Social media policy: official accounts, personal posts and incidents

A designer posts a photograph from the office kitchen. In the background, a whiteboard shows a client's launch date and a half-finished pricing table. Nobody meant harm. The post was liked forty times before a manager noticed. Most social media trouble looks like this: small, quick and public.

A social media policy sets the rules for two different things. One is the company's own accounts. The other is what employees say about the company, its clients and their work on their personal accounts. It sits beside the code of conduct and the confidentiality rules, and it is one of the documents covered under HR policies and governance. For the order in which to write it, see the 30 policies a growing company needs.

Scope is the first thing to settle. The policy should cover employees, directors, interns, consultants and anyone else who posts on the company's behalf. It should name the platforms in use today and say that new or niche platforms, including messaging groups and review sites, fall under the same rules.

• Official accounts: pages, handles, channels and community groups opened in the company's name.
• Personal accounts: anything a person runs in their own name, whether or not it mentions work.
• Employee reference to the workplace: a post that names the company, a client, a product or a colleague.
• Impersonation: a fake profile, page or group that uses the company's name, logo or a leader's identity.

Every official account needs an account owner, who is accountable for it, and a short list of authorised administrators, who can post. Credentials belong in a company password manager, never in a personal notes app. When an administrator leaves, access is removed on the last working day, and the password and recovery email are changed the same day.

Approval is the decision most companies get wrong in one of two ways. Either every post waits for the founder, or nobody reviews anything. A middle path works better: routine posts such as job openings and event notices are approved by the account owner, while posts about clients, pricing, layoffs, legal matters or anything controversial need a second approver.

1. 1

   Draft

   The administrator writes the post and attaches any image, link or testimonial.

2. 2

   Check

   The administrator confirms the content has no client data, no unreleased product detail and no licensed material used without permission.

3. 3

   Approve

   The account owner approves routine posts. Sensitive posts also need the second approver named in the policy.

4. 4

   Publish and log

   The administrator posts and records it in the content calendar with the approver's name and date.

5. 5

   Monitor

   Comments and messages are checked on a set rhythm, and negative or hostile ones follow the escalation route below.

• Confidential information and customer data: no client names, screenshots of internal tools, or personal details unless the client has agreed in writing.
• Workplace photographs: no visible screens, whiteboards, badges or documents, and consent from every identifiable person.
• Customer testimonials: written permission, a record of the exact words approved, and a way to withdraw.
• Copyright, trademarks and licensed content: images, fonts, music and quotes need a licence or a clear right to use.
• Advertising disclosures: paid, sponsored or incentivised endorsements must be marked as such. Check the current rules with a professional.

Staff have a right to a private life, and the law protects some kinds of expression. The policy should therefore avoid broad bans on opinions. It should ask three things of employees: do not disclose confidential information, do not speak as the company unless authorised, and do not harass, threaten or defame colleagues or customers online.

Decide how far the policy reaches into off-hours behaviour. A sensible line is that personal posts become a company matter when they identify the company, harm a colleague or breach a confidentiality duty. Public statements and controversial topics are the grey area. Many companies ask staff to make clear that views are personal, and to leave company statements to the authorised spokespersons.

An incident is any post, comment or fake account that could harm the company, a client or an employee. The policy should say who to tell, how fast, and who decides on takedown requests, public replies or involvement of the police. Keep one named person on call for this, with a deputy. Harassment of an employee through social media should be routed to the grievance or harassment channel, with restricted access and confidential case handling, not into the public comment queue.

Media and external enquiries go to the authorised spokesperson, and staff are told not to answer journalists, even informally. Impersonation is reported to the platform and to the account owner, with screenshots and the URL saved as evidence.

Say in general terms that a breach may lead to disciplinary action, and that the response depends on intent, harm and repetition. Whether to add a stricter step for deliberate disclosure is a decision for management.

• Account register: platform, handle, owner, administrators, recovery contact and date of last password change.
• Post approval log and content calendar.
• Testimonial and photograph consent forms.
• Incident log with timeline, action taken and closure date.
• Employee acknowledgement: read, understood and accepted, with date and policy version.

1. Purpose and scope: [company name] policy for official and personal use of social media.
2. Definitions: official account, personal account, spokesperson, confidential information.
3. Official accounts: owner [role], administrators [roles], credentials held in [vault].
4. Approval: routine posts approved by [role]; sensitive posts need [role] and [role].
5. Personal use: staff speak for themselves, not the company, and do not share [categories].
6. Photographs, testimonials and licensed content: written consent from [who] before posting.
7. Incidents: report to [role] within [number] hours; decision on takedown by [role].
8. Breaches: handled under the [disciplinary policy name].
9. Review: owner [role], reviewed every [number] months, version [number].
10. Acknowledgement: employee name, date, policy version.

Review the policy when a new platform becomes important, after any serious incident, and on a fixed cycle. Brief new joiners during onboarding, and remind account administrators when a campaign or rebrand begins.