University duty of care after spiking

Overview

Spiking, meaning secretly putting alcohol or drugs into someone’s drink or body without their consent, is a criminal offence in England and Wales. It can be prosecuted under the Offences Against the Person Act 1861 (administering a noxious substance) and, where relevant, sexual offences legislation or the Modern Slavery framework. The Criminal Justice Act 2025 has been used by the Government to create a more specific spiking offence to improve clarity and reporting.

A university is not the police and is not a criminal court. Its responsibilities after an alleged spiking fall into several distinct categories: immediate welfare and safeguarding, supporting a report to the police if the student wishes, handling any internal disciplinary process if the alleged perpetrator is also a student or staff member, and its general duty of care and health and safety obligations. What the university can and must do depends heavily on who the alleged perpetrator is, where the incident happened, and what the student wants to happen.

Immediate welfare and safeguarding

The most important and immediate responsibility is the welfare of the affected student. Universities UK guidance on spiking sets out that staff should stay with the person, provide reassurance and support, seek urgent medical help by calling 999 or 111 or using university healthcare where the person is unwell, and, with the student’s agreement, support them to report to the police at the earliest opportunity. Early medical attention matters because many spiking substances leave the body quickly, so prompt testing can be important for evidence.

A university that runs its own venues, halls, security or events has a practical safeguarding role in that moment: getting the person to safety, preventing further harm, and preserving anything that might be evidence, such as the drink itself.

Duty of care and health and safety

Higher education providers owe students a general duty of care to deliver educational and pastoral services to the standard of an ordinarily competent institution, and are expected to act reasonably to protect the health, safety and welfare of their students. It is worth being precise about this: the existence and exact scope of a legal duty of care between universities and students has not been extensively tested in the courts, so this is not an unlimited guarantee of safety.

Where the university controls the premises, for example a students’ union bar, a campus venue or halls of residence, it also has obligations under the Health and Safety at Work etc. Act 1974 and occupiers’ liability principles to take reasonable steps for the safety of people on its premises. That can include measures such as drink protection lids, trained and vigilant door and bar staff, CCTV, clear reporting routes and awareness campaigns. A failure to take reasonable preventative steps could in principle be relevant to a negligence claim, but liability would depend on showing that the university fell below a reasonable standard and that this caused harm, which is a demanding test.

The new regulatory duty on harassment and sexual misconduct

From August 2024, registered higher education providers in England are subject to a specific Office for Students condition of registration on harassment and sexual misconduct. Where a spiking incident is linked to sexual assault or misconduct, this regulatory framework is directly engaged. It requires providers to have clear policies, accessible reporting routes, fair and prompt investigation processes, and appropriate support for those affected. Even where spiking is not sexual in nature, most universities treat it within their broader student conduct, safeguarding and harassment frameworks.

Internal investigation and disciplinary action

If the person accused of spiking is a student or member of staff of the same university, the university generally has the power, and often a responsibility under its own regulations, to investigate under its student conduct or staff disciplinary procedures. This is separate from and runs alongside any police investigation. The university’s process is not a criminal trial: it usually applies the civil standard of proof, the balance of probabilities, rather than the criminal standard of beyond reasonable doubt.

A university disciplinary process must be procedurally fair to both the complainant and the accused. That typically means a proper investigation, telling the accused the allegations, giving them a chance to respond, an impartial decision-maker, and a right of appeal. Universities frequently pause or coordinate internal proceedings where there is a live police investigation, to avoid prejudicing the criminal case, but they are not automatically required to wait for the criminal process to conclude.

Where the alleged perpetrator is not connected to the university, for example a stranger in an unaffiliated city-centre venue, the university’s disciplinary powers do not reach that person. Its role then is confined to welfare support, safeguarding, and helping the student engage with the police.

Supporting the police report

The university’s role is to support and facilitate a report to the police, not to substitute for it. The decision to report normally rests with the affected student, except where there is a serious safeguarding concern, a risk to others, or a legal reporting obligation, in which case the university may need to act even without consent. Universities should preserve evidence where they can, share relevant information such as CCTV with the police in accordance with data protection law, and keep the student informed and supported throughout.

Support and adjustments for the affected student

Beyond the incident itself, universities are generally expected to offer ongoing support. This can include counselling and wellbeing services, safety measures such as changing accommodation or timetables, reasonable academic adjustments or extensions and mitigating circumstances arrangements, and specialist referrals. If the student has developed a mental health condition as a result, disability-related duties under the Equality Act 2010 may also be engaged, requiring reasonable adjustments.

Data protection and confidentiality

The university must handle the student’s personal and sensitive information carefully and in line with UK GDPR and the Data Protection Act 2018. Health information and information about alleged crimes are special category or sensitive data. Sharing with the police, security or internal panels must be proportionate and justified, and the student should ordinarily be kept informed about how their information is used.

Where the answer depends on further facts

The precise responsibilities turn on several things that are not yet clear:

1. Who is alleged to have done the spiking, in particular whether they are a student, staff member or an outsider, because this determines whether the university has any disciplinary jurisdiction at all.

2. Where it happened, in particular whether it was on university or students’ union premises or at a university-organised event, because this affects health and safety and occupiers’ obligations.

3. Whether the spiking is linked to a sexual assault, which engages the specific harassment and sexual misconduct regulatory duty and additional support obligations.

4. What the affected student wants, since consent normally governs whether and when police involvement and internal action proceed.

5. Which university it is, because each institution’s own student conduct regulations, complaints procedure and support policies are binding on it and set out exactly what it has promised to do.

Practical next steps

1. Ensure the affected student is safe and has received any needed medical attention, and preserve evidence, including seeking prompt medical testing, since some substances clear quickly.

2. Report the incident to the police if the student is willing, and ask the university to support that report and preserve CCTV and other evidence.

3. Obtain and read the specific university’s student conduct or disciplinary policy, safeguarding policy, harassment and sexual misconduct policy, and support procedures, so you can hold it to its own published commitments.

4. Ask the university in writing what welfare support, safety measures and academic adjustments it will provide, and request confirmation of any internal investigation if a student or staff member is implicated.

5. If the university fails to respond appropriately, use its internal complaints procedure, and if that is exhausted without a satisfactory outcome, a student can escalate to the Office of the Independent Adjudicator for Higher Education. Regulatory failings around harassment and sexual misconduct can also be raised with the Office for Students.

6. If there is evidence that a failure to take reasonable safety measures caused harm, a negligence or personal injury claim may in principle be possible, but that is a distinct and evidentially demanding route that should be assessed on its specific facts.

If you tell me who the alleged perpetrator is, where the incident happened, whether it involved any sexual element, and which university is involved, I can give a much more targeted explanation of exactly what that institution is obliged to do and what you can require of it.