicator for Higher Education, which reviews how universities have handled matters and can recommend remedies. Concerns that a university is systematically failing to meet its regulatory obligations can also be raised with the Office for Students, although the OfS regulates providers rather than resolving individual disputes.

Separately from anything the university does, the student can report the conduct to the police, and can seek civil remedies, including an injunction and damages under the Protection from Harassment Act 1997. In cases of serious risk, the police can also apply for a stalking protection order.

Key facts that change the answer

The most sensible next steps depend on several things it would help to know: whether the alleged perpetrator is a student, staff member or an outsider; whether the conduct is a repeated course of conduct or a one-off; whether there is any immediate safety risk; what evidence exists; whether the police are already involved; and whether the student wants formal action or only support and protection. If you can tell me which of these applies, I can set out the most appropriate route in more detail.

Practical next steps

1. Preserve all evidence of the conduct, with dates, times and sources.

2. Make a written report through the university’s report-and-support route and ask for a risk assessment and interim protective measures.

3. Access the university’s support services and, for stalking, contact the National Stalking Helpline.

4. Consider reporting to the police, especially where there is any threat, escalation or fear for safety.

5. If the university mishandles the matter, use its internal complaints process and then, if needed, the Office of the Independent Adjudicator, and keep in mind the option of civil remedies under the Protection from Harassment Act 1997.